Les cookies nous permettent de vous proposer nos services plus facilement. En utilisant nos services, vous nous donnez expressément votre accord pour exploiter ces cookies.En savoir plus OK

Guide-de-l-utilisateur-des-telephones-IP-sans-fil-Cisco-8821-et-8821-EX-Premiere-publication-2016-06-29-Derniere-modification-:-2019-12-13

Revenir à l'accueil

Cliquez sur le pdf pour le télécharger

VOIR EGALEMENT : DOCUMENTATION CISCO

Affectation-statique-d-ID-d-unite-de-numerotation-ou-de-manuel-sur-les-Commutateurs-SG550XG-et-SG350XG.html

CHAPTER-6-1-System-Administration-Guide-for-Cisco-Unity-Connection-Release-10-x-6-System-Distribution-List.html

Cisco-Integrated-Services-Routers-Performance-Overview-2013.html

Cisco-IOS-Configuration-Fundamentals-Command-Reference-April-2010.html

Cisco-IP-Communicator-version-2.0-en-Francais.html

Cisco-Prime-Network-3.10-User-Guide-November-2012.html

CISCO-VALIDATED-DESIGN-September-2018-Solution-1-1-Software-Defined-Access-Deployment-Guide.html

Cisco-Wireless-Solutions-Software-Compatibility-Matrix-Last-Updated-December-12-2017.html

Ciscowebex_150409-Japonais.html

Configuration-et-cablage-des-gammes-de-routeurs-d-acces-Cisco-850-et-Cisco-870-Guide-de-demarrage-rapide.html

Customer-Journey-Analyzer-User-Guide-First-Published:-2019-02-18-Last-Modified-2020-02-25.html

Data-Sheet-Cisco-220-Series-Smart-Switches.html

Guide-de-l'utilisateur-des-telephones-IP-Cisco-Unified-7941G-7941G-GE-7942-7961G-7961G-GE-et-7962-pour-Cisco-Unified-Communications-Manager-9.0-SCCP-et-SIP-Premiere-publication-1-Janvier-2012-Derniere-modification-18-Ju.html

Guide-de-l'utilisateur-du-telephone-IP-Cisco-Unified-7931G-pour-Cisco-Unified-Communications-Manager-9.0-SCCP-et-SIP.html

Guide-de-l-utilisateur-des-telephones-IP-Cisco-7811-7821-7841-et-7861-pour-Cisco-Unified-Communications-Manager-10-0-SIP-Premiere-publication-05-Mai-2015.html

Guide-de-l-utilisateur-des-telephones-IP-Cisco-8800-Series-Premiere-publication-2015-11-25-Derniere-modification-2020-01-23.html

Guide-de-l-utilisateur-des-telephones-IP-Cisco-serie-7800-Premiere-publication-2015-11-25-Derniere-modification-2019-09-05.html

Guide-de-l-utilisateur-des-telephones-IP-Cisco-Unified-6921-6941-6945-et-6961-pour-Cisco-Unified-Communications-Manager-10-0-SCCP-et-SIP-Premiere-publication-14-Novembre-2013.html

Guide-de-l-utilisateur-des-telephones-IP-Cisco-Unified-8941-et-8945-pour-Cisco-Unified-Communications-Manager-10-0-SCCP-et-SIP-Premiere-publication-09-Janvier-2014-Derniere-modification-13-Janvier-2014.html

Guide-de-l-utilisateur-des-telephones-IP-sans-fil-Cisco-8821-et-8821-EX-Premiere-publication-2016-06-29-Derniere-modification-:-2019-12-13.html

Guide-de-l-utilisateur-du-bureau-Cisco-Finesse-des-agents-et-superviseurs-version-12-5-1-Premiere-publication-27-Janvier-2020.html

Le-telephone-IP-Cisco-serie-7800-Les-modeles-de-telephones-IP-Cisco-7811-7821-7841-et-7861.html

Manuel-des-telephones-IP-Cisco-Unified-7960G-et-7940G-pour-Cisco-Unified-Communications-Manager-7-0-SCCP.html

Manuel-du-telephone-Cisco-Unified-IP-Conference-Station-7937G-pour-Cisco-Unified-Communications-Manager-6-0.html

Manuel-du-telephone-Cisco-Unified-IP-Conference-Station-7937G-pour-Cisco-Unified-Communications-Manager-6.0.html

Manuel-du-telephone-IP-Cisco-Unified-7961G-7961G-GE-7941G-7941G-GE-pour-Cisco-Unified-Communications-Manager-6-1-SCCP-et-SIP.html

Manuel-du-telephone-sans-fil-IP-Cisco-Unified-7921G-pour-Cisco-Unified-Communications-Manager-7.0.html

Manuel_d_utilisation_des_cisco_spa525g.html

Manuel_d_utilisation_des_cisco_spa5xx.html

Mode-de-introduction-manuel-de-profil-de-configuration-d'IPSec-sur-RV160-et-RV260.html

Nom-d-utilisateur-et-mot-de-passe-par-defaut-pour-Cisco-Transport-Controller.html

Orchestrator-de-maree-d-entreprise-editez-satisfait-livre-par-Cisco.html

sitemap.txt

Telephones-IP-Cisco-Unified-7970-pour-Cisco-Unified-CallManager-5-1-SCCP-et-SIP.html

Understanding-Layer-3-Ether-Channel-Support-on-the-Cisco-Integrated-Services-Router.html

User-Guide-for-the-Cisco-Application-Networking-Manager-5-2-February-2012.html

single-space CF-324 menu clear-screen CF-325 menu command CF-327 menu default CF-329 menu line-mode CF-330 menu options CF-332 menu prompt CF-333 menu status-line CF-334 menu text CF-335 Contents ix Cisco IOS Configuration Fundamentals Command Reference April 2010 menu title CF-337 microcode (12000) CF-339 microcode (7000/7500) CF-341 microcode (7200) CF-343 microcode reload (12000) CF-345 microcode reload (7000/7500) CF-347 microcode reload (7200) CF-348 mkdir CF-349 mkdir disk0: CF-351 mode CF-352 CF-355 monitor event-trace (EXEC) CF-356 monitor event-trace (global) CF-359 monitor event-trace dump-traces CF-362 monitor permit-list CF-363 monitor session egress replication-mode CF-365 monitor session type CF-367 mop device-code CF-375 mop retransmit-timer CF-376 mop retries CF-377 more CF-378 more begin CF-381 more exclude CF-383 more include CF-385 more flh:logfile CF-387 motd-banner CF-389 name-connection CF-391 no menu CF-392 notify CF-393 notify syslog CF-394 padding CF-396 parity CF-397 parser cache CF-399 parser command serializer CF-400 parser config cache interface CF-401 Contents x Cisco IOS Configuration Fundamentals Command Reference April 2010 parser config partition CF-403 partition CF-405 path (archive configuration) CF-407 periodic CF-411 ping CF-414 ping (privileged) CF-418 ping ip CF-421 ping vrf CF-425 platform shell CF-428 power enable CF-429 power redundancy-mode CF-430 printer CF-431 private CF-433 privilege CF-434 process cpu statistics limit entry-percentage CF-439 process cpu threshold type CF-440 process-max-time CF-442 prompt CF-443 pwd CF-445 refuse-message CF-446 reload CF-447 remote command CF-451 remote login CF-453 remote-span CF-455 rename CF-456 request platform software package describe file CF-457 request platform software package expand file CF-463 request platform software package install commit CF-466 request platform software package install file CF-468 request platform software package install rollback CF-477 request platform software package install snapshot CF-479 request platform software process release CF-481 request platform software system shell CF-483 request platform software shell session output format CF-484 request platform software vty attach CF-487 Contents xi Cisco IOS Configuration Fundamentals Command Reference April 2010 revision CF-488 rmdir CF-490 rommon-pref CF-492 route-converge-interval CF-494 rsh CF-496 scheduler allocate CF-498 scheduler heapcheck process CF-500 scheduler interrupt mask profile CF-502 scheduler interrupt mask size CF-503 scheduler interrupt mask time CF-504 scheduler interval CF-505 send CF-506 service compress-config CF-508 service config CF-510 service counters max age CF-512 service decimal-tty CF-514 service exec-wait CF-515 service finger CF-516 service hide-telnet-address CF-517 service linenumber CF-518 service nagle CF-520 service prompt config CF-521 service sequence-numbers CF-522 service slave-log CF-523 service tcp-keepalives-in CF-524 service tcp-keepalives-out CF-525 service tcp-small-servers CF-526 service telnet-zero-idle CF-527 service timestamps CF-528 service udp-small-servers CF-533 service-module apa traffic-management CF-534 service-module wlan-ap bootimage CF-536 service-module wlan-ap reload CF-538 service-module wlan-ap reset CF-540 service-module wlan-ap session CF-542 Contents xii Cisco IOS Configuration Fundamentals Command Reference April 2010 service-module wlan-ap statistics CF-544 service-module wlan-ap status CF-545 session slot CF-546 set memory debug incremental starting-time CF-547 setup CF-548 show CF-555 show append CF-557 show begin CF-558 show exclude CF-560 show include CF-562 show redirect CF-564 show section CF-565 show tee CF-567 show (Flash file system) CF-569 show aliases CF-578 show alignment CF-579 show archive CF-582 show archive config differences CF-584 show archive config incremental-diffs CF-587 show archive config rollback timer CF-589 show archive log config CF-591 show async bootp CF-595 show autoupgrade configuration unknown CF-596 show bootflash: CF-598 show bootvar CF-600 show buffers CF-603 show buffers summary CF-609 show c2600 CF-611 show c7200 CF-614 show catalyst6000 CF-615 show cls CF-617 show config id CF-619 show configuration lock CF-621 show context CF-625 show controllers (GRP image) CF-628 Contents xiii Cisco IOS Configuration Fundamentals Command Reference April 2010 show controllers (line card image) CF-630 show controllers logging CF-638 show controllers tech-support CF-640 show coverage history CF-642 show data-corruption CF-643 show debugging CF-644 show declassify CF-646 show derived-config CF-648 show diagnostic cns CF-651 show diagnostic sanity CF-652 show disk CF-657 show disk0: CF-659 show disk1: CF-662 show environment CF-665 show environment alarm CF-691 show environment cooling CF-694 show environment status CF-695 show environment temperature CF-698 show errdisable detect CF-701 show errdisable recovery CF-702 show fastblk CF-703 show file descriptors CF-705 show file information CF-706 show file systems CF-708 show flh-log CF-710 show fm inspect CF-711 show fm interface CF-713 show fm reflexive CF-716 show fm summary CF-717 show funi CF-718 show identity policy CF-722 show identity profile CF-723 show gsr CF-724 show gt64010 (7200) CF-725 show hardware CF-727 Contents xiv Cisco IOS Configuration Fundamentals Command Reference April 2010 show health-monitor CF-729 show history CF-730 show history all CF-732 show hosts CF-735 show html CF-738 show idb CF-740 show idprom CF-741 show inventory CF-747 show logging CF-750 show logging count CF-756 show logging history CF-758 show logging system CF-760 show logging xml CF-763 show memory CF-765 show memory allocating-process CF-770 show memory dead CF-773 show memory debug incremental CF-775 show memory debug leaks CF-778 show memory debug references CF-783 show memory debug unused CF-785 show memory ecc CF-787 show memory events CF-789 show memory failures alloc CF-791 show memory fast CF-792 show memory fragment CF-795 show memory multibus CF-798 show memory pci CF-800 show memory processor CF-802 show memory scan CF-806 show memory statistics history table CF-808 show memory traceback CF-811 show memory transient CF-813 show microcode CF-815 show mls statistics CF-817 show module CF-820 Contents xv Cisco IOS Configuration Fundamentals Command Reference April 2010 show monitor event-trace CF-823 CF-829 show monitor permit-list CF-830 show monitor session CF-831 show msfc CF-836 show pagp CF-840 show parser dump CF-842 show parser macro CF-854 show parser statistics CF-856 show pci CF-859 show pci hardware CF-861 show perf-meas CF-863 show platform CF-865 show platform bridge CF-876 show platform cfm CF-878 show platform diag CF-880 show platform hardware capacity CF-883 show platform isg CF-890 show platform oam CF-891 show platform redundancy CF-892 show platform software filesystem CF-894 show platform software memory CF-897 show platform software mount CF-903 show platform software process list CF-907 show platform software tech-support CF-914 show platform supervisor CF-916 show power CF-917 show processes CF-921 show processes cpu CF-928 show processes interrupt mask buffer CF-936 show processes interrupt mask detail CF-938 show processes memory CF-940 CF-950 show protocols CF-951 show region CF-954 Contents xvi Cisco IOS Configuration Fundamentals Command Reference April 2010 show registry CF-957 show reload CF-960 show resource-pool queue CF-961 show rom-monitor CF-963 show rom-monitor slot CF-966 show running identity policy CF-968 show running identity profile CF-969 show running-config CF-970 show running-config control-plane CF-976 show running-config map-class CF-977 show running-config partition CF-980 show scp CF-983 show slot CF-985 show slot0: CF-988 show slot1: CF-991 show software authenticity file CF-994 show software authenticity keys CF-996 show software authenticity running CF-998 show software authenticity upgrade-status CF-1000 show stacks CF-1002 show startup-config CF-1004 show subsys CF-1005 show sup-bootflash CF-1007 show sysctrl CF-1010 show system jumbomtu CF-1013 show tech-support CF-1014 show template CF-1021 show usb controllers CF-1022 show usb device CF-1024 show usb driver CF-1027 show usb port CF-1029 show usb tree CF-1030 show usbtoken CF-1031 show version CF-1033 show warm-reboot CF-1052 Contents xvii Cisco IOS Configuration Fundamentals Command Reference April 2010 show whoami CF-1053 showmon CF-1054 slave auto-sync config CF-1056 slave default-slot CF-1058 slave image CF-1060 slave reload CF-1062 slave sync config CF-1063 slave terminal CF-1065 special-character-bits CF-1066 squeeze CF-1067 stack-mib portname CF-1070 state-machine CF-1071 stopbits CF-1073 storm-control level CF-1074 sync-restart-delay CF-1076 system flowcontrol bus CF-1077 system jumbomtu CF-1078 tdm clock priority CF-1080 terminal databits CF-1082 terminal data-character-bits CF-1083 terminal dispatch-character CF-1084 terminal dispatch-timeout CF-1085 terminal download CF-1086 terminal editing CF-1087 terminal escape-character CF-1088 terminal exec-character-bits CF-1089 terminal flowcontrol CF-1090 terminal full-help CF-1091 terminal history CF-1093 terminal history size CF-1095 terminal hold-character CF-1097 terminal international CF-1099 terminal keymap-type CF-1100 terminal length CF-1101 terminal monitor CF-1102 Contents xviii Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal notify CF-1103 terminal padding CF-1104 terminal parity CF-1105 terminal rxspeed CF-1106 terminal special-character-bits CF-1107 terminal speed CF-1109 terminal start-character CF-1110 terminal stopbits CF-1111 terminal stop-character CF-1112 terminal telnet break-on-ip CF-1113 terminal telnet refuse-negotiations CF-1114 terminal telnet speed CF-1115 terminal telnet sync-on-break CF-1116 terminal telnet transparent CF-1117 terminal terminal-type CF-1118 terminal txspeed CF-1119 terminal width CF-1120 terminal-queue entry-retry-interval CF-1121 terminal-type CF-1122 test cable-diagnostics CF-1123 test flash CF-1125 test interfaces CF-1126 test memory CF-1127 test memory destroy CF-1128 test platform police get CF-1129 test platform police set CF-1130 tftp-server CF-1132 tftp-server system CF-1135 time-period CF-1136 trace (privileged) CF-1138 trace (user) CF-1142 traceroute CF-1145 traceroute mac CF-1148 undelete CF-1152 upgrade automatic abortversion CF-1154 Contents xix Cisco IOS Configuration Fundamentals Command Reference April 2010 upgrade automatic getversion CF-1156 upgrade automatic runversion CF-1159 upgrade filesystem monlib CF-1161 upgrade rom-monitor CF-1162 upgrade rom-monitor file CF-1167 upgrade rom-monitor preference CF-1171 vacant-message CF-1172 verify CF-1174 vtp CF-1179 warm-reboot CF-1182 where CF-1184 width CF-1185 write core CF-1186 write erase CF-1188 write memory CF-1189 write terminal CF-1190 xmodem CF-1191 ASCII Character Set and Hexadecimal Values CF-1193 Contents xx Cisco IOS Configuration Fundamentals Command Reference April 2010 xxi Cisco IOS Configuration Fundamentals Command Reference April 2010 About Cisco IOS Software Documentation Last Updated: March 26, 2010 This document describes the objectives, audience, conventions, and organization used in Cisco IOS software documentation. Also included are resources for obtaining technical assistance, additional documentation, and other information from Cisco. This document is organized into the following sections: • Documentation Objectives, page xxi • Audience, page xxi • Documentation Conventions, page xxi • Documentation Organization, page xxiii • Additional Resources and Documentation Feedback, page xxxi Documentation Objectives Cisco IOS documentation describes the tasks and commands available to configure and maintain Cisco networking devices. Audience The Cisco IOS documentation set is intended for users who configure and maintain Cisco networking devices (such as routers and switches) but who may not be familiar with the configuration and maintenance tasks, the relationship among tasks, or the Cisco IOS commands necessary to perform particular tasks. The Cisco IOS documentation set is also intended for those users experienced with Cisco IOS software who need to know about new features, new configuration options, and new software characteristics in the current Cisco IOS release. Documentation Conventions In Cisco IOS documentation, the term router may be used to refer to various Cisco products; for example, routers, access servers, and switches. These and other networking devices that support Cisco IOS software are shown interchangeably in examples and are used only for illustrative purposes. An example that shows one product does not necessarily mean that other products are not supported. About Cisco IOS Software Documentation Documentation Conventions xxii Cisco IOS Configuration Fundamentals Command Reference April 2010 This section contains the following topics: • Typographic Conventions, page xxii • Command Syntax Conventions, page xxii • Software Conventions, page xxiii • Reader Alert Conventions, page xxiii Typographic Conventions Cisco IOS documentation uses the following typographic conventions: Command Syntax Conventions Cisco IOS documentation uses the following command syntax conventions: Convention Description ^ or Ctrl Both the ^ symbol and Ctrl represent the Control (Ctrl) key on a keyboard. For example, the key combination ^D or Ctrl-D means that you hold down the Control key while you press the D key. (Keys are indicated in capital letters but are not case sensitive.) string A string is a nonquoted set of characters shown in italics. For example, when setting a Simple Network Management Protocol (SNMP) community string to public, do not use quotation marks around the string; otherwise, the string will include the quotation marks. Convention Description bold Bold text indicates commands and keywords that you enter as shown. italic Italic text indicates arguments for which you supply values. [x] Square brackets enclose an optional keyword or argument. ... An ellipsis (three consecutive nonbolded periods without spaces) after a syntax element indicates that the element can be repeated. | A vertical line, called a pipe, that is enclosed within braces or square brackets indicates a choice within a set of keywords or arguments. [x | y] Square brackets enclosing keywords or arguments separated by a pipe indicate an optional choice. {x | y} Braces enclosing keywords or arguments separated by a pipe indicate a required choice. [x {y | z}] Braces and a pipe within square brackets indicate a required choice within an optional element. About Cisco IOS Software Documentation Documentation Organization xxiii Cisco IOS Configuration Fundamentals Command Reference April 2010 Software Conventions Cisco IOS software uses the following program code conventions: Reader Alert Conventions Cisco IOS documentation uses the following conventions for reader alerts: Caution Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data. Note Means reader take note. Notes contain helpful suggestions or references to material not covered in the manual. Timesaver Means the described action saves time. You can save time by performing the action described in the paragraph. Documentation Organization This section describes the Cisco IOS documentation set, how it is organized, and how to access it on Cisco.com. It also lists the configuration guides, command references, and supplementary references and resources that comprise the documentation set. It contains the following topics: • Cisco IOS Documentation Set, page xxiv • Cisco IOS Documentation on Cisco.com, page xxiv • Configuration Guides, Command References, and Supplementary Resources, page xxv Convention Description Courier font Courier font is used for information that is displayed on a PC or terminal screen. Bold Courier font Bold Courier font indicates text that the user must enter. < > Angle brackets enclose text that is not displayed, such as a password. Angle brackets also are used in contexts in which the italic font style is not supported; for example, ASCII text. ! An exclamation point at the beginning of a line indicates that the text that follows is a comment, not a line of code. An exclamation point is also displayed by Cisco IOS software for certain processes. [ ] Square brackets enclose default responses to system prompts. About Cisco IOS Software Documentation Documentation Organization xxiv Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco IOS Documentation Set The Cisco IOS documentation set consists of the following: • Release notes and caveats provide information about platform, technology, and feature support for a release and describe severity 1 (catastrophic), severity 2 (severe), and select severity 3 (moderate) defects in released Cisco IOS software. Review release notes before other documents to learn whether updates have been made to a feature. • Sets of configuration guides and command references organized by technology and published for each standard Cisco IOS release. – Configuration guides—Compilations of documents that provide conceptual and task-oriented descriptions of Cisco IOS features. – Command references—Compilations of command pages in alphabetical order that provide detailed information about the commands used in the Cisco IOS features and the processes that comprise the related configuration guides. For each technology, there is a single command reference that supports all Cisco IOS releases and that is updated at each standard release. • Lists of all the commands in a specific release and all commands that are new, modified, removed, or replaced in the release. • Command reference book for debug commands. Command pages are listed in alphabetical order. • Reference book for system messages for all Cisco IOS releases. Cisco IOS Documentation on Cisco.com The following sections describe the organization of the Cisco IOS documentation set and how to access various document types. Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required. Feature Guides Cisco IOS features are documented in feature guides. Feature guides describe one feature or a group of related features that are supported on many different software releases and platforms. Your Cisco IOS software release or platform may not support all the features documented in a feature guide. See the Feature Information table at the end of the feature guide for information about which features in that guide are supported in your software release. Configuration Guides Configuration guides are provided by technology and release and comprise a set of individual feature guides relevant to the release and technology. Command References Command reference books contain descriptions of Cisco IOS commands that are supported in many different software releases and on many different platforms. The books are organized by technology. For information about all Cisco IOS commands, use the Command Lookup Tool at http://tools.cisco.com/Support/CLILookup or the Cisco IOS Master Command List, All Releases, at http://www.cisco.com/en/US/docs/ios/mcl/allreleasemcl/all_book.html. About Cisco IOS Software Documentation Documentation Organization xxv Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco IOS Supplementary Documents and Resources Supplementary documents and resources are listed in Table 2 on page xxxi. Configuration Guides, Command References, and Supplementary Resources Table 1 lists, in alphabetical order, Cisco IOS software configuration guides and command references, including brief descriptions of the contents of the documents. The Cisco IOS command references contain commands for Cisco IOS software for all releases. The configuration guides and command references support many different software releases and platforms. Your Cisco IOS software release or platform may not support all these technologies. Table 2 lists documents and resources that supplement the Cisco IOS software configuration guides and command references. These supplementary resources include release notes and caveats; master command lists; new, modified, removed, and replaced command lists; system messages; and the debug command reference. For additional information about configuring and operating specific networking devices, and to access Cisco IOS documentation, go to the Product/Technologies Support area of Cisco.com at the following location: http://www.cisco.com/go/techdocs Table 1 Cisco IOS Configuration Guides and Command References Configuration Guide and Command Reference Titles Features/Protocols/Technologies • Cisco IOS AppleTalk Configuration Guide • Cisco IOS AppleTalk Command Reference AppleTalk protocol. • Cisco IOS Asynchronous Transfer Mode Configuration Guide • Cisco IOS Asynchronous Transfer Mode Command Reference LAN ATM, multiprotocol over ATM (MPoA), and WAN ATM. • Cisco IOS Bridging and IBM Networking Configuration Guide • Cisco IOS Bridging Command Reference • Cisco IOS IBM Networking Command Reference Transparent and source-route transparent (SRT) bridging, source-route bridging (SRB), Token Ring Inter-Switch Link (TRISL), and token ring route switch module (TRRSM). Data-link switching plus (DLSw+), serial tunnel (STUN), block serial tunnel (BSTUN); logical link control, type 2 (LLC2), synchronous data link control (SDLC); IBM Network Media Translation, including Synchronous Data Logical Link Control (SDLLC) and qualified LLC (QLLC); downstream physical unit (DSPU), Systems Network Architecture (SNA) service point, SNA frame relay access, advanced peer-to-peer networking (APPN), native client interface architecture (NCIA) client/server topologies, and IBM Channel Attach. • Cisco IOS Broadband Access Aggregation and DSL Configuration Guide • Cisco IOS Broadband Access Aggregation and DSL Command Reference PPP over ATM (PPPoA) and PPP over Ethernet (PPPoE). About Cisco IOS Software Documentation Documentation Organization xxvi Cisco IOS Configuration Fundamentals Command Reference April 2010 • Cisco IOS Carrier Ethernet Configuration Guide • Cisco IOS Carrier Ethernet Command Reference Operations, Administration, and Maintenance (OAM); Ethernet connectivity fault management (CFM); ITU-T Y.1731 fault management functions; Ethernet Local Management Interface (ELMI); MAC address support on service instances, bridge domains, and pseudowire; IEEE 802.3ad Link Bundling; Link Aggregation Control Protocol (LACP) support for Ethernet and Gigabit Ethernet links and EtherChannel bundles; LACP support for stateful switchover (SSO), in service software upgrade (ISSU), Cisco nonstop forwarding (NSF), and nonstop routing (NSR) on Gigabit EtherChannel bundles; and Link Layer Discovery Protocol (LLDP) and media endpoint discovery (MED). • Cisco IOS Configuration Fundamentals Configuration Guide • Cisco IOS Configuration Fundamentals Command Reference Autoinstall, Setup, Cisco IOS command-line interface (CLI), Cisco IOS file system (IFS), Cisco IOS web browser user interface (UI), basic file transfer services, and file management. • Cisco IOS DECnet Configuration Guide • Cisco IOS DECnet Command Reference DECnet protocol. • Cisco IOS Dial Technologies Configuration Guide • Cisco IOS Dial Technologies Command Reference Asynchronous communications, dial backup, dialer technology, dial-in terminal services and AppleTalk remote access (ARA), dial-on-demand routing, dial-out, ISDN, large scale dial-out, modem and resource pooling, Multilink PPP (MLP), PPP, and virtual private dialup network (VPDN). • Cisco IOS Flexible NetFlow Configuration Guide • Cisco IOS Flexible NetFlow Command Reference Flexible NetFlow. • Cisco IOS High Availability Configuration Guide • Cisco IOS High Availability Command Reference A variety of high availability (HA) features and technologies that are available for different network segments (from enterprise access to service provider core) to facilitate creation of end-to-end highly available networks. Cisco IOS HA features and technologies can be categorized in three key areas: system-level resiliency, network-level resiliency, and embedded management for resiliency. • Cisco IOS Intelligent Services Gateway Configuration Guide • Cisco IOS Intelligent Services Gateway Command Reference Subscriber identification, service and policy determination, session creation, session policy enforcement, session life-cycle management, accounting for access and service usage, and session state monitoring. • Cisco IOS Interface and Hardware Component Configuration Guide • Cisco IOS Interface and Hardware Component Command Reference LAN interfaces, logical interfaces, serial interfaces, virtual interfaces, and interface configuration. • Cisco IOS IP Addressing Services Configuration Guide • Cisco IOS IP Addressing Services Command Reference Address Resolution Protocol (ARP), Network Address Translation (NAT), Domain Name System (DNS), Dynamic Host Configuration Protocol (DHCP), and Next Hop Address Resolution Protocol (NHRP). Table 1 Cisco IOS Configuration Guides and Command References (continued) Configuration Guide and Command Reference Titles Features/Protocols/Technologies About Cisco IOS Software Documentation Documentation Organization xxvii Cisco IOS Configuration Fundamentals Command Reference April 2010 • Cisco IOS IP Application Services Configuration Guide • Cisco IOS IP Application Services Command Reference Enhanced Object Tracking (EOT), Gateway Load Balancing Protocol (GLBP), Hot Standby Router Protocol (HSRP), IP Services, Server Load Balancing (SLB), Stream Control Transmission Protocol (SCTP), TCP, Web Cache Communication Protocol (WCCP), User Datagram Protocol (UDP), and Virtual Router Redundancy Protocol (VRRP). • Cisco IOS IP Mobility Configuration Guide • Cisco IOS IP Mobility Command Reference Mobile ad hoc networks (MANet) and Cisco mobile networks. • Cisco IOS IP Multicast Configuration Guide • Cisco IOS IP Multicast Command Reference Protocol Independent Multicast (PIM) sparse mode (PIM-SM), bidirectional PIM (bidir-PIM), Source Specific Multicast (SSM), Multicast Source Discovery Protocol (MSDP), Internet Group Management Protocol (IGMP), and Multicast VPN (MVPN). • Cisco IOS IP Routing: BFD Configuration Guide Bidirectional forwarding detection (BFD). • Cisco IOS IP Routing: BGP Configuration Guide • Cisco IOS IP Routing: BGP Command Reference Border Gateway Protocol (BGP), multiprotocol BGP, multiprotocol BGP extensions for IP multicast. • Cisco IOS IP Routing: EIGRP Configuration Guide • Cisco IOS IP Routing: EIGRP Command Reference Enhanced Interior Gateway Routing Protocol (EIGRP). • Cisco IOS IP Routing: ISIS Configuration Guide • Cisco IOS IP Routing: ISIS Command Reference Intermediate System-to-Intermediate System (IS-IS). • Cisco IOS IP Routing: ODR Configuration Guide • Cisco IOS IP Routing: ODR Command Reference On-Demand Routing (ODR). • Cisco IOS IP Routing: OSPF Configuration Guide • Cisco IOS IP Routing: OSPF Command Reference Open Shortest Path First (OSPF). • Cisco IOS IP Routing: Protocol-Independent Configuration Guide • Cisco IOS IP Routing: Protocol-Independent Command Reference IP routing protocol-independent features and commands. Generic policy-based routing (PBR) features and commands are included. • Cisco IOS IP Routing: RIP Configuration Guide • Cisco IOS IP Routing: RIP Command Reference Routing Information Protocol (RIP). • Cisco IOS IP SLAs Configuration Guide • Cisco IOS IP SLAs Command Reference Cisco IOS IP Service Level Agreements (IP SLAs). • Cisco IOS IP Switching Configuration Guide • Cisco IOS IP Switching Command Reference Cisco Express Forwarding, fast switching, and Multicast Distributed Switching (MDS). • Cisco IOS IPv6 Configuration Guide • Cisco IOS IPv6 Command Reference For IPv6 features, protocols, and technologies, go to the IPv6 “Start Here” document. • Cisco IOS ISO CLNS Configuration Guide • Cisco IOS ISO CLNS Command Reference ISO Connectionless Network Service (CLNS). Table 1 Cisco IOS Configuration Guides and Command References (continued) Configuration Guide and Command Reference Titles Features/Protocols/Technologies About Cisco IOS Software Documentation Documentation Organization xxviii Cisco IOS Configuration Fundamentals Command Reference April 2010 • Cisco IOS LAN Switching Configuration Guide • Cisco IOS LAN Switching Command Reference VLANs, Inter-Switch Link (ISL) encapsulation, IEEE 802.10 encapsulation, IEEE 802.1Q encapsulation, and multilayer switching (MLS). • Cisco IOS Mobile Wireless Gateway GPRS Support Node Configuration Guide • Cisco IOS Mobile Wireless Gateway GPRS Support Node Command Reference Cisco IOS Gateway GPRS Support Node (GGSN) in a 2.5-generation general packet radio service (GPRS) and 3-generation universal mobile telecommunication system (UMTS) network. • Cisco IOS Mobile Wireless Home Agent Configuration Guide • Cisco IOS Mobile Wireless Home Agent Command Reference Cisco Mobile Wireless Home Agent, an anchor point for mobile terminals for which mobile IP or proxy mobile IP services are provided. • Cisco IOS Mobile Wireless Packet Data Serving Node Configuration Guide • Cisco IOS Mobile Wireless Packet Data Serving Node Command Reference Cisco Packet Data Serving Node (PDSN), a wireless gateway that is between the mobile infrastructure and standard IP networks and that enables packet data services in a code division multiple access (CDMA) environment. • Cisco IOS Mobile Wireless Radio Access Networking Configuration Guide • Cisco IOS Mobile Wireless Radio Access Networking Command Reference Cisco IOS radio access network products. • Cisco IOS Multiprotocol Label Switching Configuration Guide • Cisco IOS Multiprotocol Label Switching Command Reference MPLS Label Distribution Protocol (LDP), MPLS Layer 2 VPNs, MPLS Layer 3 VPNs, MPLS traffic engineering (TE), and MPLS Embedded Management (EM) and MIBs. • Cisco IOS Multi-Topology Routing Configuration Guide • Cisco IOS Multi-Topology Routing Command Reference Unicast and multicast topology configurations, traffic classification, routing protocol support, and network management support. • Cisco IOS NetFlow Configuration Guide • Cisco IOS NetFlow Command Reference Network traffic data analysis, aggregation caches, and export features. • Cisco IOS Network Management Configuration Guide • Cisco IOS Network Management Command Reference Basic system management; system monitoring and logging; troubleshooting, logging, and fault management; Cisco Discovery Protocol; Cisco IOS Scripting with Tool Control Language (Tcl); Cisco networking services (CNS); DistributedDirector; Embedded Event Manager (EEM); Embedded Resource Manager (ERM); Embedded Syslog Manager (ESM); HTTP; Remote Monitoring (RMON); SNMP; and VPN Device Manager Client for Cisco IOS software (XSM Configuration). • Cisco IOS Novell IPX Configuration Guide • Cisco IOS Novell IPX Command Reference Novell Internetwork Packet Exchange (IPX) protocol. Table 1 Cisco IOS Configuration Guides and Command References (continued) Configuration Guide and Command Reference Titles Features/Protocols/Technologies About Cisco IOS Software Documentation Documentation Organization xxix Cisco IOS Configuration Fundamentals Command Reference April 2010 • Cisco IOS Optimized Edge Routing Command Reference Optimized edge routing (OER) monitoring and automatic route optimization and load distribution for multiple connections between networks. • Cisco IOS Performance Routing Configuration Guide Performance Routing (PfR) provides additional intelligence to classic routing technologies to track the performance of, or verify the quality of, a path between two devices over a WAN infrastructure in order to determine the best egress or ingress path for application traffic. • Cisco IOS Quality of Service Solutions Configuration Guide • Cisco IOS Quality of Service Solutions Command Reference Traffic queueing, traffic policing, traffic shaping, Modular QoS CLI (MQC), Network-Based Application Recognition (NBAR), Multilink PPP (MLP) for QoS, header compression, AutoQoS, Resource Reservation Protocol (RSVP), and weighted random early detection (WRED). • Cisco IOS Security Command Reference Access control lists (ACLs); authentication, authorization, and accounting (AAA); firewalls; IP security and encryption; neighbor router authentication; network access security; network data encryption with router authentication; public key infrastructure (PKI); RADIUS; TACACS+; terminal access security; and traffic filters. • Cisco IOS Security Configuration Guide: Securing the Data Plane Access Control Lists (ACLs); Firewalls: Context-Based Access Control (CBAC) and Zone-Based Firewall; Cisco IOS Intrusion Prevention System (IPS); Flexible Packet Matching; Unicast Reverse Path Forwarding (uRPF); Threat Information Distribution Protocol (TIDP) and TMS. • Cisco IOS Security Configuration Guide: Securing the Control Plane Control Plane Policing, Neighborhood Router Authentication. • Cisco IOS Security Configuration Guide: Securing User Services AAA (includes 802.1x authentication and Network Admission Control [NAC]); Security Server Protocols (RADIUS and TACACS+); Secure Shell (SSH); Secure Access for Networking Devices (includes Autosecure and Role-Based CLI access); Lawful Intercept. • Cisco IOS Security Configuration Guide: Secure Connectivity Internet Key Exchange (IKE) for IPsec VPNs; IPsec Data Plane features; IPsec Management features; Public Key Infrastructure (PKI); Dynamic Multipoint VPN (DMVPN); Easy VPN; Cisco Group Encrypted Transport VPN (GETVPN); SSL VPN. • Cisco IOS Service Advertisement Framework Configuration Guide • Cisco IOS Service Advertisement Framework Command Reference Cisco Service Advertisement Framework. • Cisco IOS Service Selection Gateway Configuration Guide • Cisco IOS Service Selection Gateway Command Reference Subscriber authentication, service access, and accounting. Table 1 Cisco IOS Configuration Guides and Command References (continued) Configuration Guide and Command Reference Titles Features/Protocols/Technologies About Cisco IOS Software Documentation Documentation Organization xxx Cisco IOS Configuration Fundamentals Command Reference April 2010 • Cisco IOS Software Activation Configuration Guide • Cisco IOS Software Activation Command Reference An orchestrated collection of processes and components to activate Cisco IOS software feature sets by obtaining and validating Cisco software licenses. • Cisco IOS Software Modularity Installation and Configuration Guide • Cisco IOS Software Modularity Command Reference Installation and basic configuration of software modularity images, including installations on single and dual route processors, installation rollbacks, software modularity binding, software modularity processes, and patches. • Cisco IOS Terminal Services Configuration Guide • Cisco IOS Terminal Services Command Reference DEC, local-area transport (LAT), and X.25 packet assembler/disassembler (PAD). • Cisco IOS Virtual Switch Command Reference Virtual switch redundancy, high availability, and packet handling; converting between standalone and virtual switch modes; virtual switch link (VSL); Virtual Switch Link Protocol (VSLP). Note For information about virtual switch configuration, see the product-specific software configuration information for the Cisco Catalyst 6500 series switch or for the Metro Ethernet 6500 series switch. • Cisco IOS Voice Configuration Library • Cisco IOS Voice Command Reference Cisco IOS support for voice call control protocols, interoperability, physical and virtual interface management, and troubleshooting. The library includes documentation for IP telephony applications. • Cisco IOS VPDN Configuration Guide • Cisco IOS VPDN Command Reference Layer 2 Tunneling Protocol (L2TP) dial-out load balancing and redundancy; L2TP extended failover; L2TP security VPDN; multihop by Dialed Number Identification Service (DNIS); timer and retry enhancements for L2TP and Layer 2 Forwarding (L2F); RADIUS Attribute 82 (tunnel assignment ID); shell-based authentication of VPDN users; tunnel authentication via RADIUS on tunnel terminator. • Cisco IOS Wide-Area Networking Configuration Guide • Cisco IOS Wide-Area Networking Command Reference Frame Relay; Layer 2 Tunnel Protocol Version 3 (L2TPv3); L2VPN Pseudowire Redundancy; L2VPN Interworking; Layer 2 Local Switching; Link Access Procedure, Balanced (LAPB); and X.25. • Cisco IOS Wireless LAN Configuration Guide • Cisco IOS Wireless LAN Command Reference Broadcast key rotation, IEEE 802.11x support, IEEE 802.1x authenticator, IEEE 802.1x local authentication service for Extensible Authentication Protocol-Flexible Authentication via Secure Tunneling (EAP-FAST), Multiple Basic Service Set ID (BSSID), Wi-Fi Multimedia (WMM) required elements, and Wi-Fi Protected Access (WPA). Table 1 Cisco IOS Configuration Guides and Command References (continued) Configuration Guide and Command Reference Titles Features/Protocols/Technologies About Cisco IOS Software Documentation Additional Resources and Documentation Feedback xxxi Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 2 lists documents and resources that supplement the Cisco IOS software configuration guides and command references. Additional Resources and Documentation Feedback What’s New in Cisco Product Documentation is released monthly and describes all new and revised Cisco technical documentation. The What’s New in Cisco Product Documentation publication also provides information about obtaining the following resources: • Technical documentation • Cisco product security overview • Product alerts and field notices • Technical assistance Cisco IOS technical documentation includes embedded feedback forms where you can rate documents and provide suggestions for improvement. Your feedback helps us improve our documentation. Table 2 Cisco IOS Supplementary Documents and Resources Document Title or Resource Description Cisco IOS Master Command List, All Releases Alphabetical list of all the commands documented in all Cisco IOS releases. Cisco IOS New, Modified, Removed, and Replaced Commands List of all the new, modified, removed, and replaced commands for a Cisco IOS release. Cisco IOS System Message Guide List of Cisco IOS system messages and descriptions. System messages may indicate problems with your system, may be informational only, or may help diagnose problems with communications lines, internal hardware, or system software. Cisco IOS Debug Command Reference Alphabetical list of debug commands including brief descriptions of use, command syntax, and usage guidelines. Release Notes and Caveats Information about new and changed features, system requirements, and other useful information about specific software releases; information about defects in specific Cisco IOS software releases. MIBs Files used for network monitoring. To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator. RFCs Standards documents maintained by the Internet Engineering Task Force (IETF) that Cisco IOS documentation references where applicable. The full text of referenced RFCs may be obtained at the following URL: http://www.rfc-editor.org/ About Cisco IOS Software Documentation Additional Resources and Documentation Feedback xxxii Cisco IOS Configuration Fundamentals Command Reference April 2010 CCDE, CCENT, CCSI, Cisco Eos, Cisco Explorer, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco TrustSec, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco and/or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1002R) Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. © 2008–2010 Cisco Systems, Inc. All rights reserved. xxxiii Cisco IOS Configuration Fundamentals Command Reference April 2010 Using the Command-Line Interface in Cisco IOS Software Last Updated: February 24, 2010 This document provides basic information about the command-line interface (CLI) in Cisco IOS software and how you can use some of the CLI features. This document contains the following sections: • Initially Configuring a Device, page xxxiii • Using the CLI, page xxxiv • Saving Changes to a Configuration, page xliv • Additional Information, page xliv For more information about using the CLI, see the “Using the Cisco IOS Command-Line Interface” section of the Cisco IOS Configuration Fundamentals Configuration Guide. For information about the software documentation set, see the “About Cisco IOS Software Documentation” document. Initially Configuring a Device Initially configuring a device varies by platform. For information about performing an initial configuration, see the hardware installation documentation that is provided with the original packaging of the product or go to the Product/Technologies Support area of Cisco.com at http://www.cisco.com/go/techdocs. After you have performed the initial configuration and connected the device to your network, you can configure the device by using the console port or a remote access method, such as Telnet or Secure Shell (SSH), to access the CLI or by using the configuration method provided on the device, such as Security Device Manager. Using the Command-Line Interface in Cisco IOS Software Using the CLI xxxiv Cisco IOS Configuration Fundamentals Command Reference April 2010 Changing the Default Settings for a Console or AUX Port There are only two changes that you can make to a console port and an AUX port: • Change the port speed with the config-register 0x command. Changing the port speed is not recommended. The well-known default speed is 9600. • Change the behavior of the port; for example, by adding a password or changing the timeout value. Note The AUX port on the Route Processor (RP) installed in a Cisco ASR 1000 series router does not serve any useful customer purpose and should be accessed only under the advisement of a customer support representative. Using the CLI This section describes the following topics: • Understanding Command Modes, page xxxiv • Using the Interactive Help Feature, page xxxvii • Understanding Command Syntax, page xxxviii • Understanding Enable and Enable Secret Passwords, page xxxix • Using the Command History Feature, page xl • Abbreviating Commands, page xli • Using Aliases for CLI Commands, page xli • Using the no and default Forms of Commands, page xlii • Using the debug Command, page xlii • Filtering Output Using Output Modifiers, page xlii • Understanding CLI Error Messages, page xliii Understanding Command Modes The CLI command mode structure is hierarchical, and each mode supports a set of specific commands. This section describes the most common of the many modes that exist. Table 3 lists common command modes with associated CLI prompts, access and exit methods, and a brief description of how each mode is used. Using the Command-Line Interface in Cisco IOS Software Using the CLI xxxv Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 3 CLI Command Modes Command Mode Access Method Prompt Exit Method Mode Usage User EXEC Log in. Router> Issue the logout or exit command. • Change terminal settings. • Perform basic tests. • Display device status. Privileged EXEC From user EXEC mode, issue the enable command. Router# Issue the disable command or the exit command to return to user EXEC mode. • Issue show and debug commands. • Copy images to the device. • Reload the device. • Manage device configuration files. • Manage device file systems. Global configuration From privileged EXEC mode, issue the configure terminal command. Router(config)# Issue the exit command or the end command to return to privileged EXEC mode. Configure the device. Interface configuration From global configuration mode, issue the interface command. Router(config-if)# Issue the exit command to return to global configuration mode or the end command to return to privileged EXEC mode. Configure individual interfaces. Line configuration From global configuration mode, issue the line vty or line console command. Router(config-line)# Issue the exit command to return to global configuration mode or the end command to return to privileged EXEC mode. Configure individual terminal lines. Using the Command-Line Interface in Cisco IOS Software Using the CLI xxxvi Cisco IOS Configuration Fundamentals Command Reference April 2010 ROM monitor From privileged EXEC mode, issue the reload command. Press the Break key during the first 60 seconds while the system is booting. rommon # > The # symbol represents the line number and increments at each prompt. Issue the continue command. • Run as the default operating mode when a valid image cannot be loaded. • Access the fall-back procedure for loading an image when the device lacks a valid image and cannot be booted. • Perform password recovery when a Ctrl-Break sequence is issued within 60 seconds of a power-on or reload event. Diagnostic (available only on Cisco ASR 1000 series routers) The router boots or enters diagnostic mode in the following scenarios. When a Cisco IOS process or processes fail, in most scenarios the router will reload. • A user-configured access policy was configured using the transport-map command, which directed the user into diagnostic mode. • The router was accessed using an RP auxiliary port. • A break signal (Ctrl-C, Ctrl-Shift-6, or the send break command) was entered, and the router was configured to enter diagnostic mode when the break signal was received. Router(diag)# If a Cisco IOS process failure is the reason for entering diagnostic mode, the failure must be resolved and the router must be rebooted to exit diagnostic mode. If the router is in diagnostic mode because of a transport-map configuration, access the router through another port or use a method that is configured to connect to the Cisco IOS CLI. If the RP auxiliary port was used to access the router, use another port for access. Accessing the router through the auxiliary port is not useful for customer purposes. • Inspect various states on the router, including the Cisco IOS state. • Replace or roll back the configuration. • Provide methods of restarting the Cisco IOS software or other processes. • Reboot hardware (such as the entire router, an RP, an ESP, a SIP, a SPA) or other hardware components. • Transfer files into or off of the router using remote access methods such as FTP, TFTP, and SCP. Table 3 CLI Command Modes (continued) Command Mode Access Method Prompt Exit Method Mode Usage Using the Command-Line Interface in Cisco IOS Software Using the CLI xxxvii Cisco IOS Configuration Fundamentals Command Reference April 2010 EXEC commands are not saved when the software reboots. Commands that you issue in a configuration mode can be saved to the startup configuration. If you save the running configuration to the startup configuration, these commands will execute when the software is rebooted. Global configuration mode is the highest level of configuration mode. From global configuration mode, you can enter a variety of other configuration modes, including protocol-specific modes. ROM monitor mode is a separate mode that is used when the software cannot load properly. If a valid software image is not found when the software boots or if the configuration file is corrupted at startup, the software might enter ROM monitor mode. Use the question symbol (?) to view the commands that you can use while the device is in ROM monitor mode. rommon 1 > ? alias set and display aliases command boot boot up an external process confreg configuration register utility cont continue executing a downloaded image context display the context of a loaded image cookie display contents of cookie PROM in hex . . . rommon 2 > The following example shows how the command prompt changes to indicate a different command mode: Router> enable Router# configure terminal Router(config)# interface ethernet 1/1 Router(config-if)# ethernet Router(config-line)# exit Router(config)# end Router# Note A keyboard alternative to the end command is Ctrl-Z. Using the Interactive Help Feature The CLI includes an interactive Help feature. Table 4 describes the purpose of the CLI interactive Help commands. Table 4 CLI Interactive Help Commands Command Purpose help Provides a brief description of the Help feature in any command mode. ? Lists all commands available for a particular command mode. partial command? Provides a list of commands that begin with the character string (no space between the command and the question mark). partial command Completes a partial command name (no space between the command and ). command ? Lists the keywords, arguments, or both associated with the command (space between the command and the question mark). command keyword ? Lists the arguments that are associated with the keyword (space between the keyword and the question mark). Using the Command-Line Interface in Cisco IOS Software Using the CLI xxxviii Cisco IOS Configuration Fundamentals Command Reference April 2010 The following examples show how to use the help commands: help Router> help Help may be requested at any point in a command by entering a question mark '?'. If nothing matches, the help list will be empty and you must backup until entering a '?' shows the available options. Two styles of help are provided: 1. Full help is available when you are ready to enter a command argument (e.g. 'show ?') and describes each possible argument. 2. Partial help is provided when an abbreviated argument is entered and you want to know what arguments match the input (e.g. 'show pr?'.) ? Router# ? Exec commands: access-enable Create a temporary access-List entry access-profile Apply user-profile to interface access-template Create a temporary access-List entry alps ALPS exec commands archive manage archive files partial command? Router(config)# zo? zone zone-pair partial command Router(config)# we webvpn command ? Router(config-if)# pppoe ? enable Enable pppoe max-sessions Maximum PPPOE sessions command keyword ? Router(config-if)# pppoe enable ? group attach a BBA group Understanding Command Syntax Command syntax is the format in which a command should be entered in the CLI. Commands include the name of the command, keywords, and arguments. Keywords are alphanumeric strings that are used literally. Arguments are placeholders for values that a user must supply. Keywords and arguments may be required or optional. Specific conventions convey information about syntax and command elements. Table 5 describes these conventions. Using the Command-Line Interface in Cisco IOS Software Using the CLI xxxix Cisco IOS Configuration Fundamentals Command Reference April 2010 The following examples show syntax conventions: Router(config)# ethernet cfm domain ? WORD domain name Router(config)# ethernet cfm domain dname ? level Router(config)# ethernet cfm domain dname level ? <0-7> maintenance level number Router(config)# ethernet cfm domain dname level 7 ? Router(config)# snmp-server file-transfer access-group 10 ? protocol protocol options Router(config)# logging host ? Hostname or A.B.C.D IP address of the syslog server ipv6 Configure IPv6 syslog server Understanding Enable and Enable Secret Passwords Some privileged EXEC commands are used for actions that impact the system, and it is recommended that you set a password for these commands to prevent unauthorized use. Two types of passwords, enable (not encrypted) and enable secret (encrypted), can be set. The following commands set these passwords and are issued in global configuration mode: • enable password • enable secret password Table 5 CLI Syntax Conventions Symbol/Text Function Notes < > (angle brackets) Indicate that the option is an argument. Sometimes arguments are displayed without angle brackets. A.B.C.D. Indicates that you must enter a dotted decimal IP address. Angle brackets (< >) are not always used to indicate that an IP address is an argument. WORD (all capital letters) Indicates that you must enter one word. Angle brackets (< >) are not always used to indicate that a WORD is an argument. LINE (all capital letters) Indicates that you must enter more than one word. Angle brackets (< >) are not always used to indicate that a LINE is an argument. (carriage return) Indicates the end of the list of available keywords and arguments, and also indicates when keywords and arguments are optional. When is the only option, you have reached the end of the branch or the end of the command if the command has only one branch. — Using the Command-Line Interface in Cisco IOS Software Using the CLI xl Cisco IOS Configuration Fundamentals Command Reference April 2010 Using an enable secret password is recommended because it is encrypted and more secure than the enable password. When you use an enable secret password, text is encrypted (unreadable) before it is written to the config.text file. When you use an enable password, the text is written as entered (readable) to the config.text file. Each type of password is case sensitive, can contain from 1 to 25 uppercase and lowercase alphanumeric characters, and can start with a numeral. Spaces are also valid password characters; for example, “two words” is a valid password. Leading spaces are ignored, but trailing spaces are recognized. Note Both password commands have numeric keywords that are single integer values. If you choose a numeral for the first character of your password followed by a space, the system will read the number as if it were the numeric keyword and not as part of your password. When both passwords are set, the enable secret password takes precedence over the enable password. To remove a password, use the no form of the commands: no enable password or no enable secret password. For more information about password recovery procedures for Cisco products, see the following: http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/ products_tech_note09186a00801746e6.shtml Using the Command History Feature The command history feature saves, in a command history buffer, the commands that you enter during a session. The default number of saved commands is 10, but the number is configurable within the range of 0 to 256. This command history feature is particularly useful for recalling long or complex commands. To change the number of commands saved in the history buffer for a terminal session, issue the terminal history size command: Router# terminal history size num A command history buffer is also available in line configuration mode with the same default and configuration options. To set the command history buffer size for a terminal session in line configuration mode, issue the history command: Router(config-line)# history [size num] To recall commands from the history buffer, use the following methods: • Press Ctrl-P or the Up Arrow key—Recalls commands beginning with the most recent command. Repeat the key sequence to recall successively older commands. • Press Ctrl-N or the Down Arrow key—Recalls the most recent commands in the history buffer after they have been recalled using Ctrl-P or the Up Arrow key. Repeat the key sequence to recall successively more recent commands. Note The arrow keys function only on ANSI-compatible terminals such as the VT100. • Issue the show history command in user EXEC or privileged EXEC mode—Lists the most recent commands that you entered. The number of commands that are displayed is determined by the setting of the terminal history size and history commands. Using the Command-Line Interface in Cisco IOS Software Using the CLI xli Cisco IOS Configuration Fundamentals Command Reference April 2010 The command history feature is enabled by default. To disable this feature for a terminal session, issue the terminal no history command in user EXEC or privileged EXEC mode or the no history command in line configuration mode. Abbreviating Commands Typing a complete command name is not always required for the command to execute. The CLI recognizes an abbreviated command when the abbreviation contains enough characters to uniquely identify the command. For example, the show version command can be abbreviated as sh ver. It cannot be abbreviated as s ver because s could mean show, set, or systat. The sh v abbreviation also is not valid because the show command has vrrp as a keyword in addition to version. (Command and keyword examples are from Cisco IOS Release 12.4(13)T.) Using Aliases for CLI Commands To save time and the repetition of entering the same command multiple times, you can use a command alias. An alias can be configured to do anything that can be done at the command line, but an alias cannot move between modes, type in passwords, or perform any interactive functions. Table 6 shows the default command aliases. To create a command alias, issue the alias command in global configuration mode. The syntax of the command is alias mode command-alias original-command. Following are some examples: • Router(config)# alias exec prt partition—privileged EXEC mode • Router(config)# alias configure sb source-bridge—global configuration mode • Router(config)# alias interface rl rate-limit—interface configuration mode To view both default and user-created aliases, issue the show alias command. For more information about the alias command, see the following: http://www.cisco.com/en/US/docs/ios/fundamentals/command/reference/cf_a1.html Table 6 Default Command Aliases Command Alias Original Command h help lo logout p ping s show u or un undebug w where Using the Command-Line Interface in Cisco IOS Software Using the CLI xlii Cisco IOS Configuration Fundamentals Command Reference April 2010 Using the no and default Forms of Commands Most configuration commands have a no form that is used to reset a command to its default value or to disable a feature or function. For example, the ip routing command is enabled by default. To disable this command, you would issue the no ip routing command. To re-enable IP routing, you would issue the ip routing command. Configuration commands may also have a default form, which returns the command settings to their default values. For commands that are disabled by default, using the default form has the same effect as using the no form of the command. For commands that are enabled by default and have default settings, the default form enables the command and returns the settings to their default values. To see what default commands are available on your system, enter default ? in the appropriate command mode of the command-line interface. The no form is documented in the command pages of Cisco IOS command references. The default form is generally documented in the command pages only when the default form performs a function different than that of the plain and no forms of the command. Command pages often include a “Command Default” section as well. The “Command Default” section documents the state of the configuration if the command is not used (for configuration commands) or the outcome of using the command if none of the optional keywords or arguments is specified (for EXEC commands). Using the debug Command A debug command produces extensive output that helps you troubleshoot problems in your network. These commands are available for many features and functions within Cisco IOS software. Some debug commands are debug all, debug aaa accounting, and debug mpls packets. To use debug commands during a Telnet session with a device, you must first enter the terminal monitor command. To turn off debugging completely, you must enter the undebug all command. For more information about debug commands, see the Cisco IOS Debug Command Reference: http://www.cisco.com/en/US/docs/ios/debug/command/reference/db_book.html Caution Debugging is a high priority and high CPU utilization process that can render your device unusable. Use debug commands only to troubleshoot specific problems. The best times to run debugging are during periods of low network traffic and when few users are interacting with the network. Debugging during these periods decreases the likelihood that the debug command processing overhead will affect network performance or user access or response times. Filtering Output Using Output Modifiers Many commands produce lengthy output that may use several screens to display. Using output modifiers, you can filter this output to show only the information that you want to see. Using the Command-Line Interface in Cisco IOS Software Using the CLI xliii Cisco IOS Configuration Fundamentals Command Reference April 2010 The following three output modifiers are available: • begin regular-expression—Displays the first line in which a match of the regular expression is found and all lines that follow. • include regular-expression—Displays all lines in which a match of the regular expression is found. • exclude regular-expression—Displays all lines except those in which a match of the regular expression is found. To use one of these output modifiers, type the command followed by the pipe symbol (|), the modifier, and the regular expression that you want to search for or filter. A regular expression is a case-sensitive alphanumeric pattern. It can be a single character or number, a phrase, or a more complex string. The following example illustrates how to filter output of the show interface command to display only lines that include the expression “protocol.” Router# show interface | include protocol FastEthernet0/0 is up, line protocol is up Serial4/0 is up, line protocol is up Serial4/1 is up, line protocol is up Serial4/2 is administratively down, line protocol is down Serial4/3 is administratively down, line protocol is down Understanding CLI Error Messages You may encounter some error messages while using the CLI. Table 7 shows the common CLI error messages. For more system error messages, see the Cisco IOS Release 12.4T System Message Guide. Table 7 Common CLI Error Messages Error Message Meaning How to Get Help % Ambiguous command: “show con” You did not enter enough characters for the command to be recognized. Reenter the command followed by a space and a question mark (?). The keywords that you are allowed to enter for the command appear. % Incomplete command. You did not enter all the keywords or values required by the command. Reenter the command followed by a space and a question mark (?). The keywords that you are allowed to enter for the command appear. % Invalid input detected at “^” marker. You entered the command incorrectly. The caret (^) marks the point of the error. Enter a question mark (?) to display all the commands that are available in this command mode. The keywords that you are allowed to enter for the command appear. Using the Command-Line Interface in Cisco IOS Software Saving Changes to a Configuration xliv Cisco IOS Configuration Fundamentals Command Reference April 2010 Saving Changes to a Configuration To save changes that you made to the configuration of a device, you must issue the copy running-config startup-config command or the copy system:running-config nvram:startup-config command. When you issue these commands, the configuration changes that you made are saved to the startup configuration and saved when the software reloads or power to the device is turned off or interrupted. The following example shows the syntax of the copy running-config startup-config command: Router# copy running-config startup-config Destination filename [startup-config]? You press Enter to accept the startup-config filename (the default), or type a new filename and then press Enter to accept that name. The following output is displayed indicating that the configuration was saved. Building configuration... [OK] Router# On most platforms, the configuration is saved to NVRAM. On platforms with a Class A flash file system, the configuration is saved to the location specified by the CONFIG_FILE environment variable. The CONFIG_FILE variable defaults to NVRAM. Additional Information • “Using the Cisco IOS Command-Line Interface” section of the Cisco IOS Configuration Fundamentals Configuration Guide http://www.cisco.com/en/US/docs/ios/fundamentals/configuration/guide/cf_cli-basics.html • Cisco Product/Technology Support http://www.cisco.com/go/techdocs • Support area on Cisco.com (also search for documentation by task or product) http://www.cisco.com/en/US/support/index.html • Software Download Center (downloads; tools; licensing, registration, advisory, and general information) (requires Cisco.com user ID and password) http://www.cisco.com/kobayashi/sw-center/ • Error Message Decoder, a tool to help you research and resolve error messages for Cisco IOS software http://www.cisco.com/pcgi-bin/Support/Errordecoder/index.cgi • Command Lookup Tool, a tool to help you find detailed descriptions of Cisco IOS commands (requires Cisco.com user ID and password) http://tools.cisco.com/Support/CLILookup • Output Interpreter, a troubleshooting tool that analyzes command output of supported show commands https://www.cisco.com/pcgi-bin/Support/OutputInterpreter/home.pl Using the Command-Line Interface in Cisco IOS Software Additional Information xlv Cisco IOS Configuration Fundamentals Command Reference April 2010 CCDE, CCENT, CCSI, Cisco Eos, Cisco Explorer, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco TrustSec, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco and/or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1002R) Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. © 2008–2010 Cisco Systems, Inc. All rights reserved. Using the Command-Line Interface in Cisco IOS Software Additional Information xlvi Cisco IOS Configuration Fundamentals Command Reference April 2010 CF-1 Cisco IOS Configuration Fundamentals Command Reference April 2010 Introduction The Cisco IOS Configuration Fundamentals Command Reference provides command documentation associated with the following tasks: • Using the Cisco IOS Command-Line Interface (CLI) • Configuration Using Setup and AutoInstall • Configuring Operating Characteristics for Terminals • Managing Connections, Logins, Menus, and System Banners – Configure user menus and banners • Using the Cisco Web Browser User Interface (UI) – Using the HTTP server-based UI as an alternative to the CLI • Using the Cisco IOS Integrated File System (IFS) – The basics of filesystem use and Cisco IOS software’s filesystem infrastructure • Configuring Basic File Transfer Services – Copy, move, and delete files locally or across the network • Managing Configuration Files • Loading, Maintaining, and Upgrading System Images • Rebooting For further information about performing these tasks, refer to the Cisco IOS Configuration Fundamentals Configuration Guide for your release. Note Some commands previously documented in this Command Reference have been moved to other books: Commands related to system management and network monitoring can be found in the Cisco IOS Network Management Command Reference. Command reference documentation for the Cisco IOS software feature “Service Assurance Agent (SAA)” can be found in the the Cisco IOS IP SLAs Command Reference. Introduction Cisco IOS IFS Command Syntax CF-2 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco IOS IFS Command Syntax Some commands in this book use URLs (uniform resource locators) as part of the command syntax. URLs used in the Cisco IOS Integrated File System (IFS) contain two parts: a file system or network prefix, and a file identification suffix. The following tables list URL keywords that can be used in the source-url and destination-url arguments for all commands in this book. The prefixes listed below can also be used in the filesystem arguments in this document. Table 8 lists common URL network prefixes used to indicate a device on the network. Table 9 lists the available suffix options (file indentification suffixes) for the URL prefixes used in Table 8. Table 10 lists common URL prefixes used to indicate memory locations on the system. Table 8 Network Prefixes for Cisco IFS URLs Prefix Description ftp: Specifies a File Transfer Protocol (FTP) network server. rcp: Specifies an remote copy protocol (rcp) network server. tftp: Specifies a TFTP server. Table 9 File ID Suffixes for Cisco IFS URLs Prefix Suffix Options ftp: [[//[username[:password]@]location]/directory]/filename For example: ftp://network-config (prefix://filename) ftp://user1:mypassword1@example.com/config-files rcp: rcp:[[//[username@]location]/directory]/filename tftp: tftp:[[//location]/directory]/filename Table 10 File System Prefixes for Cisco IFS URLs Prefix Description bootflash: Boot flash memory. disk0: Rotating disk media. flash: [partition-number] Flash memory. This prefix is available on all platforms. For platforms that do not have a device named flash:, the prefix flash: is aliased to slot0:. Therefore, you can use the prefix flash: to refer to the main Flash memory storage area on all platforms. flh: Flash load helper log files. null: Null destination for copies. You can copy a remote file to null to determine its size. nvram: NVRAM. This is the default location for the running-configuration file. Introduction Obtaining Documentation, Obtaining Support, and Security Guidelines CF-3 Cisco IOS Configuration Fundamentals Command Reference April 2010 For details about the Cisco IOS IFS, and for IFS configuration tasks, refer to the “Using the Cisco IOS Integrated File System (IFS)” chapter in the latest Cisco IOS Configuration Fundamentals Configuration Guide appropriate for your release version. Obtaining Documentation, Obtaining Support, and Security Guidelines For information on obtaining documentation, obtaining support, providing documentation feedback, security guidelines, and also recommended aliases and general Cisco documents, see the monthly What’s New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at: http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html slavebootflash: Internal Flash memory on a slave RSP card of a router configured with Dual RSPs. slavenvram: NVRAM on a slave RSP card. slaveslot0: First PCMCIA card on a slave RSP card. slaveslot1: Second PCMCIA card on a slave RSP card. slot0: First PCMCIA Flash memory card. slot1: Second PCMCIA Flash memory card. xmodem: Obtain the file from a network machine using the Xmodem protocol. ymodem: Obtain the file from a network machine using the Ymodem protocol. Table 10 File System Prefixes for Cisco IFS URLs (continued) Prefix Description Introduction Obtaining Documentation, Obtaining Support, and Security Guidelines CF-4 Cisco IOS Configuration Fundamentals Command Reference April 2010 CF-5 Cisco IOS Configuration Fundamentals Command Reference April 2010 Configuration Fundamentals Commands Configuration Fundamentals Commands activation-character CF-6 Cisco IOS Configuration Fundamentals Command Reference April 2010 activation-character To define the character you enter at a vacant terminal to begin a terminal session, use the activation-character command in line configuration mode. To make any character activate a terminal, use the no form of this command. activation-character ascii-number no activation-character Syntax Description Defaults Return (decimal 13) Command Modes Line configuration (config-line) Command History Usage Guidelines See the “ASCII Character Set and Hexadecimal Values” document for a list of ASCII characters. Note If you are using the autoselect function, set the activation character to the default, Return, and exec-character-bits to 7. If you change these defaults, the application will not recognize the activation request. Examples The following example shows how to set the activation character for the console to Delete, which is decimal character 127: Router(config)# line console Router(config-line)# activation-character 127 ascii-number Decimal representation of the activation character. Release Modification 10.0 This command was introduced. This command is supported in all Cisco IOS software Releases. Configuration Fundamentals Commands alias CF-7 Cisco IOS Configuration Fundamentals Command Reference April 2010 alias To create a command alias, use the alias command in global configuration mode. To delete all aliases in a command mode or to delete a specific alias, and to revert to the original command syntax, use the no form of this command. alias mode command-alias original-command no alias mode [command-alias] Syntax Description Defaults A set of six basic EXEC mode aliases are enabled by default. See the “Usage Guidelines” section of this command for a list of default aliases. Command Modes Global configuration Command History Usage Guidelines You can use simple words or abbreviations as command aliases. Table 11 lists the basic EXEC mode aliases that are enabled by default. The default aliases in Table 11 are predefined. These default aliases can be disabled with the no alias exec command. mode Command mode of the original and alias commands. command-alias Command alias. original-command Original command syntax. Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 11 Default Command Aliases Command Alias Original Command h help lo logout p ping r resume s show w where Configuration Fundamentals Commands alias CF-8 Cisco IOS Configuration Fundamentals Command Reference April 2010 Common keyword aliases (which cannot be disabled) include running-config (keyword alias for system:running-config) and startup-config (keyword alias for nvram:startup-config). See the description of the copy command for more information about these keyword aliases. Note that aliases can be configured for keywords instead of entire commands. You can create, for example, an alias for the first part of any command and still enter the additional keywords and arguments as normal. To determine the value for the mode argument, enter the command mode in which you would issue the original command (and in which you will issue the alias) and enter the ? command. The name of the command mode should appear at the top of the list of commands. For example, the second line in the following sample output shows the name of the command mode as “Interface configuration”: Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)# interface e0 Router(config-if)# ? Interface configuration commands: access-expression Build a bridge boolean access expression . . . To match the name of the command mode to the acceptable mode keyword for the alias command, issue the alias ? command. As shown in the following sample output, the keyword needed to create a command alias for the access-expression command is interface: Router(config)# alias ? accept-dialin VPDN group accept dialin configuration mode accept-dialout VPDN group accept dialout configuration mode address-family Address Family configuration mode call-discriminator Call Discriminator Configuration cascustom Cas custom configuration mode clid-group CLID group configuration mode configure Global configuration mode congestion Frame Relay congestion configuration mode controller Controller configuration mode cptone-set custom call progress tone configuration mode customer-profile customer profile configuration mode dhcp DHCP pool configuration mode dnis-group DNIS group configuration mode exec Exec mode flow-cache Flow aggregation cache config mode fr-fr FR/FR connection configuration mode interface Interface configuration mode . . . Router(config)# alias interface express access-expression When you use online help, command aliases are indicated by an asterisk (*), and displayed in the following format: *command-alias=original-command For example, the lo command alias is shown here along with other EXEC mode commands that start with “lo”: Router# lo? *lo=logout lock login logout When you use online help, aliases that contain multiple keyword elements separated by spaces are displayed in quotes, as shown here: Configuration Fundamentals Commands alias CF-9 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router(config)#alias exec device-mail telnet device.cisco.com 25 Router(config)#end Router#device-mail? *device-mail=”telnet device.cisco.com 25" To list only commands and omit aliases, begin your input line with a space. In the following example, the alias td is not shown, because there is a space before the t? command line. Router(config)#alias exec td telnet device Router(config)#end Router# t? telnet terminal test tn3270 trace To circumvent command aliases, use a space before entering the command. In the following example, the command alias express is not recognized because a space is used before the command. Router(config-if)#exp? *express=access-expression Router(config-if)# express ? % Unrecognized command As with commands, you can use online help to display the arguments and keywords that can follow a command alias. In the following example, the alias td is created to represent the command telnet device. The /debug and /line switches can be added to telnet device to modify the command: Router(config)#alias exec td telnet device Router(config)#end Router#td ? /debug Enable telnet debugging mode /line Enable telnet line mode ... whois Whois port Router# telnet device You must enter the complete syntax for the command alias. Partial syntax for aliases is not accepted. In the following example, the parser does not recognize the command t as indicating the alias td: Router# t % Ambiguous command: “t” Examples In the following example, the alias fixmyrt is configured for the clear iproute 192.168.116.16 EXEC mode command: Router(config)#alias exec fixmyrt clear ip route 192.168.116.16 In the following example, the alias express is configured for the first part of the access-expression interface configuration command: Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#interface e0 Router(config-if)#? Interface configuration commands: access-expression Build a bridge boolean access expression . . . Router(config-if)#exit Router(config)#alias ? accept-dialin VPDN group accept dialin configuration mode Configuration Fundamentals Commands alias CF-10 Cisco IOS Configuration Fundamentals Command Reference April 2010 accept-dialout VPDN group accept dialout configuration mode address-family Address Family configuration mode call-discriminator Call Discriminator Configuration cascustom Cas custom configuration mode clid-group CLID group configuration mode configure Global configuration mode congestion Frame Relay congestion configuration mode controller Controller configuration mode cptone-set custom call progress tone configuration mode customer-profile customer profile configuration mode dhcp DHCP pool configuration mode dnis-group DNIS group configuration mode exec Exec mode flow-cache Flow aggregation cache config mode fr-fr FR/FR connection configuration mode interface Interface configuration mode . . . Router(config)#alias interface express access-expression Router(config)#int e0 Router(config-if)#exp? *express=access-expression Router(config-if)#express ? input Filter input packets output Filter output packets !Note that the true form of the command/keyword alias appears on the screen after issuing !the express ? command. Router(config-if)#access-expression ? input Filter input packets output Filter output packets Router(config-if)#ex? *express=access-expression exit !Note that in the following line, a space is used before the ex? command !so the alias is not displayed. Router(config-if)# ex? exit !Note that in the following line, the alias cannot be recognized because !a space is used before the command. Router#(config-if)# express ? % Unrecognized command Router(config-if)# end Router# show alias interface Interface configuration mode aliases: express access-expression Related Commands Command Description show aliases Displays command aliases. Configuration Fundamentals Commands archive CF-11 Cisco IOS Configuration Fundamentals Command Reference April 2010 archive To enter archive configuration mode, use the archive command in global configuration mode. archive Syntax Description This command has no arguments or keywords. Command Default None Command Modes Global configuration Command History Examples The following example shows how to place the router in archive configuration mode: Router# configure terminal ! Router(config)# archive Router(config-archive)# Related Commands Release Modification 12.3(4)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. Command Description log config Enters configuration change logger configuration mode. logging enable Enables the logging of configuration changes. maximum Sets the maximum number of archive files of the running configuration to be saved in the Cisco IOS configuration archive. path Specifies the location and filename prefix for the files in the Cisco IOS configuration archive. time-period Sets the time increment for automatically saving an archive file of the current running configuration in the Cisco IOS configuration archive. Configuration Fundamentals Commands archive config CF-12 Cisco IOS Configuration Fundamentals Command Reference April 2010 archive config To save a copy of the current running configuration to the Cisco IOS configuration archive, use the archive config command in privileged EXEC mode. archive config Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Usage Guidelines Note Before using this command, you must configure the path command in order to specify the location and filename prefix for the files in the Cisco IOS configuration archive. The Cisco IOS configuration archive is intended to provide a mechanism to store, organize, and manage an archive of Cisco IOS configuration files to enhance the configuration rollback capability provided by the configure replace command. Before this feature was introduced, you could save copies of the running configuration using the copy running-config destination-url command, storing the target file either locally or remotely. However, this method lacked any automated file management. On the other hand, the Configuration Replace and Configuration Rollback feature provides the capability to automatically save copies of the running configuration to the Cisco IOS configuration archive. These archived files serve as checkpoint configuration references and can be used by the configure replace command to revert to previous configuration states. The archive config command allows you to save Cisco IOS configurations in the configuration archive using a standard location and filename prefix that is automatically appended with an incremental version number (and optional time stamp) as each consecutive file is saved. This functionality provides a means for consistent identification of saved Cisco IOS configuration files. You can specify how many versions of the running configuration are kept in the archive. After the maximum number of files has been saved in the archive, the oldest file is automatically deleted when the next, most recent file is saved. The show archive command displays information for all configuration files saved in the Cisco IOS configuration archive. Release Modification 12.3(7)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(31)SB2 This command was implemented on the Cisco 10000 series. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. Configuration Fundamentals Commands archive config CF-13 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example shows how to save the current running configuration to the Cisco IOS configuration archive using the archive config command. Before using the archive config command, you must configure the path command to specify the location and filename prefix for the files in the Cisco IOS configuration archive. In this example, the location and filename prefix are specified as disk0:myconfig as follows: configure terminal ! archive path disk0:myconfig end You then save the current running configuration in the configuration archive, as follows: archive config The show archive command displays information on the files saved in the configuration archive as shown in the following sample output: Router# show archive There are currently 1 archive configurations saved. The next archive file will be named disk0:myconfig-2 Archive # Name 0 1 disk0:myconfig-1 <- Most Recent 2 3 4 5 6 7 8 9 10 Related Commands Command Description archive Enters archive configuration mode. configure confirm Confirms replacement of the current running configuration with a saved Cisco IOS configuration file. configure replace Replaces the current running configuration with a saved Cisco IOS configuration file. maximum Sets the maximum number of archive files of the running configuration to be saved in the Cisco IOS configuration archive. path Specifies the location and filename prefix for the files in the Cisco IOS configuration archive. show archive Displays information about the files saved in the Cisco IOS configuration archive. time-period Sets the time increment for automatically saving an archive file of the current running configuration in the Cisco IOS configuration archive. Configuration Fundamentals Commands archive log config persistent save CF-14 Cisco IOS Configuration Fundamentals Command Reference April 2010 archive log config persistent save To save the persisted commands in the configuration log to the Cisco IOS secure file system, use the archive log config persistent save command in virtually any configuration mode. archive log config persistent save Syntax Description This command has no arguments or keywords. Command Default If this command is not entered, the persisted configuration commands in the archive log are not saved to the Cisco IOS secure file system. Command Modes Configuration change logger configuration mode in archive configuration mode is common for this command, but the command can be used in virtually any configuration mode. Command History Usage Guidelines This command can be entered at any time, regardless of what mode the router is in. If the router is in the persistent periodic mode, the persistent timer is restarted. Examples The following example saves the persisted commands in the archive log to the Cisco IOS secure file system: Router(config-archive-log-cfg)# archive log config persistent save Related Commands Release Modification 12.2(33)SRA This command was introduced. 12.4(11)T This command was integrated into Cisco IOS Release 12.4(11)T. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB. Command Description log config Enters configuration change logger configuration mode. logging enable Enables the logging of configuration changes. logging persistent Enables the configuration logging persistent feature. Configuration Fundamentals Commands archive tar CF-15 Cisco IOS Configuration Fundamentals Command Reference April 2010 archive tar To create a TAR file, to list files in a TAR file, or to extract the files from a TAR file, use the archive tar command in privileged EXEC mode. archive tar {/create destination-url flash:/file-url | /table source-url | /xtract source-url flash:/file-url [dir/file...]} Syntax Description /create destination-url flash:/file-url Creates a new TAR file on the local or network file system. For destination-url, specify the destination URL alias for the local or network file system and the name of the TAR file to create. The following options are supported: • flash:—Syntax for the local flash file system. • ftp:[[//username[:password]@location]/directory]/tar-filename.tar— Syntax for FTP. • rcp:[[//username@location]/directory]/tar-filename.tar—Syntax for Remote Copy Protocol (RCP). • tftp:[[//location]/directory]/tar-filename.tar —Syntax for TFTP. The tar-filename.tar is the name of the TAR file to be created. For flash:/file-url, specify the location on the local flash file system from which the new TAR file is created. An optional list of files or directories within the source directory can be specified to write to the new TAR file. If none is specified, all files and directories at this level are written to the newly created TAR file. /table source-url Display the contents of an existing TAR file to the screen. For source-url, specify the source URL alias for the local or network file system. The following options are supported: • flash:—Syntax for the local flash file system. • ftp:[[//username[:password]@location]/directory]/tar-filename.tar— Syntax for FTP. • rcp:[[//username@location]/directory]/tar-filename.tar—Syntax for Remote Copy Protocol (RCP). • tftp:[[//location]/directory]/tar-filename.tar —Syntax for TFTP. The tar-filename.tar is the name of the TAR file to be created. Configuration Fundamentals Commands archive tar CF-16 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Default The TAR archive file is not created. Command Modes Privileged EXEC (#) Command History Usage Guidelines Filenames, directory names, and image names are case sensitive. The TAR file is an archive file from which you can extract files by using the archive tar command. Examples The following example shows how to create a TAR file. The command writes the contents of the new-configs directory on the local flash device to a file named saved.tar on the TFTP server at 172.20.136.9. Switch# archive tar /create tftp:172.20.136.9/saved.tar flash:/new-configs The following example shows how to display the contents of the c2940-tv0-m.tar file that is in flash memory. The contents of the TAR file appear on the screen. Switch# archive tar /table flash:c2940-tv0-m.tar info (219 bytes) c2940-tv0-mz-121/ (directory) c2940-tv0-mz-121/html/ (directory) c2940-tv0-mz-121/html/foo.html (0 bytes) c2940-tv0-mz-121/vegas-tv0-mz-121.bin (610856 bytes) c2940-tv0-mz-121/info (219 bytes) info.ver (219 bytes) /xtract source-url flash:/file-url [dir/file...] Extracts files from a TAR file to the local file system. For source-url, specify the source URL alias for the local file system. These options are supported: • flash:—Syntax for the local flash file system. • ftp:[[//username[:password]@location]/directory]/tar-filename.tar— Syntax for FTP. • rcp:[[//username@location]/directory]/tar-filename.tar—Syntax for Remote Copy Protocol (RCP). • tftp:[[//location]/directory]/tar-filename.tar —Syntax for TFTP. The tar-filename.tar is the name of the TAR file to be created. Release Modification 12.1(13)AY This command was introduced. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.4(22)YB This command was integrated into Cisco IOS Release 12.4(22)YB. 12.4(24)T This command was integrated into Cisco IOS Release 12.4(24)T. Configuration Fundamentals Commands archive tar CF-17 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following example shows how to extract the contents of a TAR file on the TFTP server at 172.20.10.30. This command extracts only the new-configs directory into the root directory on the local flash file system. The remaining files in the saved.tar file are ignored. Switch# archive tar /xtract tftp:/172.20.10.30/saved.tar flash:/ new-configs Configuration Fundamentals Commands async-bootp CF-18 Cisco IOS Configuration Fundamentals Command Reference April 2010 async-bootp To configure extended BOOTP requests for asynchronous interfaces as defined in RFC 1084, use the async-bootp command in global configuration mode. To restore the default, use the no form of this command. async-bootp tag [:hostname] data no async-bootp Syntax Description tag Item being requested; expressed as filename, integer, or IP dotted decimal address. See Table 12 for possible keywords. :hostname (Optional) This entry applies only to the specified host. The :hostname argument accepts both an IP address and a logical host name. data List of IP addresses entered in dotted decimal notation or as logical host names, a number, or a quoted string. Table 12 tag Keyword Options Keyword Description bootfile Specifies use of a server boot file from which to download the boot program. Use the optional :hostname argument and the data argument to specify the filename. subnet-mask mask Dotted decimal address specifying the network and local subnetwork mask (as defined by RFC 950). time-offset offset Signed 32-bit integer specifying the time offset of the local subnetwork in seconds from Coordinated Universal Time (UTC). gateway address Dotted decimal address specifying the IP addresses of gateways for this subnetwork. A preferred gateway should be listed first. time-server address Dotted decimal address specifying the IP address of time servers (as defined by RFC 868). IEN116-server address Dotted decimal address specifying the IP address of name servers (as defined by IEN 116). nbns-server address Dotted decimal address specifying the IP address of Windows NT servers. DNS-server address Dotted decimal address specifying the IP address of domain name servers (as defined by RFC 1034). log-server address Dotted decimal address specifying the IP address of an MIT-LCS UDP log server. quote-server address Dotted decimal address specifying the IP address of Quote of the Day servers (as defined in RFC 865). lpr-server address Dotted decimal address specifying the IP address of Berkeley UNIX Version 4 BSD servers. impress-server address Dotted decimal address specifying the IP address of Impress network image servers. Configuration Fundamentals Commands async-bootp CF-19 Cisco IOS Configuration Fundamentals Command Reference April 2010 Defaults If no extended BOOTP commands are entered, the Cisco IOS software generates a gateway and subnet mask appropriate for the local network. Command Modes Global configuration Command History Usage Guidelines Use the show async-bootp EXEC command to list the configured parameters. Use the no async-bootp command to clear the list. Examples The following example illustrates how to specify different boot files: one for a PC, and one for a Macintosh. With this configuration, a BOOTP request from the host on 172.30.1.1 results in a reply listing the boot filename as pcboot. A BOOTP request from the host named “mac” results in a reply listing the boot filename as “macboot.” async-bootp bootfile :172.30.1.1 “pcboot” async-bootp bootfile :mac “macboot” The following example specifies a subnet mask of 255.255.0.0: async-bootp subnet-mask 255.255.0.0 The following example specifies a negative time offset of the local subnetwork of 3600 seconds: async-bootp time-offset -3600 The following example specifies the IP address of a time server: async-bootp time-server 172.16.1.1 Related Commands rlp-server address Dotted decimal address specifying the IP address of Resource Location Protocol (RLP) servers (as defined in RFC 887). hostname name The name of the client, which may or may not be domain qualified, depending upon the site. bootfile-size value A two-octet value specifying the number of 512-octet (byte) blocks in the default boot file. Table 12 tag Keyword Options (continued) Keyword Description Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show async bootp Displays the extended BOOTP request parameters that have been configured for asynchronous interfaces. Configuration Fundamentals Commands attach CF-20 Cisco IOS Configuration Fundamentals Command Reference April 2010 attach To connect to a specific line card or module from a remote location for the purpose of executing monitoring and maintenance commands on that line card or module, use the attach command in privileged EXEC mode. To exit from the Cisco IOS software image on the line card and return to the Cisco IOS image on the main (Supervisor) module, use the exit command. Cisco 12000 Series attach slot-number Cisco 7600 Series and Catalyst 6500 Series attach module-number Syntax Description Defaults No default behavior or values. Command Modes Privileged EXEC Command History Usage Guidelines Cisco 12000 Series You must first use the attach privileged EXEC command to access the Cisco IOS software image on a line card before using line card-specific show EXEC commands. Alternatively, you can use the execute-on privileged EXEC command to execute a show command on a specific line card. After you connect to the Cisco IOS image on the line card using the attach command, the prompt changes to LC-Slotx#, where x is the slot number of the line card. The commands executed on the line card use the Cisco IOS image on that line card. You can also use the execute-on slot privileged EXEC command to execute commands on one or all line cards. Note Do not execute the config EXEC command from the Cisco IOS software image on the line card. slot-number Slot number of the line card to which you wish to connect. If you omit the slot number, you will be prompted for it. module-number Module number; see the “Usage Guidelines” section for valid values. Release Modification 11.2GS This command was introduced on the Cisco 12000 series. 12.2(14)SX This command was implemented on the Supervisor Engine 720. 12.2(17d)SXB Support was added for the Supervisor Engine 2. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Configuration Fundamentals Commands attach CF-21 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco 7600 Series and Catalyst 6500 Series Caution After you enter the attach or remote login command to access another console from your switch, if you enter global or interface configuration mode commands, the switch might reset. The valid values for the module-number argument depend on the chassis that is used. For example, if you have a 13-slot chassis, valid values for the module number are from 1 to 13. This command is supported on Distributed Forwarding Card (DFC)-equipped modules, FlexWan modules, and the supervisor engine only. When you execute the attach module-number command, the prompt changes to Router-dfcx# or Switch-sp#, depending on the type of module to which you are connecting. The behavior of the attach command is identical to that of the remote login module num command. There are two ways to end this session: • You can enter the exit command as follows: Router-dfc3# exit [Connection to Switch closed by foreign host] Router# • You can press Ctrl-C three times as follows: Router-dfc3# ^C Router-dfc3# ^C Router-dfc3# ^C Terminate remote login session? [confirm] y [Connection to Switch closed by local host] Router# Examples In the following example, the user connects to the Cisco IOS image running on the line card in slot 9, gets a list of valid show commands, and returns the Cisco IOS image running on the GRP: Router# attach 9 Entering Console for 4 Port Packet Over SONET OC-3c/STM-1 in Slot: 9 Type exit to end this session Press RETURN to get started! LC-Slot9# show ? cef Cisco Express Forwarding clock Display the system clock context Show context information about recent crash(s) history Display the session command history hosts IP domain-name, lookup style, nameservers, and host table ipc Interprocess communications commands location Display the system location sessions Information about Telnet connections terminal Display terminal configuration parameters users Display information about terminal lines version System hardware and software status LC-Slot9# exit Disconnecting from slot 9. Configuration Fundamentals Commands attach CF-22 Cisco IOS Configuration Fundamentals Command Reference April 2010 Connection Duration: 00:01:04 Router# Note Because not all statistics are maintained on line cards, the output from some of show commands may be inconsistent. The following example shows how to log in remotely to the DFC-equipped module: Console# attach 3 Trying Switch ... Entering CONSOLE for Switch Type "^C^C^C" to end this session Router-dfc3# Related Commands Command Description attach shelf Connects you to a specific (managed) shelf for the purpose of remotely executing commands on that shelf only. execute-on slot Executes commands remotely on a specific line card, or on all line cards simultaneously. remote login Accesses the Cisco 7600 series router console or a specific module. Configuration Fundamentals Commands autobaud CF-23 Cisco IOS Configuration Fundamentals Command Reference April 2010 autobaud To set the line for automatic baud rate detection (autobaud), use the autobaud command in line configuration mode. To disable automatic baud detection, use the no form of this command. autobaud no autobaud Syntax Description This command has no arguments or keywords. Defaults Autobaud detection is disabled. Fixed speed of 9600 bps. Command Modes Line configuration Command History Usage Guidelines The autobaud detection supports a range from 300 to 19200 baud. A line set for autobaud cannot be used for outgoing connections, nor can you set autobaud capability on a line using 19200 baud when the parity bit is set (because of hardware limitations). Note Automatic baud detection must be disabled by using the no autobaud command prior to setting the txspeed, rxspeed, or speed commands. Examples In the following example, the auxiliary port is configured for autobaud detection: Router(config)# line aux Router(config-line)# autobaud Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Configuration Fundamentals Commands auto-sync CF-24 Cisco IOS Configuration Fundamentals Command Reference April 2010 auto-sync To enable automatic synchronization of the configuration files in NVRAM, use the auto-sync command in main-cpu redundancy configuration mode. To disable automatic synchronization, use the no form of this command. auto-sync {startup-config | config-register | bootvar | running-config | standard} no auto-sync {startup-config | config-register | bootvar | standard} Syntax Description Defaults For the Performance Routing Engines (PREs) on the Cisco uBR10012 universal broadband router, the system defaults to synchronizing all system files on the (auto-sync standard). For the Supervisor Engines on the Cisco 7600 series routers, the system defaults to synchronizing the running configuration. (running-config). Command Modes Main-cpu redundancy configuration Command History Usage Guidelines Cisco 7600 Series Routers If you enter the no auto-sync standard command, no automatic synchronizations occur. If you want to enable any of the keywords, you have to enter the appropriate command for each keyword. The auto-sync command is not supported in RPR+ mode. startup-config Specifies synchronization of the startup configuration files. config-register Specifies synchronization of the configuration register values. bootvar Specifies synchronization of the following boot variables: • BOOT—Set by the boot system device:filename command. • CONFIG_FILE—Set by the boot config device:filename command. • BOOTLDR—Set by the boot bootldr device:filename command. running-config Specifies synchronization of the running configuration files. standard Specifies synchronization of all of the system files (startup configuration, boot variables, and config configuration registers). Release Modification 12.2(4)XF1 This command was introduced on the Cisco uBR10012 universal broadband router. 12.2(14)SX This command was integrated into the Supervisor Engine 720. 12.2(17d)SXB Support was added for the Supervisor Engine 2. 12.2(18)SXD Support for this command on the Cisco 7600 series routers was removed. 12.3BC This command was integrated into Cisco IOS Release 12.3BC for the Cisco uBR10012 router. 12.2(33)SCA This command is obsolete on the Cisco uBR10012 universal broadband router. Configuration Fundamentals Commands auto-sync CF-25 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco uBR10012 Universal Broadband Router By default, the system synchronizes all system files, which is the typical setting for most applications. However, you might want exclude certain files from synchronization for specialized applications. For example, if you have configured the active and standby PRE1 (or PRE2) modules to run different versions of Cisco IOS software, you might want to use different configuration files as well. In this case, you would not synchronize the startup configuration file. Examples Cisco 7600 Series Routers The following example shows how (from the default configuration) to enable automatic synchronization of the configuration register in the main CPU: Router# configure terminal Router (config)# redundancy Router (config-r)# main-cpu Router (config-r-mc)# no auto-sync standard Router (config-r-mc)# auto-sync config-register Cisco uBR10012 Universal Broadband Router The following example shows the system being configured to synchronize only the startup configuration file: router(config)# redundancy router(config-r)# main-cpu router(config-r-mc)# auto-sync startup-config router(config-r-mc)# exit router(config-r)# exit The following example shows how to configure the system to synchronize all system files except for the startup configuration file. This typically is done when the two PRE1 (or PRE2) modules are running different software images. router(config)# redundancy router(config-r)# main-cpu router(config-r-mc)# no auto-sync startup-config router(config-r-mc)# auto-sync config-register router(config-r-mc)# auto-sync bootvar router(config-r-mc)# exit router(config-r)# exit Related Commands Command Description redundancy Enters redundancy configuration mode. main-cpu Enters main CPU redundancy configuration mode. Configuration Fundamentals Commands autoupgrade disk-cleanup CF-26 Cisco IOS Configuration Fundamentals Command Reference April 2010 autoupgrade disk-cleanup To configure the Cisco IOS Auto-Upgrade Manager disk cleanup utility, use the autoupgrade disk-cleanup command in global configuration mode. To disable this configuration, use the no form of this command. autoupgrade disk-cleanup [crashinfo | core | image | irrecoverable] no autoupgrade disk-cleanup [crashinfo | core | image | irrecoverable] Syntax Description Command Default By default, the crashinfo files, the core files, and the Cisco IOS software images are deleted by the Cisco IOS Auto-Upgrade Manager disk cleanup utility, and the filesystems that support the undelete operation are not cleaned up. Command Modes Global configuration (config) Command History Examples The following example shows how to clean-up filesystems that support undelete operation: Router(config)# autoupgrade disk-cleanup irrecoverable The following example shows how to avoid deleting the Cisco IOS software images: Router(config)# no autoupgrade disk-cleanup image Related Commands crashinfo (Optional) Deletes crashinfo files during disk-cleanup before an image is downloaded. core (Optional) Deletes core files during disk-cleanup before an image is downloaded. image (Optional) Deletes the Cisco IOS images, except the default boot image and the current image, during disk-cleanup before an image is downloaded. irrecoverable (Optional) Deletes files irretrievably (in a file-system that supports the undelete operation) during disk-cleanup before an image is downloaded. Release Modification 12.4(15)T This command was introduced. Command Description autoupgrade ida url Configures the URL of the server on www.cisco.com where the image download requests will be sent by Auto-Upgrade Manager. autoupgrade status email Configures the address to which the status email is to be sent. upgrade automatic getversion Downloads a Cisco IOS software image directly from www.cisco.com or from a non-Cisco server. Configuration Fundamentals Commands autoupgrade ida url CF-27 Cisco IOS Configuration Fundamentals Command Reference April 2010 autoupgrade ida url To configure the URL of the Intelligent Download Application (IDA) running on www.cisco.com, use the autoupgrade ida url command in global configuration mode. The router will send the image download requests to the configured URL. To disable this URL, use the no form of this command. autoupgrade ida url url no autoupgrade ida url url Syntax Description Command Default Default URL: https://www.cisco.com/cgi-bin/ida/locator/locator.pl Command Modes Global configuration (config) Command History Usage Guidelines Use the autoupgrade ida url command to configure a new URL for the IDA server, if it is not present in the default location. Examples The following example shows how to configure the URL for the IDA server: Router(config)# autoupgrade ida url https://www.cisco.com/cgi-bin/ida/locator/locator.pl Related Commands url URL of the IDA server. Release Modification 12.4(15)T This command was introduced. Command Description autoupgrade disk-cleanup Configures the Cisco IOS Auto-Upgrade Manager disk cleanup utility. autoupgrade status email Configures the address to which the status email is to be sent. upgrade automatic getversion Downloads a Cisco IOS software image directly from www.cisco.com or from a non-Cisco server. Configuration Fundamentals Commands autoupgrade status email CF-28 Cisco IOS Configuration Fundamentals Command Reference April 2010 autoupgrade status email To configure the address to which status email is to be sent and the outgoing email server, use the autoupgrade status email command in global configuration mode. To disable status email, use the no form of this command. autoupgrade status email [recipient [email-address]] [smtp-server[smtp-server]] no autoupgrade status email [recipient [email-address]] [smtp-server[smtp-server]] Syntax Description Command Default Status email is not sent unless the address is configured. The recipient email address and SMTP server have to be configured in order to receive AUM status email. Command Modes Global configuration (config) Command History Usage Guidelines Use this command to configure the email-address where AUM status email can be sent. Examples The following example shows how to configure the address to which status email is to be sent: Router(config)# autoupgrade status email recipient tree@abc.com Router(config)# autoupgrade status email smtp-server smtpserver.abc.com Related Commands recipient The address to which the Cisco IOS Auto-Upgrade Manager (AUM) status is to be sent. smtp-server The outgoing email server to which the AUM email is sent. email-address The email address to which the AUM status is to be sent. Release Modification 12.4(15)T This command was introduced. Command Description autoupgrade disk-cleanup Configures the Cisco IOS Auto-Upgrade Manager disk cleanup utility. autoupgrade ida url Configures the URL of the server running on www.cisco.com to which the router sends the image download requests. upgrade automatic getversion Downloads a Cisco IOS software image directly from www.cisco.com or from a non-Cisco server. Configuration Fundamentals Commands banner exec CF-29 Cisco IOS Configuration Fundamentals Command Reference April 2010 banner exec To specify and enable a message to be displayed when an EXEC process is created (an EXEC banner), use the banner exec command in global configuration mode. To delete the existing EXEC banner, use the no form of this command. banner exec d message d no banner exec Syntax Description Defaults Disabled (no EXEC banner is displayed). Command Modes Global configuration Command History Usage Guidelines This command specifies a message to be displayed when an EXEC process is created (a line is activated, or an incoming connection is made to a vty). Follow this command with one or more blank spaces and a delimiting character of your choice. Then enter one or more lines of text, terminating the message with the second occurrence of the delimiting character. When a user connects to a router, the message-of-the-day (MOTD) banner appears first, followed by the login banner and prompts. After the user logs in to the router, the EXEC banner or incoming banner will be displayed, depending on the type of connection. For a reverse Telnet login, the incoming banner will be displayed. For all other connections, the router will display the EXEC banner. To disable the EXEC banner on a particular line or lines, use the no exec-banner line configuration command. To customize the banner, use tokens in the form $(token) in the message text. Tokens will display current Cisco IOS configuration variables, such as the router’s host name and IP address. The tokens are described in Table 13. d Delimiting character of your choice—a pound sign (#), for example. You cannot use the delimiting character in the banner message. message Message text. You can include tokens in the form $(token) in the message text. Tokens will be replaced with the corresponding configuration variable. Tokens are described in Table 13. Release Modification 10.0 This command was introduced. 11.3(7.5)AA Token functionality was introduced. 12.0(3)T Token functionality was integrated into Cisco IOS Release 12.0(3)T. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Configuration Fundamentals Commands banner exec CF-30 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example sets an EXEC banner that uses tokens. The percent sign (%) is used as a delimiting character. Notice that the $(token) syntax is replaced by the corresponding configuration variable. Router(config)# banner exec % Enter TEXT message. End with the character '%'. Session activated on line $(line), $(line-desc). Enter commands at the prompt. % When a user logs on to the system, the following output is displayed: User Access Verification Username: joeuser Password: Session activated on line 50, vty default line. Enter commands at the prompt. Router> Related Commands Table 13 banner exec Tokens Token Information Displayed in the Banner $(hostname) Displays the host name for the router. $(domain) Displays the domain name for the router. $(line) Displays the vty or tty (asynchronous) line number. $(line-desc) Displays the description attached to the line. Command Description banner incoming Defines a customized banner to be displayed when there is an incoming connection to a terminal line from a host on the network. banner login Defines a customized banner to be displayed before the username and password login prompts. banner motd Defines a customized message-of-the-day banner. banner slip-ppp Defines a customized banner to be displayed when a serial-line IP or point-to-point connection is made. exec-banner Controls (enables or disables) the display of EXEC banners and message-of-the-day banners on a specified line or lines. Configuration Fundamentals Commands banner incoming CF-31 Cisco IOS Configuration Fundamentals Command Reference April 2010 banner incoming To define and enable a banner to be displayed when there is an incoming connection to a terminal line from a host on the network, use the banner incoming command in global configuration mode. To delete the incoming connection banner, use the no form of this command. banner incoming d message d no banner incoming Syntax Description Defaults Disabled (no incoming banner is displayed). Command Modes Global configuration Command History Usage Guidelines Follow the banner incoming command with one or more blank spaces and a delimiting character of your choice. Then enter one or more lines of text, terminating the message with the second occurrence of the delimiting character. An incoming connection is one initiated from the network side of the router. Incoming connections are also called reverse Telnet sessions. These sessions can display MOTD banners and incoming banners, but they do not display EXEC banners. Use the no motd-banner line configuration command to disable the MOTD banner for reverse Telnet sessions on asynchronous lines. When a user connects to the router, the message-of-the-day (MOTD) banner (if configured) appears first, before the login prompt. After the user successfully logs in to the router, the EXEC banner or incoming banner will be displayed, depending on the type of connection. For a reverse Telnet login, the incoming banner will be displayed. For all other connections, the router will display the EXEC banner. Incoming banners cannot be suppressed. If you do not want the incoming banner to appear, you must delete it with the no banner incoming command. To customize the banner, use tokens in the form $(token) in the message text. Tokens will display current Cisco IOS configuration variables, such as the router’s host name and IP address. The tokens are described in Table 14. d Delimiting character of your choice—a pound sign (#), for example. You cannot use the delimiting character in the banner message. message Message text. You can include tokens in the form $(token) in the message text. Tokens will be replaced with the corresponding configuration variable. Tokens are described in Table 14. Release Modification 10.0 This command was introduced. 11.3(7.5)AA Token functionality was introduced. 12.0(3)T Token functionality was integrated into Cisco IOS Release 12.0(3)T. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Configuration Fundamentals Commands banner incoming CF-32 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example sets an incoming connection banner. The pound sign (#) is used as a delimiting character. Router(config)# banner incoming # This is the Reuses router. # The following example sets an incoming connection banner that uses several tokens. The percent sign (%) is used as a delimiting character. darkstar(config)# banner incoming % Enter TEXT message. End with the character '%'. You have entered $(hostname).$(domain) on line $(line) ($(line-desc)) % When the incoming connection banner is executed, the user will see the following banner. Notice that the $(token) syntax is replaced by the corresponding configuration variable. You have entered darkstar.ourdomain.com on line 5 (Dialin Modem) Related Commands Table 14 banner incoming Tokens Token Information Displayed in the Banner $(hostname) Displays the host name for the router. $(domain) Displays the domain name for the router. $(line) Displays the vty or tty (asynchronous) line number. $(line-desc) Displays the description attached to the line. Command Description banner exec Defines a customized banner to be displayed whenever the EXEC process is initiated. banner login Defines a customized banner to be displayed before the username and password login prompts. banner motd Defines a customized message-of-the-day banner. banner slip-ppp Defines a customized banner to be displayed when a serial-line IP or point-to-point connection is made. Configuration Fundamentals Commands banner login CF-33 Cisco IOS Configuration Fundamentals Command Reference April 2010 banner login To define and enable a customized banner to be displayed before the username and password login prompts, use the banner login command in global configuration mode. To disable the login banner, use no form of this command. banner login d message d no banner login Syntax Description Defaults Disabled (no login banner is displayed). Command Modes Global configuration Command History Usage Guidelines Follow the banner login command with one or more blank spaces and a delimiting character of your choice. Then enter one or more lines of text, terminating the message with the second occurrence of the delimiting character. When a user connects to the router, the message-of-the-day (MOTD) banner (if configured) appears first, followed by the login banner and prompts. After the user successfully logs in to the router, the EXEC banner or incoming banner will be displayed, depending on the type of connection. For a reverse Telnet login, the incoming banner will be displayed. For all other connections, the router will display the EXEC banner. To customize the banner, use tokens in the form $(token) in the message text. Tokens will display current Cisco IOS configuration variables, such as the router’s host name and IP address. The tokens are described in Table 15. d Delimiting character of your choice—a pound sign (#), for example. You cannot use the delimiting character in the banner message. message Message text. You can include tokens in the form $(token) in the message text. Tokens will be replaced with the corresponding configuration variable. Tokens are described in Table 15. Release Modification 10.0 This command was introduced. 11.3(7.5)AA Token functionality was introduced. 12.0(3)T Token functionality was integrated into Cisco IOS Release 12.0(3)T. 12.2(14)SX This command was integrated into Cisco IOS Release 12.2(14)SX. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Configuration Fundamentals Commands banner login CF-34 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example sets a login banner. Double quotes (") are used as the delimiting character. Router# banner login " Access for authorized users only. Please enter your username and password. " The following example sets a login banner that uses several tokens. The percent sign (%) is used as the delimiting character. darkstar(config)# banner login % Enter TEXT message. End with the character '%'. You have entered $(hostname).$(domain) on line $(line) ($(line-desc)) % When the login banner is executed, the user will see the following banner. Notice that the $(token) syntax is replaced by the corresponding configuration variable. You have entered darkstar.ourdomain.com on line 5 (Dialin Modem) Related Commands Table 15 banner login Tokens Token Information Displayed in the Banner $(hostname) Displays the host name for the router. $(domain) Displays the domain name for the router. $(line) Displays the vty or tty (asynchronous) line number. $(line-desc) Displays the description attached to the line. Command Description banner exec Defines a customized banner to be displayed whenever the EXEC process is initiated. banner incoming Defines a customized message to be displayed when there is an incoming connection to a terminal line from a host on the network. banner motd Defines a customized message-of-the-day banner. banner slip-ppp Defines a customized banner to be displayed when a serial-line IP or point-to-point connection is made. Configuration Fundamentals Commands banner motd CF-35 Cisco IOS Configuration Fundamentals Command Reference April 2010 banner motd To define and enable a message-of-the-day (MOTD) banner, use the banner motd command in global configuration mode. To delete the MOTD banner, use the no form of this command. banner motd d message d no banner motd Syntax Description Defaults Disabled (no MOTD banner is displayed). Command Modes Global configuration Command History Usage Guidelines Follow this command with one or more blank spaces and a delimiting character of your choice. Then enter one or more lines of text, terminating the message with the second occurrence of the delimiting character. This MOTD banner is displayed to all terminals connected and is useful for sending messages that affect all users (such as impending system shutdowns). Use the no exec-banner or no motd-banner command to disable the MOTD banner on a line. The no exec-banner command also disables the EXEC banner on the line. When a user connects to the router, the MOTD banner appears before the login prompt. After the user logs in to the router, the EXEC banner or incoming banner will be displayed, depending on the type of connection. For a reverse Telnet login, the incoming banner will be displayed. For all other connections, the router will display the EXEC banner. To customize the banner, use tokens in the form $(token) in the message text. Tokens will display current Cisco IOS configuration variables, such as the router’s host name and IP address. The tokens are described in Table 16. d Delimiting character of your choice—a pound sign (#), for example. You cannot use the delimiting character in the banner message. message Message text. You can include tokens in the form $(token) in the message text. Tokens will be replaced with the corresponding configuration variable. Release Modification 10.0 This command was introduced. 11.3(7.5)AA Token functionality was introduced. 12.0(3)T Token functionality was integrated into Cisco IOS Release 12.0(3)T. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Configuration Fundamentals Commands banner motd CF-36 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example configures an MOTD banner. The pound sign (#) is used as a delimiting character. Router# banner motd # Building power will be off from 7:00 AM until 9:00 AM this coming Tuesday. # The following example configures an MOTD banner with a token. The percent sign (%) is used as a delimiting character. darkstar(config)# banner motd % Enter TEXT message. End with the character '%'. Notice: all routers in $(domain) will be upgraded beginning April 20 % When the MOTD banner is executed, the user will see the following. Notice that the $(token) syntax is replaced by the corresponding configuration variable. Notice: all routers in ourdomain.com will be upgraded beginning April 20 Related Commands Table 16 banner motd Tokens Token Information Displayed in the Banner $(hostname) Displays the host name for the router. $(domain) Displays the domain name for the router. $(line) Displays the vty or tty (asynchronous) line number. $(line-desc) Displays the description attached to the line. Command Description banner exec Defines and enables a customized banner to be displayed whenever the EXEC process is initiated. banner incoming Defines and enables a customized message to be displayed when there is an incoming connection to a terminal line from a host on the network. banner login Defines and enables a customized banner to be displayed before the username and password login prompts. banner slip-ppp Defines and enables a customized banner to be displayed when a serial-line IP or point-to-point connection is made. exec-banner Controls (enables or disables) the display of EXEC banners and message-of-the-day banners on a specified line or lines. motd-banner Controls (enables or disables) the display of message-of-the-day banners on a specified line or lines. Configuration Fundamentals Commands banner slip-ppp CF-37 Cisco IOS Configuration Fundamentals Command Reference April 2010 banner slip-ppp To customize the banner that is displayed when a Serial Line Internet Protocol (SLIP) or PPP connection is made, use the banner slip-ppp command in global configuration mode. To restore the default SLIP or PPP banner, use the no form of this command. banner slip-ppp d message d no banner slip-ppp Syntax Description Defaults The default SLIP or PPP banner message is: Entering encapsulation mode. Async interface address is unnumbered (Ethernet0) Your IP address is 10.000.0.0 MTU is 1500 bytes The banner message when using the service old-slip-prompt command is: Entering encapsulation mode. Your IP address is 10.100.0.0 MTU is 1500 bytes where encapsulation is SLIP or PPP. Command Modes Global configuration Command History Usage Guidelines Follow this command with one or more blank spaces and a delimiting character of your choice. Then enter one or more lines of text, terminating the message with the second occurrence of the delimiting character. Use this command to define a custom SLIP or PPP connection message. This is useful when legacy client applications require a specialized connection string. To customize the banner, use tokens in the form $(token) in the message text. Tokens will display current Cisco IOS configuration variables, such as the routers host name, IP address, encapsulation type, and Maximum Transfer Unit (MTU) size. The banner tokens are described in Table 17. d Delimiting character of your choice—a pound sign (#), for example. You cannot use the delimiting character in the banner message. message Message text. You can include tokens in the form $(token) in the message text. Tokens will be replaced with the corresponding configuration variable. Release Modification 12.0(3)T This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Configuration Fundamentals Commands banner slip-ppp CF-38 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example sets the SLIP/PPP banner using several tokens and the percent sign (%) as the delimiting character: Router(config)# banner slip-ppp % Enter TEXT message. End with the character '%'. Starting $(encap) connection from $(gate-ip) to $(peer-ip) using a maximum packet size of $(mtu) bytes... % The new SLIP/PPP banner will now be displayed when the slip EXEC command is used. Notice that the $(token) syntax is replaced by the corresponding configuration variable. Router# slip Starting SLIP connection from 172.16.69.96 to 192.168.1.200 using a maximum packet size of 1500 bytes... Related Commands Table 17 banner slip-ppp Tokens Token Information Displayed in the Banner $(hostname) Displays the host name of the router. $(domain) Displays the domain name of the router. $(peer-ip) Displays the IP address of the peer machine. $(gate-ip) Displays the IP address of the gateway machine. $(encap) Displays the encapsulation type (SLIP, PPP, and so on). $(encap-alt) Displays the encapsulation type as SL/IP instead of SLIP. $(mtu) Displays the MTU size. Command Description banner exec Defines and enables a customized banner to be displayed whenever the EXEC process is initiated. banner incoming Defines and enables a customized message to be displayed when there is an incoming connection to a terminal line from a host on the network. banner motd Defines and enables a customized message-of-the-day banner. ppp Initiates a connection to a remote host using PPP. slip Initiates a connection to a remote host using SLIP. Configuration Fundamentals Commands boot CF-39 Cisco IOS Configuration Fundamentals Command Reference April 2010 boot To boot the router manually, use the boot command in ROM monitor mode. The syntax of this command varies according to the platform and ROM monitor version. boot boot file-url boot filename [tftp-ip-address] boot flash [flash-fs:][partition-number:][filename] Cisco 7000 Series, 7200 Series, 7500 Series Routers boot flash-fs:[filename] Cisco 1600 and Cisco 3600 Series Routers boot [flash-fs:][partition-number:][filename] Cisco 1800 Series, 2800 Series, and 3800 Series Routers boot usbflash0[:filename] Syntax Description file-url URL of the image to boot (for example, boot tftp://172.16.15.112/routertest). filename When used in conjunction with the ip-address argument, the filename argument is the name of the system image file to boot from a network server. The filename is case sensitive. When used in conjunction with the flash keyword, the filename argument is the name of the system image file to boot from Flash memory. On all platforms except the Cisco 1600 series, Cisco 3600 series, and Cisco 7000 family routers, the system obtains the image file from internal Flash memory. On the Cisco 1600 series, Cisco 3600 series and Cisco 7000 family routers, the flash-fs: argument specifies the Flash memory device from which to obtain the system image. (See the flash-fs: argument later in this table for valid device values.) The filename is case sensitive. Without the filename argument, the first valid file in Flash memory is loaded. If the filename is not specified, the first file in the partition or file system is used. (A USB Flash uses the first image in (compact) Flash as the boot loader and loads the image from USB Flash.) tftp-ip-address (optional) IP address of the TFTP server on which the system image resides. If omitted, this value defaults to the IP broadcast address of 255.255.255.255. Configuration Fundamentals Commands boot CF-40 Cisco IOS Configuration Fundamentals Command Reference April 2010 Defaults For most platforms, if you enter the boot command and press Enter, the router boots from ROM by default. However, for some platforms, such as the Cisco 3600 series routers, if you enter the boot command and press Enter, the router boots the first image in Flash memory. Refer to the documentation for your platform for information about the default image. Command Modes ROM monitor Command History Usage Guidelines To determine which form of this command to use, refer to the documentation for your platform or use the CLI help (?) feature. Use this command only when your router cannot find the boot configuration information needed in NVRAM. To enter ROM monitor mode, use one of the following methods: • Enter the reload EXEC command, then press the Break key during the first 60 seconds of startup. • Set the configuration register bits 0 to 3 to zero (for example, set the configuration register to 0x0) and enter the reload command. flash Boots the router from Flash memory. Note that this keyword is required in some boot images. usbflash0 Boot the first file in USB Flash 0. If the optional filename argument is used, the router boots the specified image from USB Flash. Note This option uses the first image in (compact) Flash as the boot loader and loads the image from USB Flash. flash-fs: (Optional) Specifying the Flash file system is optional for all platforms except the Cisco 7500 series routers. Possible file systems are: • flash:—Internal Flash memory. • bootflash:—Internal Flash memory on the Cisco 7000 family. • slot0:—Flash memory card in the first PCMCIA slot on the Cisco 7000 family and Cisco 3600 series routers. • slot1:—Flash memory card in the second PCMCIA slot on the Cisco 7000 family and Cisco 3600 series routers. partition-number: (Optional) Specifies the partition number of the file system the file should be loaded from. This argument is not available on all platforms. If the partition-number is not specified, the first partition is used. Release Modification 10.3 The command was introduced. 12.3(14)T The usbflash0 keyword was added to support booting an image from an external USB Flash drive. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Configuration Fundamentals Commands boot CF-41 Cisco IOS Configuration Fundamentals Command Reference April 2010 The ROM Monitor prompt is either “>” or, for newer platforms, “rommon x>”. Enter only lowercase commands. These commands work only if there is a valid image to boot. Also, from the ROM monitor prompt, issuing a prior reset command is necessary for the boot to be consistently successful. In Cisco IOS Release 12.3(4)T, MONLIB was modified to search in media for a valid Cisco IOS image. This change prevents boot failures that result when the first file read in disk or flash is not a valid Cisco IOS image. Refer to your hardware documentation for information on correct jumper settings for your platform. Note For some platforms the flash keyword is now required. If your attempts to use the boot command are failing using the older boot flash:x:[filename] syntax, try using the boot flash flash:x:[filename] syntax. Examples In the following example, a router is manually booted from ROM: > boot F3: (ROM Monitor copyrights) In the following example, a router boots the file named routertest from a network server with the IP address 172.16.15.112 using the file-url syntax: > boot tftp://172.16.15.112/routertest F3 (ROM Monitor copyrights) The following example shows the boot flash command without the filename argument. The first valid file in Flash memory is loaded. > boot flash F3: 1858656+45204+166896 at 0x1000 Booting gs7-k from flash memory RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR [OK - 1903912/13765276 bytes] F3: 1858676+45204+166896 at 0x1000 (ROM Monitor copyrights) The following example boots from Flash memory using the file named gs7-k: > boot flash gs7-k F3: 1858656+45204+166896 at 0x1000 Booting gs7-k from flash memory RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRR [OK - 1903912/13765276 bytes] F3: 1858676+45204+166896 at 0x1000 (ROM Monitor copyrights) In the following example, the boot flash flash: command boots the relocatable image file named igs-bpx-l from partition 2 in Flash memory: Configuration Fundamentals Commands boot CF-42 Cisco IOS Configuration Fundamentals Command Reference April 2010 > boot flash flash:2:igs-bpx-l F3: 3562264+98228+303632 at 0x30000B4 (ROM Monitor copyrights) In the following command, the Cisco 7000 family router accepts the flash keyword for compatibility but ignores it, and boots from slot 0: > boot flash slot0:gs7-k-mz.103-9 F3: 8468+3980384+165008 at 0x1000 In the following example, the command did not function because it must be entered in lowercase: rommon 10 > BOOT command “BOOT” not found The following example boots the first file in the first partition of internal Flash memory of a Cisco 3600 series router: > boot flash: The following example boots the first image file in the first partition of the Flash memory card in slot 0 of a Cisco 3600 series router: > boot slot0: The following example shows the ROM monitor booting the first file in the first Flash memory partition on a Cisco 1600 series router: > boot flash: Related Commands Command Description continue Returns to EXEC mode from ROM monitor mode by completing the boot process. Configuration Fundamentals Commands boot bootldr CF-43 Cisco IOS Configuration Fundamentals Command Reference April 2010 boot bootldr To specify the location of the boot image that ROM uses for booting, use the boot bootldr command in global configuration mode. To remove this boot image specification, use the no form of this command. boot bootldr file-url no boot bootldr Syntax Description Defaults Refer to your platform documentation for the location of the default boot image. Command Modes Global configuration (config) Command History Usage Guidelines The boot bootldr command sets the BOOTLDR variable in the current running configuration. You must specify both the Flash file system and the filename. Note When you use this global configuration command, you affect only the running configuration. You must save the variable setting to your startup configuration to place the information under ROM monitor control and to have the variable function as expected. Use the copy system:running-config nvram:startup-config command to save the variable from your running configuration to your startup configuration. Note The default length of the bootstring filename is 64 characters. Depending on the platform a longer bootstring filename can be used and supported. The no form of the command sets the BOOTLDR variable to a null string. On the Cisco 7000 family routers, a null string causes the first image file in boot Flash memory to be used as the boot image that ROM uses for booting. Use the show boot command to display the current value for the BOOTLDR variable. Examples In the following example, the internal Flash memory contains the boot image: boot bootldr bootflash:boot-image file-url URL of the boot image on a Flash file system. Release Modification 11.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Configuration Fundamentals Commands boot bootldr CF-44 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following example specifies that the Flash memory card inserted in slot 0 contains the boot image: boot bootldr slot0:boot-image Related Commands Command Description copy system:running-config nvram:startup-config Copies any file from a source to a destination. show (flash file system) Displays the layout and contents of a Flash memory file system. show bootvar Displays the contents of the BOOT variable, the name of the configuration file pointed to by the CONFIG_FILE variable, the contents of the BOOTLDR variable, and the configuration register setting. Configuration Fundamentals Commands boot bootstrap CF-45 Cisco IOS Configuration Fundamentals Command Reference April 2010 boot bootstrap To configure the filename that is used to boot a secondary bootstrap image, use the boot bootstrap command in global configuration mode. To disable booting from a secondary bootstrap image, use the no form of this command. boot bootstrap file-url no boot bootstrap file-url boot bootstrap flash [filename] no boot bootstrap flash [filename] boot bootstrap [tftp] filename [ip-address] no boot bootstrap [tftp] filename [ip-address] Syntax Description Defaults No secondary bootstrap Command Modes Global configuration Command History Usage Guidelines The boot bootstrap command causes the router to load a secondary bootstrap image from the specied URL, such as from a remote server. After the bootstrap image is loaded, the bootstrap image loads the specified system image file. See the appropriate hardware installation guide for details on the setting the configuration register and secondary bootstrap filename. Use this command when you have attempted to load a system image but have run out of memory even after compressing the system image. Secondary bootstrap images allows you to load a larger system image through a smaller secondary image. file-url URL of the bootstrap image. flash Boots the router from Flash memory. filename (Optional with flash) Name of the system image to boot from a network server or from Flash memory. If you omit the filename when booting from Flash memory, the router uses the first system image stored in Flash memory. tftp (Optional) Boots the router from a system image stored on a TFTP server. ip-address (Optional) IP address of the TFTP server on which the system image resides. If omitted, this value defaults to the IP broadcast address of 255.255.255.255. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Configuration Fundamentals Commands boot bootstrap CF-46 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, the system image file named sysimage-2 will be loaded by using a secondary bootstrap image: Router(config)# boot bootstrap bootflash:sysimage-2 Configuration Fundamentals Commands boot config CF-47 Cisco IOS Configuration Fundamentals Command Reference April 2010 boot config To specify the device and filename of the configuration file from which the system configures itself during initialization (startup), use the boot config command in global configuration mode. To return to the default location for the configuration file, use the no form of this command. Platforms Other than Cisco 7600 Series Router boot config file-system-prefix:[directory/]filename [nvbypass] no boot config Cisco 7600 Series Router boot config device:filename [nvbypass] no boot config Syntax Description Command Default The default location for the configuration file is NVRAM (nvram:). Command Modes Global configuration (config) Command History Supported Platforms Other than Cisco 7600 Series Router This command is available only on Class A and Class B file system platforms. file-system-prefix: File system, followed by a colon (for example, nvram:, flash:, slot0:, usbflash[0-9]:, or usbtoken[0-9]:). The default is nvram:. directory/ (Optional) File system directory where the configuration file is located, followed by a forward slash (/). filename Name of the configuration file. device: Device identification, followed by a colon; see the “Usage Guidelines” section for a list of the valid values. nvbypass (Optional) Specifies that the distilled configuration is not written to nonvolatile random access memory (NVRAM). Release Modification 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(14)SX Support for this command was added for the Cisco 7600 Supervisor Engine 720. 12.2(17d)SXB Support for this command on the cisco 7600 Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 11.0 This command was introduced. 12.3(14)T Support for Class B file system platforms and the following file system prefix options were added: usbflash[0-9]: and usbtoken[0-9]:. Configuration Fundamentals Commands boot config CF-48 Cisco IOS Configuration Fundamentals Command Reference April 2010 You set the CONFIG_FILE environment variable in the current running memory when you use the boot config command. This variable specifies the configuration file used for initialization (startup). The configuration file must be an ASCII file located in either NVRAM or flash memory. Cisco 7600 Series Router The valid values for the device: argument and colon are as follows: • For systems that are configured with a Supervisor Engine 2, the valid values are bootflash:, const_nvram:, flash:, nvram:, slot0:, sup-slot0:, and sup-bootflash:. • For systems that are configured with a Supervisor Engine 720, the valid values are disk0: and disk1:. The configuration file must be an ASCII file that is located in the specified file system. The disk0: and disk1: keywords are for Class C file systems. The bootflash:, slot0:, and sup-bootflash: keywords are for Class A file systems. For Class A flash file systems, the CONFIG_FILE environment variable specifies the file system and filename of the configuration file to use for initialization (startup). You set the CONFIG_FILE environment variable in the current running memory when you use the boot config command. This variable specifies the configuration file used for initialization (startup). All Supported Platforms When you use the boot config command, you affect only the running configuration. You must save the environment variable setting to your startup configuration to place the information under ROM monitor control and to have the environment variable function as expected. Use the copy system:running-config nvram:startup-config command to save the environment variable from your running configuration to your startup configuration. The software displays an error message and does not update the CONFIG_FILE environment variable in the following situations: • You specify nvram: as the file system, and it contains only a distilled version of the configuration. (A distilled configuration is one that does not contain access lists.) • You specify a configuration file in the filename argument that does not exist or is not valid. The router uses the NVRAM configuration during initialization when the CONFIG_FILE environment variable does not exist or when it is null (such as at first-time startup). If the software detects a problem with NVRAM or the configuration it contains, the device enters setup mode. When you use the no form of this command, the router returns to using the default NVRAM configuration file as the startup configuration. You can display the contents of the BOOT, BOOTLDR, and the CONFIG_FILE environment variables using the show bootvar command. This command displays the settings for these variables as they exist in the startup configuration and in the running configuration if a running configuration setting differs from a startup configuration setting. When the boot config command is used, the distilled configuration is written into NVRAM and the system configuration is written into the file specified by the boot config command. If the distilled configuration exceeds the size of NVRAM, the system configuration gets truncated. Use the nvbypass keyword to prevent the system configuration from being truncated when the distilled configuration is larger than the size of NVRAM. Configuration Fundamentals Commands boot config CF-49 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example shows how to set the configuration file that is located in internal flash memory to configure itself during initialization. The third line copies the specification to the startup configuration, ensuring that this specification will take effect upon the next reload. Router(config)# boot config flash:router-config Router(config)# end Router# copy system:running-config nvram:startup-config The following example instructs a Cisco 7500 series router to use the configuration file named router-config located on the flash memory card inserted in the second Personal Computer Memory Card Industry Association (PCMCIA) slot of the Route Switch Processor (RSP) card during initialization. The third line copies the specification to the startup configuration, ensuring that this specification will take effect upon the next reload. Router (config)# boot config slot1:router-config Router (config)# end Router# copy system:running-config nvram:startup-config Related Commands Command Description copy system:running-config nvram:startup-config Saves the environment variable from the running configuration to the startup configuration. show bootvar Displays the contents of the BOOT environment variable, the name of the configuration file pointed to by the CONFIG_FILE environment variable, the contents of the BOOTLDR environment variable, and the configuration register setting. Configuration Fundamentals Commands boot host CF-50 Cisco IOS Configuration Fundamentals Command Reference April 2010 boot host To specify the host-specific configuration file to be used at the next system startup, use the boot host command in global configuration mode. To restore the host configuration filename to the default, use the no form of this command. boot host remote-url no boot host remote-url Syntax Description Defaults If you do not specify a filename using this command, the router uses its configured host name to request a configuration file from a remote server. To form the configuration filename, the router converts its name to all lowercase letters, removes all domain information, and appends -confg or -config. Command Modes Global configuration Command History Usage Guidelines This command instructs the system to “Boot using host-specific configuration file x,” where x is the filename specified in the remote-url argument. In other words, this command specifies the remote location and filename of the host-specific configuration file to be used at the next system startup, as well as the protocol to be used to obtain the file. Before using the boot host command, use the service config global configuration command to enable the loading of the specified configuration file at reboot time. Without this command, the router ignores the boot host command and uses the configuration information in NVRAM. If the configuration information in NVRAM is invalid or missing, the service config command is enabled automatically. The network server will attempt to load two configuration files from remote hosts. The first is the network configuration file containing commands that apply to all network servers on a network. Use the boot network command to identify the network configuration file. The second is the host configuration file containing commands that apply to one network server in particular. Use the boot host command to identify the host configuration file. remote-url Location of the configuration file. Use the following syntax: • ftp:[[[//[username[:password]@]location]/directory]/filename] • rcp:[[[//[username@]location]/directory]/filename] • tftp:[[[//location]/directory]/filename] Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Configuration Fundamentals Commands boot host CF-51 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note Usually, the service config command is used in conjunction with the boot host or boot network command. You must enter the service config command to enable the router to automatically configure the system from the file specified by the boot host or boot network command. With IOS software versions 12.3(2)T , 12.3(1)B, and later, you no longer have to specify the service config command for the boot host or boot network command to be active. If you specify both the no service config command and the boot host command, the router attempts to find the specified host configuration file. The service config command can also be used without the boot host or boot network command. If you do not specify host or network configuration filenames, the router uses the default configuration files. The default network configuration file is network-confg. The default host configuration file is host-confg, where host is the hostname of the router. If the Cisco IOS software cannot resolve its hostname, the default host configuration file is router-confg. Loading a Configuration File Using rcp The rcp software requires that a client send the remote username on each rcp request to the network server. If the server has a directory structure (such as UNIX systems), the rcp implementation searches for the configuration files starting in the directory associated with the remote username. When you load a configuration file from a server using rcp, the Cisco IOS software sends the first valid username in the following list: 1. The username specified in the file-URL, if a username is specified. 2. The username set by the ip rcmd remote-username command, if the command is configured. 3. The router host name. Note An account for the username must be defined on the destination server. If the network administrator of the destination server did not establish an account for the username, this command will not execute successfully. Loading a Configuration File Using FTP The FTP protocol requires a client to send a remote username and password on each FTP request to a server. The username and password must be associated with an account on the FTP server. If the server has a directory structure, the configuration file or image copied from the directory is associated with the username on the server. Refer to the documentation for your FTP server for more details. When you load a configuration file from a server using FTP, the Cisco IOS software sends the first valid username in the following list: 1. The username specified in the boot host command, if a username is specified. 2. The username set by the ip ftp username command, if the command is configured. 3. Anonymous. The router sends the first valid password in the following list: 1. The password specified in the boot host command, if a password is specified. 2. The password set by the ip ftp password command, if the command is configured. Configuration Fundamentals Commands boot host CF-52 Cisco IOS Configuration Fundamentals Command Reference April 2010 3. The router forms a password username@routername.domain. The variable username is the username associated with the current session, routername is the configured host name, and domain is the domain of the router. Examples The following example sets the host filename to wilma-confg at address 192.168.7.19: Router(config)# boot host tftp://192.168.7.19/usr/local/tftpdir/wilma-confg Router(config)# service config Related Commands Command Description boot network Specifies the remote location and filename of the network configuration file to be used at the next system boot (startup). service config Enables autoloading of configuration files from a network server. Configuration Fundamentals Commands boot network CF-53 Cisco IOS Configuration Fundamentals Command Reference April 2010 boot network To change the default name of the network configuration file from which to load configuration commands, use the boot network command in global configuration mode. To restore the network configuration filename to the default, use the no form of this command. boot network remote-url no boot network remote-url Syntax Description Defaults The default filename is network-config. Command Modes Global configuration Command History Usage Guidelines This command instructs the system to “Boot using network configuration file x,” where x is the filename specified in the remote-url argument. This command specifies the remote location and filename of the network configuration file to be used at the next system startup, as well as the protocol to be used to obtain the file. When booting from a network server, routers ignore routing information, static IP routes, and bridging information. As a result, intermediate routers are responsible for handling FTP, rcp, or TFTP requests. Before booting from a network server, verify that a server is available by using the ping command. Use the service config command to enable the loading of the specified configuration file at reboot time. Without this command, the router ignores the boot network command and uses the configuration information in NVRAM. If the configuration information in NVRAM is invalid or missing, the service config command is enabled automatically. The network server will attempt to load two configuration files from remote hosts. The first is the network configuration file containing commands that apply to all network servers on a network. Use the boot network command to identify the network configuration file. The second is the host configuration file containing commands that apply to one network server in particular. Use the boot host command to identify the host configuration file. remote-url Location of the configuration file. Use the following syntax: • ftp:[[[//[username[:password]@]location]/directory]/filename] • rcp:[[[//[username@]location]/directory]/filename] • tftp:[[[//location]/directory]/filename] Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Configuration Fundamentals Commands boot network CF-54 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note Usually, the service config command is used in conjunction with the boot host or boot network command. You must enter the service config command to enable the router to automatically configure the system from the file specified by the boot host or boot network command. With IOS software versions 12.3(2)T , 12.3(1)B, and later, you no longer have to specify the service config command for the boot host or boot network command to be active. If you specify both the no service config command and the boot host command, the router attempts to find the specified host configuration file. The service config command can also be used without the boot host or boot network command. If you do not specify host or network configuration filenames, the router uses the default configuration files. The default network configuration file is network-confg. The default host configuration file is host-confg, where host is the hostname of the router. If the Cisco IOS software cannot resolve its hostname, the default host configuration file is router-confg. Loading a Configuration File Using rcp The rcp software requires that a client send the remote username on each rcp request to the network server. If the server has a directory structure (such as UNIX systems), the rcp implementation searches for the configuration files starting in the directory associated with the remote username. When you load a configuration file from a server using rcp, the Cisco IOS software sends the first valid username in the following list: 1. The username specified in the file-URL, if a username is specified. 2. The username set by the ip rcmd remote-username command, if the command is configured. 3. The router host name. Note An account for the username must be defined on the destination server. If the network administrator of the destination server did not establish an account for the username, this command will not execute successfully. Loading a Configuration File Using FTP The FTP protocol requires a client to send a remote username and password on each FTP request to a server. The username and password must be associated with an account on the FTP server. If the server has a directory structure, the configuration file or image copied from the directory associated with the username on the server. Refer to the documentation for your FTP server for more details. When you load a configuration file from a server using FTP, the Cisco IOS software sends the first valid username in the following list: 1. The username specified in the boot network command, if a username is specified. 2. The username set by the ip ftp username command, if the command is configured. 3. Anonymous. The router sends the first valid password in the following list: 1. The password specified in the boot network command, if a password is specified. 2. The password set by the ip ftp password command, if the command is configured. Configuration Fundamentals Commands boot network CF-55 Cisco IOS Configuration Fundamentals Command Reference April 2010 3. The router forms a password username@routername.domain. The variable username is the username associated with the current session, routername is the configured host name, and domain is the domain of the router. Examples The following example changes the network configuration filename to bridge_9.1 and uses the default broadcast address: Router(config)# boot network tftp:bridge_9.1 Router(config)# service config The following example changes the network configuration filename to bridge_9.1, specifies that rcp is to be used as the transport mechanism, and gives 172.16.1.111 as the IP address of the server on which the network configuration file resides: Router(config)# service config Router(config)# boot network rcp://172.16.1.111/bridge_9.1 Related Commands Command Description boot host Specifies the remote location and filename of the host-specific configuration file to be used at the next system boot (startup). service config Enables autoloading of configuration files from a remote host. Configuration Fundamentals Commands boot system CF-56 Cisco IOS Configuration Fundamentals Command Reference April 2010 boot system To specify the system image that the router loads at startup, use one of the following boot system command in global configuration mode. To remove the startup system image specification, use the no form of this command. Loading System Image from a URL or a TFTP File boot system {file-url | filename} no boot system {file-url | filename} Booting from a System Image in Internal Flash boot system flash [flash-fs:] [partition-number:] [filename] no boot system flash [flash-fs:] [partition-number:] [filename] Booting from a MOP Server boot system mop filename [mac-address] [interface] no boot system mop filename [mac-address] [interface] Booting from ROM boot system rom no boot system rom Booting a System Image from a Network, TFTP, or FTP Server boot system {rcp | tftp | ftp} filename [ip-address] no boot system {rcp | tftp | ftp} filename [ip-address] Syntax Description file-url The URL of the system image to load at system startup. filename The TFTP filename of the system image to load at system startup. flash On all platforms except the Cisco 1600 series, Cisco 3600 series, and Cisco 7000 family routers, this keyword boots the router from internal flash memory. If you omit all arguments that follow this keyword, the system searches internal Flash for the first bootable image. On the Cisco 1600 series, Cisco 3600 series, and Cisco 7000 family routers, this keyword boots the router from the flash system specified by the flash-fs: argument. On the Cisco 1600 series and Cisco 3600 series routers, if you omit all optional arguments, the router searches internal flash memory for the first bootable image. On the Cisco 7000 family routers, when you omit all arguments that follow this keyword, the system searches the Personal Computer Memory Card Industry Association (PCMCIA) slot 0 for the first bootable image. Configuration Fundamentals Commands boot system CF-57 Cisco IOS Configuration Fundamentals Command Reference April 2010 flash-fs: (Optional) Flash file system containing the system image to load at startup. The colon is required. Valid file systems are as follows: • flash:—Internal flash memory on the Cisco 1600 series and Cisco 3600 series routers. For the Cisco 1600 series and Cisco 3600 series routers, this file system is the default if you do not specify a file system. This is the only valid file system for the Cisco 1600 series. • bootflash:—Internal flash memory in the Cisco 7000 family. • slot0:—First PCMCIA slot on the Cisco 3600 series and Cisco 7000 family routers. For the Cisco 7000 family routers, this file system is the default if you do not specify a file system. • slot1:—Flash memory card in the second PCMCIA slot on the Cisco 3600 series and Cisco 7000 family routers. On the Cisco 2600 series routers, a file system should be specified. Otherwise, the router may attempt to load the Cisco IOS software twice with unexpected results. partition-number: (Optional) Number of the flash memory partition that contains the system image to boot, specified by the optional filename argument. If you do not specify a filename, the router loads the first valid file in the specified partition of flash memory. This argument is valid only on routers that can be partitioned. filename (Optional when used with the boot system flash command) Name of the system image to load at startup. This argument is case sensitive. If you do not specify a value for the filename argument, the router loads the first valid file in the following: • The specified flash file system • The specified partition of flash memory • The default flash file system if you also omitted the flash-fs: argument mop Boots the router from a system image stored on a DECNET Maintenance Operations Protocol (MOP) server. Do not use this keyword with the Cisco 3600 series or Cisco 7000 family routers. mac-address (Optional) MAC address of the MOP server containing the specified system image file. If you do not include the MAC address argument, the router sends a broadcast message to all MOP boot servers. The first MOP server to indicate that it has the specified file is the server from which the router gets the boot image. interface (Optional) Interface the router uses to send out MOP requests to the MOP server. The interface options are async, dialer, ethernet, serial, and tunnel. If you do not specify the interface argument, the router sends a request out on all interfaces that have MOP enabled. The interface that receives the first response is the interface the router uses to load the software. rom Boots the router from ROM. Do not use this keyword with the Cisco 3600 series or the Cisco 7000 family routers. rcp Boots the router from a system image stored on a network server using rcp. tftp Boots the router from a system image stored on a TFTP server. Configuration Fundamentals Commands boot system CF-58 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Default If you configure the router to boot from a network server but do not specify a system image file with the boot system command, the router uses the configuration register settings to determine the default system image filename. The router forms the default boot filename by starting with the word cisco and then appending the octal equivalent of the boot field number in the configuration register, followed by a hyphen (-) and the processor type name (cisconn-cpu). Refer to the appropriate hardware installation guide for details on the configuration register and default filename. See also the config-register or confreg command. Command Modes Global configuration Command History Usage Guidelines For this command to work, the config-register command must be set properly. Enter several boot system commands to provide a fail-safe method for booting your router. The router stores and executes the boot system commands in the order in which you enter them in the configuration file. If you enter multiple boot commands of the same type—for example, if you enter two commands that instruct the router to boot from different network servers—then the router tries them in the order in which they appear in the configuration file. If a boot system command entry in the list specifies an invalid device, the router omits that entry. Use the boot system rom command to specify use of the ROM system image as a backup to other boot system commands in the configuration. For some platforms, the boot image must be loaded before the system image is loaded. However, on many platforms, the boot image is loaded only if the router is booting from a network server or if the flash file system is not specified. If the file system is specified, the router will boot faster because it need not load the boot image first. This section contains the following topics: • Changing the List of Boot System Commands • Booting Compressed Images • Understanding rcp • Understanding TFTP • Understanding FTP ftp Boots the router from a system image stored on an FTP server. ip-address (Optional) IP address of the server containing the system image file. If omitted, this value defaults to the IP broadcast address of 255.255.255.255. Release Modification 10.0 This command was introduced. 12.2(14)SX Support for this command was added for the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(31)SB2 This command was integrated into Cisco IOS Release 12.2(31)SB. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. Configuration Fundamentals Commands boot system CF-59 Cisco IOS Configuration Fundamentals Command Reference April 2010 • Stopping Booting and Entering ROM Monitor Mode • Cisco 1600 Series, Cisco 3600 Series, Cisco 7000 Family, and Cisco 7600 Series Router Notes Changing the List of Boot System Commands To remove a single entry from the bootable image list, use the no form of the command with an argument. For example, to remove the entry that specifies a bootable image on a flash memory card inserted in the second slot, use the no boot system flash slot1:[filename] command. All other entries in the list remain. To eliminate all entries in the bootable image list, use the no boot system command. At this point, you can redefine the list of bootable images using the previous boot system commands. Remember to save your changes to your startup configuration by issuing the copy system:running-config nvram:startup-config command. Each time you write a new software image to flash memory, you must delete the existing filename in the configuration file with the no boot system flash filename command. Then add a new line in the configuration file with the boot system flash filename command. Note If you want to rearrange the order of the entries in the configuration file, you must first issue the no boot system command and then redefine the list. Booting Compressed Images You can boot the router from a compressed image on a network server. When a network server boots software, both the image being booted and the running image must be able to fit into memory. Use compressed images to ensure that enough memory is available to boot the router. You can compress a software image on any UNIX platform using the compress command. Refer to your UNIX platform’s documentation for the exact usage of the compress command. (You can also uncompress data with the UNIX uncompress command.) Understanding rcp The rcp requires that a client send the remote username in an rcp request to a server. When the router executes the boot system rcp command, the Cisco IOS software sends the hostname as both the remote and local usernames by default. Before the rcp can execute properly, an account must be defined on the network server for the remote username configured on the router. If the server has a directory structure, the rcp software searches for the system image to boot from the remote server relative to the directory of the remote username. By default, the router software sends the hostname as the remote username. You can override the default remote username by using the ip rcmd remote-username command. For example, if the system image resides in the home directory of a user on the server, you can specify that user’s name as the remote username. Understanding TFTP You need a TFTP server running to retrieve the router image from the host. Understanding FTP You need an FTP server running to retrieve the router image from the host. You also need an account on the server or anonymous file access to the server. Configuration Fundamentals Commands boot system CF-60 Cisco IOS Configuration Fundamentals Command Reference April 2010 Stopping Booting and Entering ROM Monitor Mode During the first 60 seconds of startup, you can force the router to stop booting by pressing the Break key. The router will enter ROM monitor mode, where you can change the configuration register value or boot the router manually. Cisco 1600 Series, Cisco 3600 Series, Cisco 7000 Family, and Cisco 7600 Series Router Notes For the Cisco 3600 series and Cisco 7000 family, the boot system command modifies the BOOT variable in the running configuration. The BOOT variable specifies a list of bootable images on various devices. Note When you use the boot system command on the Cisco 1600 series, Cisco 3600 series, Cisco 7000 family, and Cisco 7600 series, you affect only the running configuration. You must save the BOOT variable settings to your startup configuration to place the information under ROM monitor control and to have the variable function as expected. Use the copy system:running-config nvram:startup-config privileged EXEC command to save the variable from your running configuration to your startup configuration. To display the contents of the BOOT variable, use the show bootvar EXEC command. Examples The following example illustrates a configuration that specifies two possible internetwork locations for a system image, with the ROM software being used as a backup: Router(config)# boot system tftp://192.168.7.24/cs3-rx.90-1 Router(config)# boot system tftp://192.168.7.19/cs3-rx.83-2 Router(config)# boot system rom The following example boots the system boot relocatable image file named igs-bpx-l from partition 2 of the flash device: Router(config)# boot system flash:2:igs-bpx-l The following example instructs the router to boot from an image located on the flash memory card inserted in slot 0: Router(config)# boot system slot0:new-config The following example specifies the file named new-ios-image as the system image for a Cisco 3600 series router to load at startup. This file is located in the fourth partition of the flash memory card in slot 0. Router(config)# boot system slot0:4:dirt/images/new-ios-image This example boots from the image file named c1600-y-l in partition 2 of flash memory of a Cisco 1600 series router: Router(config)# boot system flash:2:c1600-y-l Related Commands Command Description boot Boots the router manually. config-register Changes the configuration register settings. Configuration Fundamentals Commands boot system CF-61 Cisco IOS Configuration Fundamentals Command Reference April 2010 confreg Changes the configuration register settings while in ROM monitor mode. copy Copies any file from a source to a destination. copy system:running-config nvram:startup-config Copies the running configuration to the startup configuration. ip rcmd remote username Configures the remote username to be used when requesting a remote copy using rcp. show bootvar Displays the contents of the BOOT variable, the name of the configuration file pointed to by the CONFIG_FILE variable, the contents of the BOOTLDR variable, and the configuration register setting. Command Description Configuration Fundamentals Commands boot-end-marker CF-62 Cisco IOS Configuration Fundamentals Command Reference April 2010 boot-end-marker The boot-start-marker and boot-end-marker flags, which can be seen in Cisco IOS software configuration files, are not CLI commands. These markers are written to configuration files automatically to flag the beginning and end of the boot commands (boot statements). By flagging boot statements, these markers allow the router to more reliably load Cisco IOS images during bootup. A boot statement is one or more lines in a configuration file that tells the router which software image to load after a powercycling (reboot). The boot-start-marker and boot-end-marker flags will appear around any boot commands, including: • boot bootstrap • boot config • boot host • boot network • boot system Note, however, that these markers will always appear in the output of the show running-config or more system:running-config commands, regardless of whether any actual boot commands have been entered. This means that no boot commands will appear between the markers if no boot commands have been entered, or if all boot commands have been removed from the configuration, as shown in the “Examples” section. The boot-start-marker and boot-end-marker flags cannot be removed or modified using the CLI. These markers are written to the startup configuration file whenever a copy running-config startup-config command is issued. These flags were also introduced to circumvent errors in the configuration file, such as a leading space before a boot command (such as those sometimes introduced by manually edited configuration files), or the use of text strings that include the word “boot” in banners or other user-specified text. If the “boot start-marker” flag is not found in the configuration file, the system will use the traditional method to identify the boot commands. However, if you are manually creating configuration files, or copying from older Cisco IOS software releases, the addition of these markers is recommended. Command History Examples In the following example, a boot command is entered, and the boot-start-marker and boot-end-marker flags are shown in the context of the startup configuration file: Router# configure terminal Enter configuration commands, one per line. End with the end command. Router(config)# boot system slot0: Router(config)# end Router# copy running-config startup-config Router# show startup-config Using 1398 out of 129016 bytes ! Release Modification 12.3(3), 12.3(4)T, 12.0(26)S, 12.0(27)SV, 12.3(3)B, The boot-start-marker and boot-end-marker flags were introduced. Configuration Fundamentals Commands boot-end-marker CF-63 Cisco IOS Configuration Fundamentals Command Reference April 2010 version 12.3 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname C3660-2 ! boot-start-marker boot system slot0: boot-end-marker ! logging count . . . In the following example, the boot-start-marker and boot-end-marker flags appear in the configuration file even though no boot commands have been entered: Router# show running-configuration Current configuration :3055 bytes ! ! No configuration change since last restart ! version 12.3 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router ! boot-start-marker boot-end-marker ! . . . Related Commands Command Description boot bootstrap Specifies the filename and location of a secondary bootstrap image (to be used if a valid software image cannot be loaded). boot config Specifies the device and filename of the configuration file from which the router boots during startup (for Class A filesytems). boot host Specifies a remote host location for the host-specific (router-specific) configuration file to be used at the next system startup. boot network Specifies a remote location for the network (network-wide) configuration file to be used at the next system startup. boot system Specifies the system software image that the router loads at startup. Configuration Fundamentals Commands boot-start-marker CF-64 Cisco IOS Configuration Fundamentals Command Reference April 2010 boot-start-marker The boot-start-marker and boot-end-marker flags, which can be seen in Cisco IOS software configuration files, are not CLI commands. These markers are written to configuration files automatically to flag the beginning and end of the boot commands (boot statements). By flagging boot statements, these markers allow the router to more reliably load Cisco IOS images during bootup. A boot statement is one or more lines in a configuration file that tells the router which software image to load after a powercycling (reboot). The boot-start-marker and boot-end-marker flags will appear around any boot commands, including: • boot bootstrap • boot config • boot host • boot network • boot system Note, however, that these markers will always appear in the output of the show running-config or more system:running-config commands, regardless of whether any actual boot commands have been entered. This means that no boot commands will appear between the markers if no boot commands have been entered, or if all boot commands have been removed from the configuration, as shown in the “Examples” section. The boot-start-marker and boot-end-marker flags cannot be removed or modified using the CLI. These markers are written to the startup configuration file whenever a copy running-config startup-config command is issued. These flags were also introduced to circumvent errors in the configuration file, such as a leading space before a boot command (such as those sometimes introduced by manually edited configuration files), or the use of text strings that include the word “boot” in banners or other user-specified text. If the “boot start-marker” flag is not found in the configuration file, the system will use the traditional method to identify the boot commands. However, if you are manually creating configuration files, or copying from older Cisco IOS software releases, the addition of these markers is recommended. Command History Examples In the following example, a boot command is entered, and the boot-start-marker and boot-end-marker flags are shown in the context of the startup configuration file: Router# configure terminal Enter configuration commands, one per line. End with the end command. Router(config)# boot system slot0: Router(config)# end Router# copy running-config startup-config Router# show startup-config Using 1398 out of 129016 bytes ! Release Modification 12.3(3), 12.3(4)T, 12.0(26)S, 12.0(27)SV, 12.3(3)B The boot-start-marker and boot-end-marker flags were introduced. Configuration Fundamentals Commands boot-start-marker CF-65 Cisco IOS Configuration Fundamentals Command Reference April 2010 version 12.3 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname C3660-2 ! boot-start-marker boot system slot0: boot-end-marker ! logging count . . . In the following example, the boot-start-marker and boot-end-marker flags appear in the configuration file even though no boot commands have been entered: Router# show running-configuration Current configuration :3055 bytes ! ! No configuration change since last restart ! version 12.3 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router ! boot-start-marker boot-end-marker ! . . . Related Commands Command Description boot bootstrap Specifies the filename and location of a secondary bootstrap image (to be used if a valid software image cannot be loaded). boot config Specifies the device and filename of the configuration file from which the router boots during startup (for Class A filesytems). boot host Specifies a remote host location for the host-specific (router-specific) configuration file to be used at the next system startup. boot network Specifies a remote location for the network (network-wide) configuration file to be used at the next system startup. boot system Specifies the system software image that the router loads at startup. cd CF-66 Cisco IOS Configuration Fundamentals Command Reference April 2010 cd To change the default directory or file system, use the cd command in user EXEC or privileged EXEC mode. cd [filesystem:][directory] Syntax Description Defaults The initial default file system is flash:. For platforms that do not have a physical device named flash:, the keyword flash: is aliased to the default Flash device. For the Supervisor Engine, the initial default file system is disk0:. If you do not specify a directory on a file system, the default is the root directory on that file system. Command Modes User EXEC Privileged EXEC Command History Usage Guidelines The valid values for filesystem: are as follows: • For systems that are configured with a Supervisor Engine 2, valid values are bootflash:, const_nvram:, disk0:, flash:, nvram:, slot0:, sup-slot0:, and sup-bootflash:. • For systems that are configured with a Supervisor Engine 720, valid values are disk0: and disk1:. For all EXEC commands that have an optional filesystem argument, the system uses the file system specified by the cd command when you omit the optional filesystem argument. For example, the dir command, which displays a list of files on a file system, contains an optional filesystem argument. When you omit this argument, the system lists the files on the file system specified by the cd command. If you do not specify a directory on a file system, the default is the root directory on that file system. Examples In the following example, the cd command is used to set the default file system to the Flash memory card inserted in slot 0: Router# pwd filesystem: (Optional) The URL or alias of the directory or file systems followed by a colon. directory (Optional) Name of the directory. Release Modification 11.0 This command was introduced. 12.2(14)SX This command was integrated into Cisco IOS Release 12.2(14)SX, and support was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support was added for the Supervisor Engine 2. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. cd CF-67 Cisco IOS Configuration Fundamentals Command Reference April 2010 bootflash:/ Router# cd slot0: Router# pwd slot0:/ Cisco 7600 Series This example sets the default file system to the Flash PC card that is inserted in disk 0: Router# cd disk0: Router# pwd disk0:/ Related Commands Command Description copy Copies any file from a source to a destination. delete Deletes a file on a Flash memory device. dir Displays a list of files on a file system. mkdir disk0: Creates a new directory in a Flash file system. pwd Displays the current setting of the cd command. show file systems Lists available file systems and their alias prefix names. undelete Recovers a file marked “deleted” on a Class A or Class B Flash file system. clear archive log config CF-68 Cisco IOS Configuration Fundamentals Command Reference April 2010 clear archive log config To purge the configuration logging database entries, use the clear archive log config command in privileged EXEC mode. clear archive log config [force | persistent] Syntax Description Command Default If this command is not used, the database entries accumulate in the archive log. Command Modes Privileged EXEC (#) Command History Usage Guidelines When the clear archive log config command is entered, only the entries in the configuration logging database file are deleted. The file itself is not deleted; it will be used in the future to log new entries as they occur. Examples The following example clears the database entries that have been saved to the config log without asking you to confirm the action before the entries are cleared: Router# clear archive log config force Related Commands force (Optional) Eliminates the confirm step before the contents of the archive log are cleared. persistent (Optional) Purges the configuration logging persistent-command database entries. Release Modification 12.2(33)SRA This command was introduced. 12.4(11)T This command was integrated into Cisco IOS Release 12.4(11)T. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB. Command Description show archive log config all persistent Displays the persisted commands in configlet format. clear catalyst6000 traffic-meter CF-69 Cisco IOS Configuration Fundamentals Command Reference April 2010 clear catalyst6000 traffic-meter To clear the traffic meter counters, use the clear catalyst6000 traffic-meter command in privileged EXEC mode. clear catalyst6000 traffic-meter Syntax Description This command has no arguments or keywords. Defaults This command has no default settings. Command Modes Privileged EXEC Command History Examples This example shows how to clear the traffic meter counters: Router# clear catalyst6000 traffic-meter Router# Release Modification 12.2(17a)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. clear configuration lock CF-70 Cisco IOS Configuration Fundamentals Command Reference April 2010 clear configuration lock To clear the lock on the running configuration file, use the clear configuration lock command in privileged EXEC mode. clear configuration lock Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Examples The following is sample output from the clear configuration lock command when the running configuration file is not locked by the configure replace command: Router# clear configuration lock Parser Config not locked. The following is sample output from the clear configuration lock command when the running configuration file is locked by the configure replace command: Router# clear configuration lock Process <3> is holding the EXCLUSIVE lock ! Do you want to clear the lock?[confirm] y The following example shows how to use the clear configuration lock command to display the owner or process ID of the lock and prompt the user for confirmation: Router# clear configuration lock Process <46> is holding the EXCLUSIVE lock. Do you want to clear the lock?[confirm] y After the lock is cleared, a message will be sent to the terminal if the owner of the lock is a TTY user: Router(config)# The configuration lock was cleared by user from terminal <5> Release Modification 12.2(25)S This command was introduced. 12.3(14)T This command was enhanced to allow the exclusive configuration lock to be cleared during erratic or abnormal behavior. 12.0(31)S This command was integrated into Cisco IOS Release 12.0(31)S. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(31)SXH. clear configuration lock CF-71 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description configuration mode exclusive Enables single-user (exclusive) access functionality for the Cisco IOS CLI. debug configuration lock Enables debugging of the Cisco IOS configuration lock. show configuration lock Displays information about the lock status of the running configuration file during a configuration replace operation. clear ip http client cache CF-72 Cisco IOS Configuration Fundamentals Command Reference April 2010 clear ip http client cache To remove information from the HTTP client cache, use the clear ip http client cache command in privileged EXEC mode. clear ip http client cache {all | session session-name | url complete-url} Syntax Description Command Default None Command Modes Privileged EXEC Command History Usage Guidelines Use this command to clear entries from the HTTP client cache pool: all the entries, all the entries owned by a specific session, or only the entry associated with a specific request from an HTTP server. Examples The following example clears all entries in the HTTP client cache: Router# clear ip http client cache all The following example removes HTTP client cache entries that belong to the HTTP Client File System (CFS) application: Router# clear ip http client cache session HTTP CFS The following example removes HTTP client cache entries at the location http://myrouter.cisco.com/flash:/: Router# clear ip http client cache url http://myrouter.cisco.com/flash:/ Related Commands cache all Removes all HTTP client cache entries. cache session session-name Removes HTTP client cache entries of the HTTP client application session specified by the session-name argument. cache url complete-url Removes the HTTP client cache entry whose location is specified by the complete-url argument, a Cisco IOS File System (IFS) Uniform Resource Locator (URL), and that consists of HTML files used by an HTTP server. Release Modification 12.2(31)SB2 This command was introduced. Command Description ip http path Specifies the base path used to locate files for use by the HTTP server. show ip http client Displays a report about the HTTP client. clear logging CF-73 Cisco IOS Configuration Fundamentals Command Reference April 2010 clear logging To clear messages from the logging buffer, use the clear logging command in privileged EXEC mode. clear logging Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Examples In the following example, the logging buffer is cleared: Router# clear logging Clear logging buffer [confirm] Router# Related Commands Release Modification 11.2 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description logging buffered Logs messages to an internal buffer. show logging Displays the state of logging (syslog). clear logging system CF-74 Cisco IOS Configuration Fundamentals Command Reference April 2010 clear logging system To clear event records stored in the System Event Archive (SEA) log file sea_log.dat, use the clear logging system command in user EXEC mode. clear logging system [disk name] Syntax Description Command Default This command has no default settings. Command Modes User EXEC (>) Command History Usage Guidelines SEA is supported on switches that have a Supervisor Engine 32 or Supervisor Engine 720 with a compact flash adapter and a Compact Flash card (WS-CF-UPG= for Supervisor Engine 720). Cisco Universal Broadband Router 10012 The SEA feature is used to address debug trace and system console constraints. SEA is a logging feature that allows the modules in the system to report major and critical events to the route processor (RP). The events occurring on the line card or jacket card are also sent to the RP using Inter-Process Communication (IPC) capability. Use the clear logging system command to clear the event records stored in the SEA log file. Note To store the system event logs, the SEA requires either the PCMCIA ATA disk or Compact Flash Disk in compact flash adapter for PRE2. Examples This example shows how to clear the SEA: Router# clear logging system Clear logging system operation will take a while. Do you want to continue? [no]: yes Router# Related Commands disk name (Optional) Stores the system event log in the specified disk. Release Modification 12.2(33)SXH This command was introduced. 12.2(33)SCC This command was introduced for the Cisco uBR10012 router in the Cisco IOS Software Release 12.2(33)SCC. copy logging system Copies the archived system events to another location. clear logging system CF-75 Cisco IOS Configuration Fundamentals Command Reference April 2010 logging system Enables or disables the SEA logging system. show logging system Displays the SEA logging system disk. clear logging xml CF-76 Cisco IOS Configuration Fundamentals Command Reference April 2010 clear logging xml To clear the contents of the XML system message logging (syslog) buffer, use the clear logging xml command in User EXEC or Priviledged EXEC mode.. clear logging xml Syntax Description This command has no arguments or keywords. Defaults No default behavior or values. Command Modes User EXEC Privileged EXEC Command History Usage Guidelines This command clears the contents of the XML-formatted logging buffer, but does not clear the contents of the standard logging buffer. The system will prompt you to confirm the action before clearing the buffer. Examples In the following example, the XML-specific buffer is cleared: Router# clear logging xml Clear XML logging buffer [confirm]?y Related Commands Release Modification 12.2(15)T This command was introduced. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE . Command Description logging buffered xml Enables system message logging (syslog) to the XML-specific buffer in XML format. show logging xml Displays the state of XML-formatted system message logging, followed by the contents of the XML-specific buffer. clear mls statistics CF-77 Cisco IOS Configuration Fundamentals Command Reference April 2010 clear mls statistics To reset the Multilayer Switching (MLS) statistics counters, use the clear mls statistics command in privileged EXEC mode. clear mls statistics [module num] Syntax Description Defaults This command has no default settings. Command Modes Privileged EXEC Command History Usage Guidelines This command replaces the clear mls stats command, which was introduced on the Supervisor Engine 720 in Cisco IOS Release 12.2(17a)SX, and on the Supervisor Engine 2 in Cisco IOS Release 12.2(17d)SXB. Examples This example shows how to reset the MLS statistics counters for all modules: Router# clear mls statistics Router# This example shows how to reset the MLS statistics counters for a specific module: Router# clear mls statistics module 5 Router# Related Commands module num (Optional) Specifies the module number. Release Modification 12.2(17d)SXB1 This command was introduced on the Supervisor Engine 720 and the Supervisor Engine 2. 12.2(17d)SXB5 The module num keyword and argument pair were added. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show mls statistics Displays the MLS statistics for the IP, IPX, multicast, Layer 2 protocol, and QoS. clear parser cache CF-78 Cisco IOS Configuration Fundamentals Command Reference April 2010 clear parser cache To clear the parse cache entries and hit/miss statistics stored for the Parser Cache feature, use the clear parser cache command in privileged EXEC mode. clear parser cache Syntax Description This command has no arguments or keywords. Defaults No default behavior or values. Command Modes Privileged EXEC Command History Usage Guidelines The Parser Cache feature optimizes the parsing (translation and execution) of Cisco IOS software configuration command lines by remembering how to parse recently encountered command lines, decreasing the time required to process large configuration files. The clear parser cache command will free the system memory used by the Parser Cache feature and will erase the hit/miss statistics stored for the output of the show parser statistics EXEC command. This command is only effective when the Parser Cache feature is enabled. Examples The following example shows the clearing of the parser cache: Router# show parser statistics Last configuration file parsed:Number of Commands:1484, Time:820 ms Parser cache:enabled, 1460 hits, 26 misses Router# clear parser cache Router# show parser statistics Last configuration file parsed:Number of Commands:1484, Time:820 ms Parser cache:enabled, 0 hits, 1 misses Related Commands Release Modification 12.1(5)T This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description parser cache Enables or disables the Parser Cache feature. show parser statistics Displays statistics about the last configuration file parsed and the status of the Parser Cache feature. clear platform netint CF-79 Cisco IOS Configuration Fundamentals Command Reference April 2010 clear platform netint To clear the interrupt-throttling counters for the platform, use the clear platform netint command in privileged EXEC mode. clear platform netint Syntax Description This command has no arguments or keywords. Defaults This command has no default settings. Command Modes Privileged EXEC Command History Examples This example shows how to clear the interrupt-throttling counters for the platform: Router# clear platform netint Router# Related Commands Release Modification 12.2(17b)SXA Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show platform netint Displays the platform network-interrupt information. clear processes interrupt mask CF-80 Cisco IOS Configuration Fundamentals Command Reference April 2010 clear processes interrupt mask To clear interrupt mask details for all processes in the interrupt mask buffer, use the clear processes interrupt mask detail command in privileged EXEC mode. clear processes interrupt mask detail Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Usage Guidelines See the documentation of the scheduler interrupt mask commands (listed in the Related Commands table) for further details on process interrupt mask profiling. Examples The following example demonstrates how to the clear interrupt mask statistics from system memory for all processes: Router# clear processes interrupt mask detail Related Commands Release Modification 12.4(2)T This command was introduced as part of the Process Interrupt Mask Profiler Enhancement feature. Command Description scheduler interrupt mask profile Starts interrupt mask profiling for all processes running on the system scheduler interrupt mask size Configures the maximum number of entries that can exist in the interrupt mask buffer. scheduler interrupt mask time Configures the maximum time that a process can run with interrupts masked. show process interrupt mask buffer Displays the information stored in the interrupt mask buffer. show processes interrupt mask detail Displays interrupt masked details for the specified processes or all processes in the system. clear tcp CF-81 Cisco IOS Configuration Fundamentals Command Reference April 2010 clear tcp To clear a TCP connection, use the clear tcp command in privileged EXEC mode. clear tcp {line line-number | local hostname port remote hostname port | tcb address} Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines The clear tcp command is particularly useful for clearing hung TCP connections. The clear tcp line line-number command terminates the TCP connection on the specified tty line. Additionally, all TCP sessions initiated from that tty line are terminated. The clear tcp local hostname port remote hostname port command terminates the specific TCP connection identified by the host name and port pair of the local and remote router. The clear tcp tcb address command terminates the specific TCP connection identified by the TCB address. Examples The following example clears a TCP connection using its tty line number. The show tcp command displays the line number (tty2) that is used in the clear tcp command. Router# show tcp tty2, virtual tty from host router20.cisco.com Connection state is ESTAB, I/O status: 1, unread input bytes: 0 Local host: 171.69.233.7, Local port: 23 Foreign host: 171.69.61.75, Foreign port: 1058 Enqueued packets for retransmit: 0, input: 0, saved: 0 Event Timers (current time is 0x36144): Timer Starts Wakeups Next Retrans 4 0 0x0 TimeWait 0 0 0x0 AckHold 7 4 0x0 SendWnd 0 0 0x0 KeepAlive 0 0 0x0 GiveUp 0 0 0x0 line line-number Line number of the TCP connection to clear. local hostname port remote hostname port Host name of the local router and port and host name of the remote router and port of the TCP connection to clear. tcb address Transmission Control Block (TCB) address of the TCP connection to clear. The TCB address is an internal identifier for the endpoint. Release Modification 11.1 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. clear tcp CF-82 Cisco IOS Configuration Fundamentals Command Reference April 2010 PmtuAger 0 0 0x0 iss: 4151109680 snduna: 4151109752 sndnxt: 4151109752 sndwnd: 24576 irs: 1249472001 rcvnxt: 1249472032 rcvwnd: 4258 delrcvwnd: 30 SRTT: 710 ms, RTTO: 4442 ms, RTV: 1511 ms, KRTT: 0 ms minRTT: 0 ms, maxRTT: 300 ms, ACK hold: 300 ms Router# clear tcp line 2 [confirm] [OK] The following example clears a TCP connection by specifying its local router host name and port and its remote router host name and port. The show tcp brief command displays the local (Local Address) and remote (Foreign Address) host names and ports to use in the clear tcp command. Router# show tcp brief TCB Local Address Foreign Address (state) 60A34E9C router1.cisco.com.23 router20.cisco.1055 ESTAB Router# clear tcp local router1 23 remote router20 1055 [confirm] [OK] The following example clears a TCP connection using its TCB address. The show tcp brief command displays the TCB address to use in the clear tcp command. Router# show tcp brief TCB Local Address Foreign Address (state) 60B75E48 router1.cisco.com.23 router20.cisco.1054 ESTAB Router# clear tcp tcb 60B75E48 [confirm] [OK] Related Commands Command Description show tcp Displays the status of TCP connections. show tcp brief Displays a concise description of TCP connection endpoints. clear vlan counters CF-83 Cisco IOS Configuration Fundamentals Command Reference April 2010 clear vlan counters To clear the software-cached counter values to start from zero again for a specified VLAN or all existing VLANs, use the clear vlan counters command in privileged EXEC mode. clear vlan [vlan-id] counters Syntax Description Defaults This command has no default settings. Command Modes Privileged EXEC Command History Usage Guidelines If you do not specify a vlan-id; the software-cached counter values for all existing VLANs are cleared. Examples This example shows how to clear the software-cached counter values for a specific VLAN: Router# clear vlan 10 counters Clear "show vlan" counters on this vlan [confirm]y Router# Related Commands vlan-id (Optional) The ID of a specific VLAN. Range: 1 to 4094. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show vlan counters Displays the software-cached counter values. clock CF-84 Cisco IOS Configuration Fundamentals Command Reference April 2010 clock To configure the port clocking mode for the 1000BASE-T transceivers, use the clock command in interface configuration mode. To return to the default settings,use the no form of this command. clock {auto | active [prefer] | passive [prefer]} no clock Syntax Description Defaults auto Command Modes Interface configuration Command History Usage Guidelines This command is supported on the 1000BASE-T transceivers only. If the clock mode of the near end of a link does not match the clock mode of the far end, the line protocol does not come up. The active and passive clock status is determined during the auto negotiation process before the transmission link is established. The clock command supports the following configurations: • auto—Auto negotiates with the far end of the link but preference is given to the active-clock switch. • active—Uses a local clock to determine transmitter-operation timing. • passive—Recovers the clock from the received signal and uses the recovered clock to determine transmitter-operation timing. • active prefer—Auto negotiates with the far end of the link but preference is given to the active-clock switch. • passive prefer—Auto negotiates with the far end of the link but preference is given to the passive-clock switch. Enter the show running-config interface command to display the current clock mode. Enter the show interfaces command to display the clock mode that is negotiated by the firmware. auto Enables the automatic-clock configuration. active Enables the active operation. prefer (Optional) Negotiates the specified mode with the far end of the link. passive Enables the passive operation. Release Modification 12.2(17a)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. clock CF-85 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples This example shows how to enable the active-clock operation: Router(config-if)# clock active Router(config-if)# Related Commands Command Description show interfaces Displays traffic that is seen by a specific interface. show running-config interface Displays the status and configuration of the module or Layer 2 VLAN. clock initialize nvram CF-86 Cisco IOS Configuration Fundamentals Command Reference April 2010 clock initialize nvram To restart the system clock from the last known system clock value, use the clock initialize nvram command in global configuration mode. To disable the restart of the system clock from the last known system clock value, use the no form of this command. clock initialize nvram no clock initialize nvram Syntax Description This command has no arguments or keywords. Command Default By default, the system clock is set to restart from the last known system clock value for platforms that have no hardware calendar. Command Modes Global configuration (config) Command History Usage Guidelines For platforms that have hardware calendars, the clock initialize nvram command is not available. When the no form of the command is configured, the system clock gets initialized to default standard values. The default values can be either 1MAR1993 or 1MAR2002. Examples The following example shows how to set the system clock to restart from the last known system clock value: Router(config)# clock initialize nvram Release Modification 12.3(4)T This command was introduced. config-register CF-87 Cisco IOS Configuration Fundamentals Command Reference April 2010 config-register To change the configuration register settings, use the config-register command in global configuration mode. config-register value Syntax Description Command Default Refer to the documentation for your platform for the default configuration register value. For many newer platforms, the default is 0x2102, which causes the router to boot from Flash memory and the Break key to be ignored. Command Modes Global configuration Command History Usage Guidelines This command applies only to platforms that use a software configuration register. The lowest four bits of the configuration register (bits 3, 2, 1, and 0) form the boot field. The boot field determines if the router boots manually, from ROM, or from Flash or the network. To change the boot field value and leave all other bits set to their default values, follow these guidelines: • If you set the configuration register boot field value to 0x0, you must boot the operating system manually with the boot command. • If you set the configuration register boot field value to 0x1, the router boots using the default ROM software. • If you set the configuration register boot field to any value from 0x2 to 0xF, the router uses the boot field value to form a default boot filename for booting from a network server. For more information about the configuration register bit settings and default filenames, refer to the appropriate router hardware installation guide. Note In a virtual switch application, If you have configured your config-register with a value that would skip file parsing during the bootup process, your change to either a standalone or virtual switch will not take place until you reconfigure your config-register. The config-register must be allowed to parse files in order to ensure the conversion from either a standalone or virtual switch. value Hexadecimal or decimal value that represents the 16-bit configuration register value that you want to use the next time the router is restarted. The value range is from 0x0 to 0xFFFF (0 to 65535 in decimal). Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(31)SB2 This command was integrated into Cisco IOS Release 12.2(31)SB2. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(31)SXH. config-register CF-88 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, the configuration register is set to boot the system image from Flash memory: config-register 0x2102 Related Commands Command Description boot system Specifies the system image that the router loads at startup. confreg Changes the configuration register settings while in ROM monitor mode. o Lists the value of the boot field (bits 0 to 3) in the configuration register. show version Displays the configuration of the system hardware, the software version, the names and sources of configuration files, and the boot images. configuration mode exclusive CF-89 Cisco IOS Configuration Fundamentals Command Reference April 2010 configuration mode exclusive To enable single-user (exclusive) access functionality for the Cisco IOS command-line interface (CLI), use the configuration mode exclusive command in global configuration mode. To disable the single-user access (configuration locking) feature, use the no form of this command. Syntax for Releases 12.3T/12.2S: configuration mode exclusive {auto | manual} no configuration mode exclusive {auto | manual} Syntax for Release 12.0(31)S, 12.2(33)SRA, and Later Releases: configuration mode exclusive {auto | manual} [expire seconds] [lock-show] [interleave] [terminate] [config_wait seconds] [retry_wait seconds] Syntax Description auto Automatically limits configuration to single-user mode. manual Allows you to manually limit the configuration file to single-user mode. expire seconds (Optional) Specifies the number of seconds in which the configuration lock is released after the user stops making configuration changes. lock-show (Optional) Gives priority to configuration commands being executed from the exclusive configuration session, and prevents the execution of show commands. interleave (Optional) Allows show commands from sessions that are not holding the configuration lock to be executed when the user in the session holding the configuration lock is not making configuration changes. Note If you entered lock-show, you should enter this keyword. terminate (Optional) Causes the configuration command executed from the exclusive configuration session to terminate show and clear commands being executed in other sessions. config_wait seconds (Optional) Amount of time, in seconds, that a configuration command entered by a user in single user mode waits for show commands entered by other users to finish being executed. If the show command is still being executed when the timer expires and if the terminate option is set, the configuration command terminates the show command. If the configuration command completes execution before the specified number of seconds, the show command begins execution. retry_wait seconds (Optional) Specifies the amount of time, in seconds, that show and clear EXEC commands will wait for a configuration command entered by a user in exclusive configuration mode to complete execution. If the configuration command is still being executed when the specified amount of time has passed, the EXEC commands generate an error message and are terminated. If execution of the configuration command is completed before the specified number of seconds, the EXEC commands are executed. configuration mode exclusive CF-90 Cisco IOS Configuration Fundamentals Command Reference April 2010 Defaults Single-user mode is disabled. Command Modes Global configuration Command History Usage Guidelines The configuration mode exclusive command enables the exclusive configuration lock feature. The exclusive configuration lock allows single-user access to configuration modes using single-user configuration mode. While the device configuration is locked, no other users can enter configuration commands. Users accessing the device using the state-full, session-based transports (telnet, SSH) are able to enter single-user configuration mode. The user enters single-user configuration mode by acquiring the exclusive configuration lock using the configure terminal lock privileged EXEC mode command. The configuration lock is released when the user exits configuration mode by using the end or exit command, or by pressing Ctrl-Z. While a user is in single-user configuration mode, no other users can configure the device. Users accessing CLI options through stateless protocols (that is, the HTTP web-based user interface) cannot access single-user configuration mode. (However, an API allows the stateless transports to lock the configuration mode, complete its operations, and release the lock.) Examples The following example shows how to configure the configuration file for single-user autoconfiguration mode by using the configuration mode exclusive auto command. Use the configuration terminal command to enter global configuration mode and lock the configuration mode exclusively. After the Cisco IOS configuration mode is locked exclusively, you can verify this configuration by entering the show configuration lock command. Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)# configuration mode exclusive auto Router(config)# end Router# show running-configuration | include config Building configuration... Current configuration : 2296 bytes configuration mode exclusive auto <========== auto policy Router# Router# configure terminal ? <======== lock option not displayed when in auto policy Router# configure terminal <======= acquires the lock Release Modification 12.3(14)T This command was introduced. 12.0(31)S This command was integrated into Cisco IOS Release 12.0(31)S. The following keywords were added: expire, lock-show, interleave, terminate, config_wait, and retry_wait. New functionality was added, including Access Session Locking. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB. configuration mode exclusive CF-91 Cisco IOS Configuration Fundamentals Command Reference April 2010 The configuration mode is locked exclusively. The lock is cleared after you exit from configuration mode by entering end or exit. Enter configuration commands, one per line. End with CNTL/Z. Router(config)# Router(config)# show configuration lock Parser Configure Lock --------------------- Owner PID : 3 User : unknown TTY : 0 Type : EXCLUSIVE State : LOCKED Class : EXPOSED Count : 1 Pending Requests : 0 User debug info : configure terminal Session idle state : TRUE No of exec cmds getting executed : 0 No of exec cmds blocked : 0 Config wait for show completion : FALSE Remote ip address : Unknown Lock active time (in Sec) : 6 Lock Expiration timer (in Sec) : 593 Router(config)# Router(config)# end <========= releases the lock Router# Router# show configuration lock Parser Configure Lock --------------------- Owner PID : -1 User : unknown TTY : -1 Type : NO LOCK State : FREE Class : unknown Count : 0 Pending Requests : 0 User debug info : Session idle state : TRUE No of exec cmds getting executed : 0 No of exec cmds blocked : 0 Config wait for show completion : FALSE Remote ip address : Unknown Lock active time (in Sec) : 0 Lock Expiration timer (in Sec) : 0 Router# The following example shows how to enable the exclusive locking feature in manual mode by using the configuration mode exclusive manual command. Once you have configured manual exclusive mode, you can lock the configuration mode by using the configure terminal lock command. In this mode, the configure terminal command does not automatically lock the parser configuration mode. The lock is cleared after you exit from configuration mode by entering end or exit. Router# Router# configure terminal Configuration mode locked exclusively. The lock will be cleared once you exit out of configuration mode using end/exit configuration mode exclusive CF-92 Cisco IOS Configuration Fundamentals Command Reference April 2010 Enter configuration commands, one per line. End with CNTL/Z. Router(config)# Router(config)# configuration mode exclusive manual Router(config)# end Router# Router# show running-configuration | include configuration Building configuration... Current configuration : 2298 bytes configuration mode exclusive manual <==== 'manual' policy Router# show configuration lock Parser Configure Lock --------------------- Owner PID : -1 User : unknown TTY : -1 Type : NO LOCK State : FREE Class : unknown Count : 0 Pending Requests : 0 User debug info : Session idle state : TRUE No of exec cmds getting executed : 0 No of exec cmds blocked : 0 Config wait for show completion : FALSE Remote ip address : Unknown Lock active time (in Sec) : 0 Lock Expiration timer (in Sec) : 0 Router# Router# configure terminal ? lock Lock configuration mode <========= 'lock' option displayed in 'manual' policy Router# configure terminal <============ ‘configure terminal’ won't acquire lock automatically Enter configuration commands, one per line. End with CNTL/Z. Router(config)# show configuration lock Parser Configure Lock --------------------- Owner PID : -1 User : unknown TTY : -1 Type : NO LOCK State : FREE Class : unknown Count : 0 Pending Requests : 0 User debug info : Session idle state : TRUE No of exec cmds getting executed : 0 No of exec cmds blocked : 0 Config wait for show completion : FALSE Remote ip address : Unknown Lock active time (in Sec) : 0 Lock Expiration timer (in Sec) : 0 Router(config)# end Router# show configuration lock Parser Configure Lock --------------------- Owner PID : -1 configuration mode exclusive CF-93 Cisco IOS Configuration Fundamentals Command Reference April 2010 User : unknown TTY : -1 Type : NO LOCK State : FREE Class : unknown Count : 0 Pending Requests : 0 User debug info : Session idle state : TRUE No of exec cmds getting executed : 0 No of exec cmds blocked : 0 Config wait for show completion : FALSE Remote ip address : Unknown Lock active time (in Sec) : 0 Lock Expiration timer (in Sec) : 0 Router# Router# configure Router# configure terminal Router# configure terminal ? lock Lock configuration mode <======= 'lock' option displayed when in 'manual' policy Router# configure terminal lock Router# configure terminal lock <============ acquires exclusive configuration lock Configuration mode is locked exclusively. The lock is cleared after you exit from configuration mode by entering the end or exit command. Enter configuration commands, one per line. End with CNTL/Z. Router(config)# Router(config)# show configuration lock Parser Configure Lock --------------------- Owner PID : 3 User : unknown TTY : 0 Type : EXCLUSIVE State : LOCKED Class : EXPOSED Count : 1 Pending Requests : 0 User debug info : configure terminal lock Session idle state : TRUE No of exec cmds getting executed : 0 No of exec cmds blocked : 0 Config wait for show completion : FALSE Remote ip address : Unknown Lock active time (in Sec) : 5 Lock Expiration timer (in Sec) : 594 Router(config)# end <================ 'end' releases exclusive configuration lock Router# Router# show configuration lock Parser Configure Lock --------------------- Owner PID : -1 User : unknown TTY : -1 Type : NO LOCK State : FREE Class : unknown Count : 0 Pending Requests : 0 configuration mode exclusive CF-94 Cisco IOS Configuration Fundamentals Command Reference April 2010 User debug info : Session idle state : TRUE No of exec cmds getting executed : 0 No of exec cmds blocked : 0 Config wait for show completion : FALSE Remote ip address : Unknown Lock active time (in Sec) : 0 Lock Expiration timer (in Sec) : 0 Router# Related Commands Command Description configure terminal Enters global configuration mode. debug configuration lock Enables debugging of the Cisco IOS configuration lock. show configuration lock Displays information about the lock status of the running configuration file during a configuration replace operation. configure confirm CF-95 Cisco IOS Configuration Fundamentals Command Reference April 2010 configure confirm To confirm replacement of the current running configuration with a saved Cisco IOS configuration file, use the configure confirm command in privileged EXEC mode. configure confirm Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC (#) Command History Usage Guidelines The configure confirm command is used only if the time seconds keyword and argument of the configure replace command are specified. If the configure confirm command is not entered within the specified time limit, the configuration replace operation is automatically reversed (in other words, the current running configuration file is restored to the configuration state that existed prior to entering the configure replace command). Examples The following example shows the use of the configure replace command with the time seconds keyword and argument. You must enter the configure confirm command within the specified time limit to confirm replacement of the current running configuration file: Router# configure replace nvram:startup-config time 120 This will apply all necessary additions and deletions to replace the current running configuration with the contents of the specified configuration file, which is assumed to be a complete configuration, not a partial configuration. Enter Y if you are sure you want to proceed. ? [no]: Y Total number of passes: 1 Rollback Done Router# configure confirm Release Modification 12.3(7)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2S. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2SB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2SR. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2SX. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. 12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI. configure confirm CF-96 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description archive config Saves a copy of the current running configuration to the Cisco IOS configuration archive. configure replace Replaces the current running configuration with a saved Cisco IOS configuration file. maximum Sets the maximum number of archive files of the running configuration to be saved in the Cisco IOS configuration archive. path (config-archive) Specifies the location and filename prefix for the files in the Cisco IOS configuration archive. show archive Displays information about the files saved in the Cisco IOS configuration archive. time-period Sets the time increment for automatically saving an archive file of the current running configuration in the Cisco IOS configuration archive. configure memory CF-97 Cisco IOS Configuration Fundamentals Command Reference April 2010 configure memory To configure the system from the system memory, use the configure memory command in privileged EXEC mode. configure memory Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Usage Guidelines On all platforms except Class A Flash file system platforms, this command executes the commands located in the configuration file in NVRAM (the “startup configuration file”). On Class A Flash file system platforms, if you specify the configure memory command, the router executes the commands pointed to by the CONFIG_FILE environment variable. The CONFIG_FILE environment variable specifies the location of the configuration file that the router uses to configure itself during initialization. The file can be located in NVRAM or any of the Flash file systems supported by the platform. When the CONFIG_FILE environment variable specifies NVRAM, the router executes the NVRAM configuration only if it is an entire configuration, not a distilled version. A distilled configuration is one that does not contain access lists. To view the contents of the CONFIG_FILE environment variable, use the show bootvar EXEC command. To modify the CONFIG_FILE environment variable, use the boot config command and then save your changes by issuing the copy system:running-config nvram:startup-config command. Examples In the following example, a router is configured from the configuration file in the memory location pointed to by the CONFIG_FILE environment variable: Router# configure memory Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description boot config Specifies the device and filename of the configuration file from which the router configures itself during initialization (startup). configure memory CF-98 Cisco IOS Configuration Fundamentals Command Reference April 2010 copy system:running-config nvram:startup-config Saves the running configuration as the startup configuration file. show bootvar Displays the contents of the BOOT environment variable, the name of the configuration file pointed to by the CONFIG_FILE environment variable, the contents of the BOOTLDR environment variable, and the configuration register setting. Command Description configure network CF-99 Cisco IOS Configuration Fundamentals Command Reference April 2010 configure network The configure network command was replaced by the copy {rcp | tftp} running-config command in Cisco IOS Release 11.0. To maintain backward compatibility, the configure network command continues to function in Cisco IOS Release 12.2(11)T for most systems, but support for this command may be removed in a future release. The copy {rcp | tftp} running-config command was replaced by the copy {ftp: | rcp: | tftp:}[filename] system:running-config command in Cisco IOS Release 12.1. The copy {ftp: | rcp: | tftp:}[filename] system:running-config command specifies that a configuration file should be copied from a FTP, rcp, or TFTP source to the running configuration. See the description of the copy command in this chapter for more information. configure overwrite-network CF-100 Cisco IOS Configuration Fundamentals Command Reference April 2010 configure overwrite-network The configure overwrite-network has been replaced by the copy {ftp-url | rcp-url | tftp-url} nvram:startup-config command. See the description of the copy command in the “Cisco IOS File System Commands” chapter for more information. configure replace CF-101 Cisco IOS Configuration Fundamentals Command Reference April 2010 configure replace To replace the current running configuration with a saved Cisco IOS configuration file, use the configure replace command in privileged EXEC mode. configure replace target-url [nolock] [list] [force] [ignorecase] [revert trigger [error] [timer minutes] | time minutes] Syntax Description Command Modes Privileged EXEC (#) Command History target-url URL (accessible by the Cisco IOS file system) of the saved Cisco IOS configuration file that is to replace the current running configuration. nolock (Optional) Disables the locking of the running configuration file that prevents other users from changing the running configuration during a configuration replace operation. list (Optional) Displays a list of the command lines applied by the Cisco IOS software parser during each pass of the configuration replace operation. The total number of passes performed is also displayed. force (Optional) Replaces the current running configuration file with the specified saved Cisco IOS configuration file without prompting you for confirmation. ignorecase (Optional) Instructs the configuration to ignore the case of the configuration confirmation. revert trigger (Optional) Sets the triggers for reverting to the original configuration. • error—Reverts to the original configuration upon error. • timer minutes—Reverts to the original configuration if the specified time elapses. time minutes (Optional) Time (in minutes) within which you must enter the configure confirm command to confirm replacement of the current running configuration file. If the configure confirm command is not entered within the specified time limit, the configuration replace operation is automatically reversed (in other words, the current running configuration file is restored to the configuration state that existed prior to entering the configure replace command). Release Modification 12.3(7)T This command was introduced. 12.2(25)S The nolock keyword was added. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(31)SB2 This command was implemented on the Cisco 10000 series. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI. 12.4(20)T The revert and trigger keywords were added. configure replace CF-102 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines When configuring more than one keyword option, the following rules apply: • The list keyword must be entered before the force and time keywords. • The force keyword must be entered before the time keyword. If the current running configuration is replaced with a saved Cisco IOS configuration file that contains commands unaccepted by the Cisco IOS software parser, an error message is displayed listing the commands that were unaccepted. The total number of passes performed in the configuration replace operation is also displayed. Note In Cisco IOS Release 12.2(25)S, a locking feature for the configuration replace operation was introduced. When the configure replace command is enabled, the Cisco IOS running configuration file is locked by default for the duration of the configuration replace operation. This locking mechanism prevents other users from changing the running configuration while the replace operation is taking place, which might otherwise cause the replace operation to terminate unsuccessfully. You can disable the locking of the running configuration using the configure replace nolock command. The running configuration lock is automatically cleared at the end of the configuration replace operation. It is not expected that you should need to clear the lock manually during the replace operation, but as a protection against any unforeseen circumstances, you can manually clear the lock using the clear configuration lock command. You can also display any locks that may be currently applied to the running configuration using the show configuration lock command. Examples This section contains the following examples: • Replacing the Current Running Configuration with a Saved Cisco IOS Configuration File • Reverting to the Startup Configuration File • Performing a Configuration Replace Operation with the configure confirm Command • Performing a Configuration Rollback Operation Replacing the Current Running Configuration with a Saved Cisco IOS Configuration File The following example shows how to replace the current running configuration with a saved Cisco IOS configuration file named disk0:myconfig. Note that the configure replace command interactively prompts you to confirm the operation. Router# configure replace disk0:myconfig This will apply all necessary additions and deletions to replace the current running configuration with the contents of the specified configuration file, which is assumed to be a complete configuration, not a partial configuration. Enter Y if you are sure you want to proceed. ? [no]: Y Total number of passes: 1 12.2(33)SRC The ignorecase keyword was added. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. Release Modification configure replace CF-103 Cisco IOS Configuration Fundamentals Command Reference April 2010 Rollback Done In the following example, the list keyword is specified to display the command lines that were applied during the configuration replace operation: Router# configure replace disk0:myconfig list This will apply all necessary additions and deletions to replace the current running configuration with the contents of the specified configuration file, which is assumed to be a complete configuration, not a partial configuration. Enter Y if you are sure you want to proceed. ? [no]: Y !Pass 1 !List of Commands: no snmp-server community public ro snmp-server community mystring ro end Total number of passes: 1 Rollback Done Reverting to the Startup Configuration File The following example shows how to revert to the Cisco IOS startup configuration file. This example also shows the use of the optional force keyword to override the interactive user prompt. Router# configure replace nvram:startup-config force Total number of passes: 1 Rollback Done Performing a Configuration Replace Operation with the configure confirm Command The following example shows the use of the configure replace command with the time seconds keyword and argument. You must enter the configure confirm command within the specified time limit to confirm replacement of the current running configuration file. If the configure confirm command is not entered within the specified time limit, the configuration replace operation is automatically reversed (in other words, the current running configuration file is restored to the configuration state that existed prior to entering the configure replace command). Router# configure replace nvram:startup-config time 120 This will apply all necessary additions and deletions to replace the current running configuration with the contents of the specified configuration file, which is assumed to be a complete configuration, not a partial configuration. Enter Y if you are sure you want to proceed. ? [no]: Y Total number of passes: 1 Rollback Done Router# configure confirm Performing a Configuration Rollback Operation The following example shows how to make changes to the current running configuration and then roll back the changes. As part of the configuration rollback operation, you must save the current running configuration before making changes to the file. In this example, the archive config command is used to save the current running configuration. Note that the generated output of the configure replace command indicates that only one pass was performed to complete the rollback operation. configure replace CF-104 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note The path command must be configured before using the archive config command. You first save the current running configuration in the configuration archive as follows: Router# archive config You then enter configuration changes as shown in the following example: Router# configure terminal Router(config)# user netops2 password rain Router(config)# user netops3 password snow Router(config)# exit After making changes to the running configuration file, you might want to roll back these changes and revert to the configuration that existed before the changes were made. The show archive command is used to verify the version of the configuration to be used as a target file. The configure replace command is then used to revert to the target configuration file as shown in the following example: Router# show archive There are currently 1 archive configurations saved. The next archive file will be named disk0:myconfig-2 Archive # Name 0 1 disk0:myconfig-1 <- Most Recent 2 3 4 5 6 7 8 9 10 Router# configure replace disk0:myconfig-1 Total number of passes: 1 Rollback Done Related Commands Command Description archive config Saves a copy of the current running configuration to the Cisco IOS configuration archive. configure confirm Confirms replacement of the current running configuration with a saved Cisco IOS configuration file. maximum Sets the maximum number of archive files of the running configuration to be saved in the Cisco IOS configuration archive. path Specifies the location and filename prefix for the files in the Cisco IOS configuration archive. show archive Displays information about the files saved in the Cisco IOS configuration archive. time-period Sets the time increment for automatically saving an archive file of the current running configuration in the Cisco IOS configuration archive. configure revert CF-105 Cisco IOS Configuration Fundamentals Command Reference April 2010 configure revert To cancel the timed rollback and trigger the rollback immediately, or to reset parameters for the timed rollback, use the configure revert command in privileged EXEC mode. configure revert {now | timer {minutes | idle minutes}} Syntax Description Command Modes Privileged EXEC (#) Command History Usage Guidelines In order to use the configure revert command to configure a timed rollback, the Configuration Archive functionality must be enable first. The Configuration Archive APIs are used to store the current configuration before applying any changes or rolling back to the previous configuration. In case of multi-user environments, only the user who enabled the timed rollback functionality will have the permission to perform the following operations: • Confirm the configuration change • Reset the timer • Cancel the timer and trigger rollback immediately Examples The following example shows how to cancel the timed rollback and revert to the saved configuration immediately: Rourter(config)# archive Router(config-archive)# path disk0:abc Router# configure revert now now Cancels the timed rollback and reverts immediately. timer Resets the confirmation timer. minutes Time in minutes (1-120). idle minutes Idle time in minutes (1-120) for which to wait before rollback. Release Modification 12.2(33)SRC This command was introduced. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. 12.4(20)T This command was integrated into Cisco IOS Release 12.4(20)T. 12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI. configure revert CF-106 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description archive config Saves a copy of the current running configuration to the Cisco IOS configuration archive. configure replace Replaces the current running configuration with a saved Cisco IOS configuration file. maximum Sets the maximum number of archive files of the running configuration to be saved in the Cisco IOS configuration archive. path (config-archive) Specifies the location and filename prefix for the files in the Cisco IOS configuration archive. show archive Displays information about the files saved in the Cisco IOS configuration archive. time-period Sets the time increment for automatically saving an archive file of the current running configuration in the Cisco IOS configuration archive. configure terminal CF-107 Cisco IOS Configuration Fundamentals Command Reference April 2010 configure terminal To enter global configuration mode, use the configure terminal command in privileged EXEC mode. configure terminal Cisco IOS Releases 12.3(14)T and Subsequent Releases: configure terminal [lock] Cisco IOS Releases 12.2(33)SRC and Subsequent Releases: configure terminal [revert {timer minutes | idle minutes}] Syntax Description Command Modes Privileged EXEC (#) Command History Usage Guidelines Use this command to enter global configuration mode. Note that commands in this mode are written to the running configuration file as soon as you enter them (using the Enter key/Carriage Return). After you enter the configure terminal command, the system prompt changes from # to (config)#, indicating that the router is in global configuration mode. To leave global configuration mode and return to privileged EXEC mode, type exit or press Ctrl-Z. To view the changes to the configuration you have made, use the more system:running-config command or show running-config command in user EXEC or privileged EXEC mode. lock (Optional) Locks the running configuration into exclusive configuration mode for the duration of your configuration session. This keyword only functions if the configuration mode exclusive command was previously enabled. revert (Optional) Sets the parameters for reverting the configuration if confirmation of the new configuration is not received. timer minutes Time in minutes (1-120) for which to wait for confirmation. idle minutes Idle time in minutes (1-120) for which to wait for confirmation. Release Modification 10.0 This command was introduced. 12.3(14)T The lock keyword option was added. 12.0(31)S This command was integrated into Cisco IOS Release 12.0(31)S. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.4(20)T The revert keyword option was added, along with the timer parameters of idle and minutes. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. 12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI. configure terminal CF-108 Cisco IOS Configuration Fundamentals Command Reference April 2010 Configuration Locking The first user to enter the configure terminal lock command acquires the configuration lock (exclusive configuration mode). Examples The following example shows how to enter global configuration mode and lock the Cisco IOS software in exclusive mode: Router(config)# configure terminal lock Enter configuration commands, one per line. End with CNTL/Z. Router(config)# Related Commands Command Description boot config Specifies the device and filename of the configuration file from which the router configures itself during initialization (startup). configuration mode exclusive Enables locking of the configuration file for single user access. copy running-config startup-config or copy system:running-config nvram:startup-config Saves the running configuration as the startup configuration file. show running-config or more system:running-config Displays the currently running configuration. confreg CF-109 Cisco IOS Configuration Fundamentals Command Reference April 2010 confreg To change the configuration register settings while in ROM monitor mode, use the confreg command in ROM monitor mode. confreg [value] Syntax Description Defaults Refer to your platform documentation for the default configuration register value. Command Modes ROM monitor Command History Usage Guidelines Not all versions in the ROM monitor support this command. Refer to your platform documentation for more information on ROM monitor mode. If you use this command without specifying the configuration register value, the router prompts for each bit of the configuration register. The lowest four bits of the configuration register (bits 3, 2, 1, and 0) form the boot field. The boot field determines if the router boots manually, from ROM, or from Flash or the network. To change the boot field value and leave all other bits set to their default values, follow these guidelines: • If you set the configuration register boot field value to 0x0, you must boot the operating system manually with the boot command. • If you set the configuration register boot field value to 0x1, the router boots using the default ROM software. • If you set the configuration register boot field to any value from 0x2 to 0xF, the router uses the boot field value to form a default boot filename for booting from a network server. For more information about the configuration register bit settings and default filenames, refer to the appropriate router hardware installation guide. Examples In the following example, the configuration register is set to boot the system image from Flash memory: confreg 0x210F In the following example, no configuration value is entered, so the system prompts for each bit in the register: value (Optional) Hexadecimal value that represents the 16-bit configuration register value that you want to use the next time the router is restarted. The value range is from 0x0 to 0xFFFF. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. confreg CF-110 Cisco IOS Configuration Fundamentals Command Reference April 2010 rommon 7 > confreg Configuration Summary enabled are: console baud: 9600 boot: the ROM Monitor do you wish to change the configuration? y/n [n]: y enable "diagnostic mode"? y/n [n]: y enable "use net in IP bcast address"? y/n [n]: enable "load rom after netboot fails"? y/n [n]: enable "use all zero broadcast"? y/n [n]: enable "break/abort has effect"? y/n [n]: enable "ignore system config info"? y/n [n]: change console baud rate? y/n [n]: y enter rate: 0 = 9600, 1 = 4800, 2 = 1200, 3 = 2400 [0]: 0 change the boot characteristics? y/n [n]: y enter to boot: 0 = ROM Monitor 1 = the boot helper image 2-15 = boot system [0]: 0 Configuration Summary enabled are: diagnostic mode console baud: 9600 boot: the ROM Monitor do you wish to change the configuration? y/n [n]: You must reset or power cycle for new config to take effect. rommon 8> continue (ROM monitor) CF-111 Cisco IOS Configuration Fundamentals Command Reference April 2010 continue (ROM monitor) To return to EXEC mode from ROM monitor mode, use the continue command in ROM monitor mode. continue Syntax Description This command has no arguments or keywords. Defaults No default behavior or values. Command Modes ROM monitor Command History Usage Guidelines Use this command to return to EXEC mode from ROM monitor mode, to use the system image instead of reloading. On older platforms, the angle bracket (< >) indicates that the router is in ROM monitor mode. On newer platforms, rommon number> is the default ROM monitor prompt. Typically, the router is in ROM monitor mode when you manually load a system image or perform diagnostic tests. Otherwise, the router will most likely never be in this mode. Caution While in ROM monitor mode, the Cisco IOS system software is suspended until you issue either a reset or the continue command. Examples In the following example, the continue command switches the router from ROM monitor to EXEC mode: > continue Router# Related Commands Release Modification 11.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description boot Boots the router manually. copy CF-112 Cisco IOS Configuration Fundamentals Command Reference April 2010 copy To copy any file from a source to a destination, use the copy command in privileged EXEC or diagnostic mode. copy [/erase] [/verify | /noverify] source-url destination-url Syntax Description The exact format of the source and destination URLs varies according to the file or directory location. You may enter either an alias keyword for a particular file or a filename that follows the standard Cisco IOS file system syntax (filesystem:[/filepath][/filename]). Table 18 shows two keyword shortcuts to URLs. /erase (Optional) Erases the destination file system before copying. Note This option is typically provided on platforms with limited memory to allow for an easy way to clear local flash memory space. /verify (Optional) Verifies the digital signature of the destination file. If verification fails, the file is deleted from the destination file system. This option applies to Cisco IOS software image files only. /noverify (Optional) If the file being copied is an image file, this keyword disables the automatic image verification that occurs after an image is copied. Note This keyword is often issued if the file verify auto command is enabled, which automatically verifies the digital signature of all images that are copied. source-url The location URL (or alias) of the source file or directory to be copied. The source can be either local or remote, depending upon whether the file is being downloaded or uploaded. destination-url The destination URL (or alias) of the copied file or directory. The destination can be either local or remote, depending upon whether the file is being downloaded or uploaded. Table 18 Common Keyword Aliases to URLs Keyword Source or Destination running-config (Optional) Keyword alias for the system:running-config URL. The system:running-config keyword represents the current running configuration file. This keyword does not work in more and show file EXEC command syntaxes. startup-config (Optional) Keyword alias for the nvram:startup-config URL. The nvram:startup-config keyword represents the configuration file used during initialization (startup). This file is contained in NVRAM for all platforms except the Cisco 7000 family, which uses the CONFIG_FILE environment variable to specify the startup configuration. The Cisco 4500 series cannot use the copy running-config startup-config command. This keyword does not work in more and show file EXEC command syntaxes. copy CF-113 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following tables list URL prefix keywords by file system type. The available file systems will vary by platform. If you do not specify a URL prefix keyword, the router looks for a file in the current directory. Table 19 lists URL prefix keywords for Special (opaque) file systems. Table 20 lists them for remote file systems, and Table 21 lists them for local writable storage. Table 19 URL Prefix Keywords for Special File Systems Keyword Source or Destination cns: Source URL for Cisco Networking Services files. flh: Source URL for flash load helper log files. logging Source URL which copies messages from the logging buffer to a file. modem: Destination URL for loading modem firmware on to supported networking devices. null: Null destination for copies or files. You can copy a remote file to null to determine its size. nvram: Router NVRAM. You can copy the startup configuration to NVRAM or from NVRAM. obfl: Source or destination URL for Onboard Failure Logging files. stby-nvram: Router NVRAM on the standby hardware. You can copy the startup configuration to NVRAM or from NVRAM. stby-obfl: Source or destination URL for Onboard Failure Logging files on the standby hardware. system: Source or destination URL for system memory, which includes the running configuration. tar: Source URL for the archive file system. tmpsys: Source or destination URL for the temporary system files. xmodem: Source or destination for a file from a network machine that uses the Xmodem protocol. ymodem: Source or destination for a file from a network machine that uses the Ymodem protocol. Table 20 URL Prefix Keywords for Remote File Systems Keyword Source or Destination ftp: Source or destination URL for FTP network server. The syntax for this alias is as follows: ftp:[[[//username [:password]@]location]/directory]/filename. http:// Source or destination URL for an HTTP server (also called a web server). The syntax for this alias is as follows: http://[[username:password]@]{hostname | host-ip}[/filepath]/filename https:// Source or destination URL for a Secure HTTP (HTTPS) server. HTTPS uses Secure Socket Layer (SSL) encryption. The syntax for this alias is as follows: https://[[username:password]@]{hostname | host-ip}[/filepath]/filename copy CF-114 Cisco IOS Configuration Fundamentals Command Reference April 2010 rcp: Source or destination URL for a remote copy protocol (rcp) network server. The syntax for this alias is as follows: rcp:[[[//username@]location]/directory]/filename scp: Source or destination URL for a network server that supports Secure Shell (SSH) and accepts copies of files using the secure copy protocol (scp). The syntax for this alias is as follows: scp://username@location[/directory][/filename] tftp: Source or destination URL for a TFTP network server. The syntax for this alias is as follows: tftp:[[//location]/directory]/filename. Table 21 URL Prefix Keywords for Local Writable Storage File Systems Alias Source or Destination bootflash: Source or destination URL for boot flash memory. disk0: and disk1: Source or destination URL of disk-based media. flash: Source or destination URL for flash memory. This alias is available on all platforms. For platforms that lack a flash: device, note that flash: is aliased to slot0:, allowing you to refer to the main flash memory storage area on all platforms. harddisk: Source or destination URL of the active harddisk file system. slavebootflash: Source or destination URL for internal flash memory on the slave RSP card of a router configured for HSA. slaveram: NVRAM on a slave RSP card of a router configured for HSA. slaveslot0: Source or destination URL of the first Personal Computer Memory Card International Association (PCMCIA) card on a slave RSP card of a router configured for HSA. slaveslot1: Source or destination URL of the second PCMCIA slot on a slave RSP card of a router configured for HSA. slot0: Source or destination URL of the first PCMCIA flash memory card. slot1: Source or destination URL of the second PCMCIA flash memory card. stby-bootflash: Source or destination URL for boot flash memory in standby RP. stby-harddisk: Source or destination URL for the standby harddisk. stby-usb[0-1]: Source or destination URL for the Universal Serial Bus (USB) flash drive that has been plugged into the router and is located on the standby RP. usb[0-1]: Source or destination URL for the Universal Serial Bus (USB) flash drive that has been plugged into the router and is located on the active RP. usbflash[0-9]: Source or destination URL for the Universal Serial Bus (USB) flash drive that has been plugged into the router. usbtoken[0-9]: Source or destination URL for the USB eToken that has been plugged into the router. Table 20 URL Prefix Keywords for Remote File Systems Keyword Source or Destination copy CF-115 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Modes Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines The fundamental function of the copy command is to allow you to copy a file (such as a system image or configuration file) from one location to another location. The source and destination for the file is specified using a Cisco IOS File System URL, which allows you to specify any supported local or remote file location. The file system being used (such as a local memory source, or a remote server) dictates the syntax used in the command. You can enter on the command line all necessary source- and destination-URL information and the username and password to use, or you can enter the copy command and have the router prompt you for any missing information. For local file systems, two commonly used aliases exist for the system:running-config and nvram:startup-config files; these aliases are running-config and startup-config, respectively. Timesaver Aliases are used to reduce the amount of typing you need to perform. For example, it is easier to type copy run start (the abbreviated form of the copy running-config startup-config command) than it is to type copy system:r nvram:s (the abbreviated form of the copy system:running-config nvram:startup-config command). These aliases also allow you to continue using some of the common commands used in previous versions of Cisco IOS software. Release Modification 11.3T This command was introduced. 12.3(2)T • The http:// and https:// keywords were added as supported remote source locations (file system URL prefixes) for files. • This command was enhanced to support copying files to servers that support SSH and the scp. 12.2(14)S This command was integrated into Cisco IOS Release 12.2(14)S. 12.2(18)S The /verify and /noverify keywords were added. 12.0(26)S The /verify and /noverify keywords were integrated into Cisco IOS Release 12.0(26)S. 12.3(4)T The /verify and /noverify keywords were integrated into Cisco IOS Release 12.3(4)T. 12.3(7)T The http:// and https:// keywords were enhanced to support file uploads. 12.3(14)T The usbflash[0-9]: and usbtoken[0-9]: keywords were added to support USB storage. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(25)SG This command was integrated into Cisco IOS Release 12.2(25)SG. 12.4(11)T This command was integrated into the Cisco 7200VXR NPE-G2 platform. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. Cisco IOS XE Release 2.1 The Cisco ASR1000 series routers became available, and introduced the copy command in diagnostic mode. copy CF-116 Cisco IOS Configuration Fundamentals Command Reference April 2010 The entire copying process may take several minutes and differs from protocol to protocol and from network to network. The colon is required after the file system URL prefix keywords (such as flash). In some cases, file system prefixes that did not require colons in earlier software releases are allowed for backwards compatibility, but use of the colon is recommended. In the URL syntax for ftp:, http:, https:, rcp:, scp: and tftp:, the location is either an IP address or a host name. The filename is specified relative to the directory used for file transfers. The following sections contain usage guidelines for the following topics: • Understanding Invalid Combinations of Source and Destination, page 116 • Understanding Character Descriptions, page 116 • Understanding Partitions, page 117 • Using rcp, page 117 • Using FTP, page 118 • Using HTTP or HTTPS, page 118 • Storing Images on Servers, page 119 • Copying from a Server to Flash Memory, page 119 • Verifying Images, page 119 • Copying a Configuration File from a Server to the Running Configuration, page 120 • Copying a Configuration File from a Server to the Startup Configuration, page 120 • Storing the Running or Startup Configuration on a Server, page 120 • Saving the Running Configuration to the Startup Configuration, page 120 • Using CONFIG_FILE, BOOT, and BOOTLDR Environment Variables, page 121 • Using the Copy Command with the Dual RSP Feature, page 121 • Using the copy command with the ASR1000 Series Routers, page 121 Understanding Invalid Combinations of Source and Destination Some invalid combinations of source and destination exist. Specifically, you cannot copy: • From a running configuration to a running configuration • From a startup configuration to a startup configuration • From a device to the same device (for example, the copy flash: flash: command is invalid) Understanding Character Descriptions Table 22 describes the characters that you may see during processing of the copy command. copy CF-117 Cisco IOS Configuration Fundamentals Command Reference April 2010 Understanding Partitions You cannot copy an image or configuration file to a flash partition from which you are currently running. For example, if partition 1 is running the current system image, copy the configuration file or image to partition 2. Otherwise, the copy operation will fail. You can identify the available flash partitions by entering the show file system EXEC command. Using rcp The rcp requires a client to send a remote username upon each rcp request to a server. When you copy a configuration file or image between the router and a server using rcp, the Cisco IOS software sends the first valid username it encounters in the following sequence: 1. The remote username specified in the copy command, if a username is specified. 2. The username set by the ip rcmd remote-username global configuration command, if the command is configured. 3. The remote username associated with the current tty (terminal) process. For example, if the user is connected to the router through Telnet and was authenticated through the username command, the router software sends the Telnet username as the remote username. 4. The router host name. For the rcp copy request to process, an account must be defined on the network server for the remote username. If the network administrator of the destination server did not establish an account for the remote username, this command will not run. If the server has a directory structure, the configuration file or image is written to or copied from the directory associated with the remote username on the server. For example, if the system image resides in the home directory of a user on the server, specify that username as the remote username. If you are writing to the server, the rcp server must be properly configured to accept the rcp write request from the user on the router. For UNIX systems, add an entry to the .rhosts file for the remote user on the rcp server. Suppose the router contains the following configuration lines: hostname Rtr1 ip rcmd remote-username User0 Table 22 copy Character Descriptions Character Description ! For network transfers, an exclamation point indicates that the copy process is taking place. Each exclamation point indicates the successful transfer of ten packets (512 bytes each). . For network transfers, a period indicates that the copy process timed out. Many periods in a row typically mean that the copy process may fail. O For network transfers, an uppercase O indicates that a packet was received out of order and the copy process may fail. e For flash erasures, a lowercase e indicates that a device is being erased. E An uppercase E indicates an error. The copy process may fail. V A series of uppercase Vs indicates the progress during the verification of the image checksum. copy CF-118 Cisco IOS Configuration Fundamentals Command Reference April 2010 If the router IP address translates to Router1.company.com, then the .rhosts file for User0 on the rcp server should contain the following line: Router1.company.com Rtr1 Refer to the documentation for your rcp server for more details. If you are using a personal computer as a file server, the computer must support the remote shell protocol (rsh). Using FTP The FTP protocol requires a client to send a username and password with each FTP request to a remote FTP server. Use the ip ftp username and ip ftp password global configuration commands to specify a default username and password for all copy operations to or from an FTP server. Include the username in the copy command syntax if you want to specify a username for that copy operation only. When you copy a file from the router to a server using FTP, the Cisco IOS software sends the first valid username that it encounters in the following sequence: 1. The username specified in the copy command, if a username is specified. 2. The username set by the ip ftp username command, if the command is configured. 3. Anonymous. The router sends the first valid password in the following list: 1. The password specified in the copy command, if a password is specified. 2. The password set by the ip ftp password command, if the command is configured. 3. The router forms a password username@routername.domain. The variable username is the username associated with the current session, routername is the configured host name, and domain is the domain of the router. The username and password must be associated with an account on the FTP server. If you are writing to the server, the FTP server must be properly configured to accept the FTP write request from the user on the router. If the server has a directory structure, the configuration file or image is written to or copied from the directory associated with the username on the server. For example, if the system image resides in the home directory of a user on the server, specify that username as the remote username. Refer to the documentation for your FTP server for details on setting up the server. Using HTTP or HTTPS Copying a file to or from a remote HTTP or HTTPS server, to or from a local file system, is performed using the embedded Secure HTTP client that is integrated in Cisco IOS software. The HTTP client is enabled by default. Downloading files from a remote HTTP or HTTPS server is performed using the HTTP client integrated in Cisco IOS software. If a username and password are not specified in the copy command syntax, the system uses the default HTTP client username and password, if configured. When you copy a file from a remote HTTP or HTTPS server, the Cisco IOS software sends the first valid username that it encounters in the following sequence: 1. The username specified in the copy command, if a username is specified. 2. The username set by the ip http client username command, if the command is configured. 3. Anonymous. copy CF-119 Cisco IOS Configuration Fundamentals Command Reference April 2010 The router sends the first valid password in the following list: 1. The password specified in the copy command, if a password is specified. 2. The password set by the ip http client password command, if the command is configured. 3. The router forms the password username@routername.domain. The variable username is the username associated with the current session, routername is the configured host name, and domain is the domain of the router. Storing Images on Servers Use the copy flash: destination-url command (for example, copy flash: tftp:) to copy a system image or boot image from flash memory to a network server. You can use the copy of the image as a backup copy. Also, you can also use the image backup file to verify that the image in flash memory is the same as that in the original file. Copying from a Server to Flash Memory Use the copy destination-url flash: command (for example, copy tftp: flash:) to copy an image from a server to flash memory. On Class B file system platforms, the system provides an option to erase existing flash memory before writing onto it. Note Verify the image in flash memory before booting the image. Verifying Images When copying a new image to your router, you should confirm that the image was not corrupted during the copy process. You can verify the integrity of the image in any of the following ways: • Depending on the destination file system type, a checksum for the image file may be displayed when the copy command completes. You can verify this checksum by comparing it to the checksum value provided for your image file on Cisco.com. Caution If the checksum values do not match, do not reboot the router. Instead, reissue the copy command and compare the checksums again. If the checksum is repeatedly wrong, copy the original image back into flash memory before you reboot the router from flash memory. If you have a corrupted image in flash memory and try to boot from flash memory, the router will start the system image contained in ROM (assuming booting from a network server is not configured). If ROM does not contain a fully functional system image, the router might not function and will need to be reconfigured through a direct console port connection. • Use the /verify keyword. • Enable automatic image verification by default by issuing the file verify auto command. This command will automatically check the integrity of each file that is copied via the copy command (without specifying the /verify option) to the router unless the /noverify keyword is specified. • Use the UNIX 'diff' command. This method can also be applied to file types other than Cisco IOS images. If you suspect that a file is corrupted, copy the suspect file and the original file to a UNIX server. (The file names may need to be modified if you try to save the files in the same directory.) Then run the UNIX 'diff' command on the two files. If there is no difference, then the file has not been corrupted. copy CF-120 Cisco IOS Configuration Fundamentals Command Reference April 2010 Copying a Configuration File from a Server to the Running Configuration Use the copy {ftp: | rcp: | scp: | tftp:} running-config command to load a configuration file from a network server to the running configuration of the router. (Note that running-config is the alias for the system:running-config keyword.) The configuration will be added to the running configuration as if the commands were typed in the command-line interface (CLI). Thus, the resulting configuration file will be a combination of the previous running configuration and the loaded configuration file, with the loaded configuration file having precedence. You can copy either a host configuration file or a network configuration file. Accept the default value of host to copy and load a host configuration file containing commands that apply to one network server in particular. Enter network to copy and load a network configuration file containing commands that apply to all network servers on a network. Copying a Configuration File from a Server to the Startup Configuration Use the copy {ftp: | rcp: | scp: | tftp:} nvram:startup-config command to copy a configuration file from a network server to the router startup configuration. These commands replace the startup configuration file with the copied configuration file. Storing the Running or Startup Configuration on a Server Use the copy system:running-config {ftp: | rcp: | scp: | tftp:} command to copy the current configuration file to a network server using FTP, rcp, scp, or TFTP. Use the copy nvram:startup-config {ftp: | rcp: | scp: | tftp:} command to copy the startup configuration file to a network server. The configuration file copy can serve as a backup copy. Saving the Running Configuration to the Startup Configuration Use the copy system:running-config nvram:startup-config command to copy the running configuration to the startup configuration. Note Some specific commands might not get saved to NVRAM. You will need to enter these commands again if you reboot the machine. These commands are noted in the documentation. We recommend that you keep a listing of these settings so you can quickly reconfigure your router after rebooting. If you issue the copy system:running-config nvram:startup-config command from a bootstrap system image, a warning will instruct you to indicate whether you want your previous NVRAM configuration to be overwritten and configuration commands to be lost. This warning does not appear if NVRAM contains an invalid configuration or if the previous configuration in NVRAM was generated by a bootstrap system image. On all platforms except Class A file system platforms, the copy system:running-config nvram:startup-config command copies the currently running configuration to NVRAM. On the Class A flash file system platforms, the copy system:running-config nvram:startup-config command copies the currently running configuration to the location specified by the CONFIG_FILE environment variable. This variable specifies the device and configuration file used for initialization. When the CONFIG_FILE environment variable points to NVRAM or when this variable does not exist (such as at first-time startup), the software writes the current configuration to NVRAM. If the current configuration is too large for NVRAM, the software displays a message and stops executing the command. copy CF-121 Cisco IOS Configuration Fundamentals Command Reference April 2010 When the CONFIG_FILE environment variable specifies a valid device other than nvram: (that is, flash:, bootflash:, slot0:, or slot1:), the software writes the current configuration to the specified device and filename, and stores a distilled version of the configuration in NVRAM. A distilled version is one that does not contain access list information. If NVRAM already contains a copy of a complete configuration, the router prompts you to confirm the copy. Using CONFIG_FILE, BOOT, and BOOTLDR Environment Variables For the Class A flash file system platforms, specifications are as follows: • The CONFIG_FILE environment variable specifies the configuration file used during router initialization. • The BOOT environment variable specifies a list of bootable images on various devices. • The BOOTLDR environment variable specifies the flash device and filename containing the rxboot image that ROM uses for booting. • Cisco 3600 routers do not use a dedicated boot helper image (rxboot), which many other routers use to help with the boot process. Instead, the BOOTLDR ROM monitor environment variable identifies the flash memory device and filename that are used as the boot helper; the default is the first system image in flash memory. To view the contents of environment variables, use the show bootvar EXEC command. To modify the CONFIG_FILE environment variable, use the boot config global configuration command. To modify the BOOTLDR environment variable, use the boot bootldr global configuration command. To modify the BOOT environment variable, use the boot system global configuration command. To save your modifications, use the copy system:running-config nvram:startup-config command. When the destination of a copy command is specified by the CONFIG_FILE or BOOTLDR environment variable, the router prompts you for confirmation before proceeding with the copy. When the destination is the only valid image in the BOOT environment variable, the router also prompts you for confirmation before proceeding with the copy. Using the Copy Command with the Dual RSP Feature The Dual RSP feature allows you to install two Route Switch Processor (RSP) cards in a single router on the Cisco 7507 and Cisco 7513 platforms. On a Cisco 7507 or Cisco 7513 router configured for Dual RSPs, if you copy a file to nvram:startup-configuration with automatic synchronization disabled, the system prompts whether you also want to copy the file to the slave startup configuration. The default answer is yes. If automatic synchronization is enabled, the system automatically copies the file to the slave startup configuration each time you use a copy command with nvram:startup-configuration as the destination. Using the copy command with the ASR1000 Series Routers The copy command is available in both privileged EXEC and diagnostic mode on the Cisco ASR1000 series routers. Because the copy command is available in diagnostic mode, it can be used to copy all types of files between directories and remote locations even in the event of an IOS failure. Examples The following examples illustrate uses of the copy command: • Verifying the Integrity of the Image Before It Is Copied Example, page 122 • Copying an Image from a Server to Flash Memory Examples, page 122 • Saving a Copy of an Image on a Server Examples, page 124 • Copying a Configuration File from a Server to the Running Configuration Example, page 126 copy CF-122 Cisco IOS Configuration Fundamentals Command Reference April 2010 • Copying a Configuration File from a Server to the Startup Configuration Example, page 126 • Copying the Running Configuration to a Server Example, page 126 • Copying the Startup Configuration to a Server Example, page 127 • Saving the Current Running Configuration Example, page 127 • Moving Configuration Files to Other Locations Examples, page 127 • Copying a File from a Remote Web Server Examples, page 129 • Copying an Image from the Master RSP Card to the Slave RSP Card Example, page 129 Verifying the Integrity of the Image Before It Is Copied Example The following example shows how to specify image verification before copying an image: Router# copy /verify tftp://10.1.1.1/cisco/c7200-js-mz disk0: Destination filename [c7200-js-mz]? Accessing tftp://10.1.1.1/cisco/c7200-js-mz... Loading cisco/c7200-js-mz from 10.1.1.1 (via FastEthernet0/0):!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [OK - 19879944 bytes] 19879944 bytes copied in 108.632 secs (183003 bytes/sec) Verifying file integrity of disk0:/c7200-js-mz ......................................................................................... .......................................................................................... .......................................................................................... ......................Done! Embedded Hash MD5 :CFA258948C4ECE52085DCF428A426DCD Computed Hash MD5 :CFA258948C4ECE52085DCF428A426DCD CCO Hash MD5 :44A7B9BDDD9638128C35528466318183 Signature Verified Copying an Image from a Server to Flash Memory Examples The following examples use a copy rcp:, copy tftp:, or copy ftp: command to copy an image file from a server to flash memory: • Copying an Image from a Server to Flash Memory Example, page 122 • Copying an Image from a Server to a Flash Memory Using Flash Load Helper Example, page 123 • Copying an Image from a Server to a Flash Memory Card Partition Example, page 123 Copying an Image from a Server to Flash Memory Example The following example copies a system image named file1 from the remote rcp server with an IP address of 172.16.101.101 to flash memory. On Class B file system platforms, the Cisco IOS software allows you to first erase the contents of flash memory to ensure that enough flash memory is available to accommodate the system image. Router# copy rcp://netadmin@172.16.101.101/file1 flash:file1 Destination file name [file1]? Accessing file 'file1' on 172.16.101.101... Loading file1 from 172.16.101.101 (via Ethernet0): ! [OK] Erase flash device before writing? [confirm] Flash contains files. Are you sure you want to erase? [confirm] copy CF-123 Cisco IOS Configuration Fundamentals Command Reference April 2010 Copy 'file1' from server as 'file1' into Flash WITH erase? [yes/no] yes Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee...erased Loading file1 from 172.16.101.101 (via Ethernet0): ! [OK - 984/8388608 bytes] Verifying checksum... OK (0x14B3) Flash copy took 0:00:01 [hh:mm:ss] Copying an Image from a Server to a Flash Memory Using Flash Load Helper Example The following example copies a system image into a partition of flash memory. The system will prompt for a partition number only if there are two or more read/write partitions or one read-only and one read/write partition and dual flash bank support in boot ROMs. If the partition entered is not valid, the process terminates. You can enter a partition number, a question mark (?) for a directory display of all partitions, or a question mark and a number (?number) for directory display of a particular partition. The default is the first read/write partition. In this case, the partition is read-only and has dual flash bank support in boot ROM, so the system uses flash Load Helper. Router# copy tftp: flash: System flash partition information: Partition Size Used Free Bank-Size State Copy-Mode 1 4096K 2048K 2048K 2048K Read Only RXBOOT-FLH 2 4096K 2048K 2048K 2048K Read/Write Direct [Type ? for partition directory; ? for full directory; q to abort] Which partition? [default = 2] **** NOTICE **** Flash load helper v1.0 This process will accept the copy options and then terminate the current system image to use the ROM based image for the copy. Routing functionality will not be available during that time. If you are logged in via telnet, this connection will terminate. Users with console access can see the results of the copy operation. ---- ******** ---- Proceed? [confirm] System flash directory, partition 1: File Length Name/status 1 3459720 master/igs-bfpx.100-4.3 [3459784 bytes used, 734520 available, 4194304 total] Address or name of remote host [255.255.255.255]? 172.16.1.1 Source file name? master/igs-bfpx-100.4.3 Destination file name [default = source name]? Loading master/igs-bfpx.100-4.3 from 172.16.1.111: ! Erase flash device before writing? [confirm] Flash contains files. Are you sure? [confirm] Copy 'master/igs-bfpx.100-4.3' from TFTP server as 'master/igs-bfpx.100-4.3' into Flash WITH erase? [yes/no] yes Copying an Image from a Server to a Flash Memory Card Partition Example The following example copies the file c3600-i-mz from the rcp server at IP address 172.23.1.129 to the flash memory card in slot 0 of a Cisco 3600 series router, which has only one partition. As the operation progresses, the Cisco IOS software prompts you to erase the files on the flash memory PC card to accommodate the incoming file. This entire operation takes 18 seconds to perform, as indicated at the end of the example. Router# copy rcp: slot0: PCMCIA Slot0 flash copy CF-124 Cisco IOS Configuration Fundamentals Command Reference April 2010 Partition Size Used Free Bank-Size State Copy Mode 1 4096K 3068K 1027K 4096K Read/Write Direct 2 4096K 1671K 2424K 4096K Read/Write Direct 3 4096K 0K 4095K 4096K Read/Write Direct 4 4096K 3825K 270K 4096K Read/Write Direct [Type ? for partition directory; ? for full directory; q to abort] Which partition? [default = 1] PCMCIA Slot0 flash directory, partition 1: File Length Name/status 1 3142288 c3600-j-mz.test [3142352 bytes used, 1051952 available, 4194304 total] Address or name of remote host [172.23.1.129]? Source file name? /tftpboot/images/c3600-i-mz Destination file name [/tftpboot/images/c3600-i-mz]? Accessing file '/tftpboot/images/c3600-i-mz' on 172.23.1.129... Connected to 172.23.1.129 Loading 1711088 byte file c3600-i-mz: ! [OK] Erase flash device before writing? [confirm] Flash contains files. Are you sure you want to erase? [confirm] Copy '/tftpboot/images/c3600-i-mz' from server as '/tftpboot/images/c3600-i-mz' into Flash WITH erase? [yes/no] yes Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee ...erased Connected to 172.23.1.129 Loading 1711088 byte file c3600-i-mz: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Verifying checksum... OK (0xF89A) Flash device copy took 00:00:18 [hh:mm:ss] Saving a Copy of an Image on a Server Examples The following examples use copy commands to copy image files to a server for storage: • Copy an Image from Flash Memory to an rcp Server Example, page 124 • Copy an Image from Flash Memory to an SSH Server Using scp Example, page 125 • Copy an Image from a Partition of Flash Memory to a Server Example, page 125 • Copying an Image from a Flash Memory File System to an FTP Server Example, page 125 • Copying an Image from Boot Flash Memory to a TFTP Server Example, page 126 Copy an Image from Flash Memory to an rcp Server Example The following example copies a system image from flash Memory to an rcp server using the default remote username. Because the rcp server address and filename are not included in the command, the router prompts for it. Router# copy flash: rcp: IP address of remote host [255.255.255.255]? 172.16.13.110 Name of file to copy? gsxx writing gsxx - copy complete copy CF-125 Cisco IOS Configuration Fundamentals Command Reference April 2010 Copy an Image from Flash Memory to an SSH Server Using scp Example The following example shows how to use scp to copy a system image from flash memory to a server that supports SSH: Router# copy flash:c4500-ik2s-mz.scp scp://user1@host1/ Address or name of remote host [host1]? Destination username [user1]? Destination filename [c4500-ik2s-mz.scp]? Writing c4500-ik2s-mz.scp Password: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Before you can use the server-side functionality, SSH, authentication, and authorization must be properly configured so the router can determine whether a user is at the right privilege level. The scp server-side functionality is configured with the ip scp server enable command. Copy an Image from a Partition of Flash Memory to a Server Example The following example copies an image from a particular partition of flash memory to an rcp server using a remote username of netadmin1. The system will prompt if there are two or more partitions. If the partition entered is not valid, the process terminates. You have the option to enter a partition number, a question mark (?) for a directory display of all partitions, or a question mark and a number (?number) for a directory display of a particular partition. The default is the first partition. Router# configure terminal Router# ip rcmd remote-username netadmin1 Router# end Router# copy flash: rcp: System flash partition information: Partition Size Used Free Bank-Size State Copy-Mode 1 4096K 2048K 2048K 2048K Read Only RXBOOT-FLH 2 4096K 2048K 2048K 2048K Read/Write Direct [Type ? for partition directory; ? for full directory; q to abort] Which partition? [1] 2 System flash directory, partition 2: File Length Name/status 1 3459720 master/igs-bfpx.100-4.3 [3459784 bytes used, 734520 available, 4194304 total] Address or name of remote host [ABC.CISCO.COM]? Source file name? master/igs-bfpx.100-4.3 Destination file name [master/igs-bfpx.100-4.3]? Verifying checksum for 'master/igs-bfpx.100-4.3' (file # 1)... OK Copy 'master/igs-bfpx.100-4.3' from Flash to server as 'master/igs-bfpx.100-4.3'? [yes/no] yes !!!!... Upload to server done Flash copy took 0:00:00 [hh:mm:ss] Copying an Image from a Flash Memory File System to an FTP Server Example The following example copies the file c3600-i-mz from partition 1 of the flash memory card in slot 0 to an FTP server at IP address 172.23.1.129: Router# show slot0: partition 1 PCMCIA Slot0 flash directory, partition 1: File Length Name/status 1 1711088 c3600-i-mz [1711152 bytes used, 2483152 available, 4194304 total] copy CF-126 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router# copy slot0:1:c3600-i-mz ftp://myuser:mypass@172.23.1.129/c3600-i-mz Verifying checksum for '/tftpboot/cisco_rules/c3600-i-mz' (file # 1)... OK Copy '/tftpboot/cisco_rules/c3600-i-mz' from Flash to server as 'c3700-i-mz'? [yes/no] yes !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Upload to server done Flash device copy took 00:00:23 [hh:mm:ss] Copying an Image from Boot Flash Memory to a TFTP Server Example The following example copies an image from boot flash memory to a TFTP server: Router# copy bootflash:file1 tftp://192.168.117.23/file1 Verifying checksum for 'file1' (file # 1)... OK Copy 'file1' from Flash to server as 'file1'? [yes/no]y !!!!... Upload to server done Flash copy took 0:00:00 [hh:mm:ss] Copying a Configuration File from a Server to the Running Configuration Example The following example copies and runs a configuration filename host1-confg from the netadmin1 directory on the remote server with an IP address of 172.16.101.101: Router# copy rcp://netadmin1@172.16.101.101/host1-confg system:running-config Configure using host1-confg from 172.16.101.101? [confirm] Connected to 172.16.101.101 Loading 1112 byte file host1-confg:![OK] Router# %SYS-5-CONFIG: Configured from host1-config by rcp from 172.16.101.101 Copying a Configuration File from a Server to the Startup Configuration Example The following example copies a configuration file host2-confg from a remote FTP server to the startup configuration. The IP address is172.16.101.101, the remote username is netadmin1, and the remote password is ftppass. Router# copy ftp://netadmin1:ftppass@172.16.101.101/host2-confg nvram:startup-config Configure using rtr2-confg from 172.16.101.101?[confirm] Connected to 172.16.101.101 Loading 1112 byte file rtr2-confg:![OK] [OK] Router# %SYS-5-CONFIG_NV:Non-volatile store configured from rtr2-config by FTP from 172.16.101.101 Copying the Running Configuration to a Server Example The following example specifies a remote username of netadmin1. Then it copies the running configuration file named rtr2-confg to the netadmin1 directory on the remote host with an IP address of 172.16.101.101. Router# configure terminal Router(config)# ip rcmd remote-username netadmin1 Router(config)# end Router# copy system:running-config rcp: copy CF-127 Cisco IOS Configuration Fundamentals Command Reference April 2010 Remote host[]? 172.16.101.101 Name of configuration file to write [Rtr2-confg]? Write file rtr2-confg on host 172.16.101.101?[confirm] Building configuration...[OK] Connected to 172.16.101.101 Copying the Startup Configuration to a Server Example The following example copies the startup configuration to a TFTP server: Router# copy nvram:startup-config tftp: Remote host[]? 172.16.101.101 Name of configuration file to write [rtr2-confg]? Write file rtr2-confg on host 172.16.101.101?[confirm] ![OK] Saving the Current Running Configuration Example The following example copies the running configuration to the startup configuration. On a Class A flash file system platform, this command copies the running configuration to the startup configuration specified by the CONFIG_FILE variable. copy system:running-config nvram:startup-config The following example shows the warning that the system provides if you try to save configuration information from bootstrap into the system: Router(boot)# copy system:running-config nvram:startup-config Warning: Attempting to overwrite an NVRAM configuration written by a full system image. This bootstrap software does not support the full configuration command set. If you perform this command now, some configuration commands may be lost. Overwrite the previous NVRAM configuration?[confirm] Enter no to escape writing the configuration information to memory. Moving Configuration Files to Other Locations Examples On some routers, you can store copies of configuration files on a flash memory device. Five examples follow: • Copying the Startup Configuration to a Flash Memory Device Example, page 127 • Copying the Running Configuration to a Flash Memory Device Example, page 127 • Copying to the Running Configuration from a Flash Memory Device Example, page 128 • Copying to the Startup Configuration from a Flash Memory Device Example, page 128 • Copying a Configuration File from one Flash Device to Another Example, page 128 Copying the Startup Configuration to a Flash Memory Device Example The following example copies the startup configuration file (specified by the CONFIG_FILE environment variable) to a flash memory card inserted in slot 0: Router# copy nvram:startup-config slot0:router-confg Copying the Running Configuration to a Flash Memory Device Example The following example copies the running configuration from the router to the flash memory PC card in slot 0: copy CF-128 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router# copy system:running-config slot0:berlin-cfg Building configuration... 5267 bytes copied in 0.720 secs Copying to the Running Configuration from a Flash Memory Device Example The following example copies the file named ios-upgrade-1 from the flash memory card in slot 0 to the running configuration: Router# copy slot0:4:ios-upgrade-1 system:running-config Copy 'ios-upgrade-1' from flash device as 'running-config' ? [yes/no] yes Copying to the Startup Configuration from a Flash Memory Device Example The following example copies the router-image file from the flash memory to the startup configuration: Router# copy flash:router-image nvram:startup-config Copying a Configuration File from one Flash Device to Another Example The following example copies the file running-config from the first partition in internal flash memory to the flash memory PC card in slot 1. The checksum of the file is verified, and its copying time of 30 seconds is displayed. Router# copy flash: slot1: System flash Partition Size Used Free Bank-Size State Copy Mode 1 4096K 3070K 1025K 4096K Read/Write Direct 2 16384K 1671K 14712K 8192K Read/Write Direct [Type ? for partition directory; ? for full directory; q to abort] Which partition? [default = 1] System flash directory, partition 1: File Length Name/status 1 3142748 dirt/images/mars-test/c3600-j-mz.latest 2 850 running-config [3143728 bytes used, 1050576 available, 4194304 total] PCMCIA Slot1 flash directory: File Length Name/status 1 1711088 dirt/images/c3600-i-mz 2 850 running-config [1712068 bytes used, 2482236 available, 4194304 total] Source file name? running-config Destination file name [running-config]? Verifying checksum for 'running-config' (file # 2)... OK Erase flash device before writing? [confirm] Flash contains files. Are you sure you want to erase? [confirm] Copy 'running-config' from flash: device as 'running-config' into slot1: device WITH erase? [yes/no] yes Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee ...erased ! [OK - 850/4194304 bytes] Flash device copy took 00:00:30 [hh:mm:ss] Verifying checksum... OK (0x16) copy CF-129 Cisco IOS Configuration Fundamentals Command Reference April 2010 Copying a File from a Remote Web Server Examples In the following example, the file config1 is copied from a remote server to flash memory using HTTP: Router# copy http://www.example.com:8080/configs/config1 flash:config1 In the following example, a default username and password for HTTP Client communications is configured, and then the file sample.scr is copied from a secure HTTP server using HTTPS: Router# configure terminal Router(config)# ip http client username joeuser Router(config)# ip http client password letmein Router(config)# end Router# copy https://www.example_secure.com/scripts/sample.scr flash: In the following example, an HTTP proxy server is specified before using the copy http:// command: Router# configure terminal Router(config)# ip http client proxy-server edge2 proxy-port 29 Router(config)# end Router# copy http://www.example.com/configs/config3 flash:/configs/config3 Copying an Image from the Master RSP Card to the Slave RSP Card Example The following example copies the router-image file from the flash memory card inserted in slot 1 of the master RSP card to slot 0 of the slave RSP card in the same router: Router# copy slot1:router-image slaveslot0: Related Commands Command Description boot config Specifies the device and filename of the configuration file from which the router configures itself during initialization (startup). boot system Specifies the system image that the router loads at startup. cd Changes the default directory or file system. copy xmodem: flash: Copies any file from a source to a destination. copy ymodem: flash: Copies any file from a source to a destination. delete Deletes a file on a flash memory device. dir Displays a list of files on a file system. erase Erases a file system. ip rcmd remote-username Configures the remote username to be used when requesting a remote copy using rcp. ip scp server enable Enables scp server-side functionality. reload Reloads the operating system. show bootvar Displays the contents of the BOOT environment variable, the name of the configuration file pointed to by the CONFIG_FILE environment variable, the contents of the BOOTLDR environment variable, and the configuration register setting. show (flash file system) Displays the layout and contents of a flash memory file system. slave auto-sync config Turns on automatic synchronization of configuration files for a Cisco 7507 or Cisco 7513 router that is configured for Dual RSP Backup. verify bootflash: File system or directory containing the files to list, followed by a colon. copy erase flash CF-130 Cisco IOS Configuration Fundamentals Command Reference April 2010 copy erase flash The copy erase flash command has been replaced by the erase flash: command. See the description of the erase command for more information. On some platforms, use can use the copy /erase source-url flash: syntax to erase the local Flash file system before copying a new file into Flash. See the desciption of the copy command for details on this option. copy http:// CF-131 Cisco IOS Configuration Fundamentals Command Reference April 2010 copy http:// The copy http:// command is documented as part of the copy command. copy https:// CF-132 Cisco IOS Configuration Fundamentals Command Reference April 2010 copy https:// The copy https:// command is documented as part of the copy command. copy logging system CF-133 Cisco IOS Configuration Fundamentals Command Reference April 2010 copy logging system To copy archived system events to a destination file system, use the copy logging system command in privileged EXEC mode. To stop copying the archived system events, use the no form of the command. copy logging system target: filename no copy logging system Syntax Description Command Default This command has no default settings. Command Modes Privileged EXEC (#) Command History target: Specifies the destination file system; Valid values are as follows: • bootflash: • disk0: • disk1: • ftp: • http: • https: • rcp: • slavebootflash: • slavedisk0: • slavedisk1: • slavesup-bootdisk: • slavesup-bootflash: • sup-bootdisk: • sup-bootflash: • tftp: filename Name of the file. Release Modification 12.2(33)SXH This command was introduced. 12.2(33)SCC The command was introduced for the Cisco uBR10012 router in the Cisco IOS Software Release 12.2(33)SCC. copy logging system CF-134 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines Cisco Universal Broadband Router 10012 The System Event Archive (SEA) feature is used to address the debug trace and system console constraints. Use the copy logging system command to copy the major and critical events stored in the sea_log.dat file, to the destination file system. Note To store the system event logs, the SEA requires either the PCMCIA ATA disk or Compact Flash Disk in compact flash adapter for PRE2. The following example shows how to copy the SEA to the file system of disk0: Router# copy logging system disk0: Destination filename [sea_log.dat]? The following example shows how to copy the SEA using the remote file copy function (rcp): Router# copy logging system rcp: Address or name of remote host []? 192.0.2.1 Destination username [Router]? username1 Destination filename [sea_log.dat]? /auto/tftpboot-users/username1/sea_log.dat Related Commands clear logging system Clears the event records stored in the SEA. logging system Enables or disables SEA logging system. show logging system Displays the SEA logging system disk. copy xmodem: CF-135 Cisco IOS Configuration Fundamentals Command Reference April 2010 copy xmodem: To copy a Cisco IOS image from a local or remote computer (such as a PC, Macintosh, or UNIX workstation) to Flash memory on a Cisco 3600 series router using the Xmodem protocol, use the copy xmodem: command in EXEC mode. copy xmodem: flash-filesystem: Syntax Description Command Modes EXEC Command History Usage Guidelines This command is a form of the copy command. The copy xmodem: and copy xmodem commands are identical. See the description of the copy command for more information. Copying a file using FTP, rcp, or TFTP is much faster than copying a file using Xmodem. Use the copy xmodem: command only if you do not have access to an FTP, TFTP, or rcp server. This copy operation is performed through the console or AUX port. The AUX port, which supports hardware flow control, is recommended. No output is displayed on the port over which the transfer is occurring. You can use the logging buffered command to log all router messages sent to the console port during the file transfer. Examples The following example initiates a file transfer from a local or remote computer to the router’s internal Flash memory using the Xmodem protocol: copy xmodem: flash: Related Commands flash-filesystem: Destination of the copied file, followed by a colon. Release Modification 11.2 P This command was introduced. 12.2(15)T This command is no longer supported in Cisco IOS Mainline or Technology-based (T) releases. It may continue to appear in Cisco IOS 12.2S-family releases. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description copy Copies any file from a source to a destination. copy ymodem: Copies a Cisco IOS image from a local or remote computer (such as a PC, Macintosh, or UNIX workstation) to Flash memory on a Cisco 3600 series router using the Ymodem protocol. copy ymodem: CF-136 Cisco IOS Configuration Fundamentals Command Reference April 2010 copy ymodem: To copy a Cisco IOS image from a local or remote computer (such as a PC, Macintosh, or UNIX workstation) to Flash memory on a Cisco 3600 series router using the Ymodem protocol, use the copy ymodem: command in EXEC mode. copy ymodem: flash-filesystem: Syntax Description Command Modes EXEC Command History Usage Guidelines The copy ymodem: and copy ymodem commands are identical. See the description of the copy command for more information. Copying a file using FTP, rcp, or TFTP is much faster than copying a file using Ymodem. Use the copy ymodem: command only if you do not have access to an FTP, rcp, or TFTP server. This copy operation is performed through the console or AUX port. The AUX port, which supports hardware flow control, is recommended. No output is displayed on the port over which the transfer is occurring. You can use the logging buffered command to log all router messages sent to the console port during the file transfer. Examples The following example initiates a file transfer from a local or remote computer to the router’s internal Flash memory using the Ymodem protocol: copy ymodem: flash: Related Commands flash-filesystem: Destination of the copied file, followed by a colon. Release Modification 11.2 P This command was introduced. 12.2(15)T This command is no longer supported in Cisco IOS Mainline or Technology-based (T) releases. It may continue to appear in Cisco IOS 12.2S-family releases. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description copy xmodem: Copies a Cisco IOS image from a local or remote computer (such as a PC, Macintosh, or UNIX workstation) to Flash memory on a Cisco 3600 series router using the Xmodem protocol. copy /noverify CF-137 Cisco IOS Configuration Fundamentals Command Reference April 2010 copy /noverify To disable the automatic image verification for the current copy operation, use the copy /noverify command. copy /noverify source-url destination-url Syntax Description Defaults Verification is done automatically after completion of a copy operation. Command Modes Privileged EXEC Command History Usage Guidelines The exact format of the source and destination URLs varies according to the file or directory location. You may enter either an alias keyword for a particular file or an alias keyword for a file system type (not a file within a type). Timesaver Aliases are used to cut down on the amount of typing that you need to perform. For example, it is easier to type copy run start (the abbreviated form of the copy running-config startup-config command) than it is to type copy system:r nvram:s (the abbreviated form of the copy system:running-config nvram:startup-config command). These aliases allow you to continue using some of the common commands that are used in previous versions of Cisco IOS software. Table 23 shows two keyword shortcuts to URLs. source-url Location URL or alias of the source file or directory to be copied; see the “Usage Guidelines” section for additional information. destination-url Destination URL or alias of the copied file or directory; see the “Usage Guidelines” section for additional information. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. copy /noverify CF-138 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 24 through Table 26 list aliases by file system type. If you do not specify an alias, the system looks for a file in the current directory. Table 24 lists the URL prefix aliases for special (opaque) file systems, Table 25 lists the URL prefix aliases for network file systems, and Table 26 lists the URL prefix aliases for local writable storage file systems. Table 23 Common Keyword Aliases to URLs Keyword Source or Destination running-config (Optional) Specifies the alias for the system:running-config URL. This keyword does not work in the more and show file command syntaxes. startup-config (Optional) Specifies the alias for the nvram:startup-config URL. The nvram:startup-config keyword represents the configuration file that is used during initialization (startup). This file is contained in NVRAM. This keyword does not work in more and show file EXEC command syntaxes. Table 24 URL Prefix Aliases for Special File Systems Alias Source or Destination flh: Source URL for Flash load helper log files. nvram: Router NVRAM. You can copy the startup configuration into or from NVRAM. You can also display the size of a private configuration file. null: Null destination for copies or files. You can copy a remote file to null to determine its size. system: Source or destination URL for system memory, which includes the running configuration. xmodem: Source destination for the file from a network device that uses the Xmodem protocol. ymodem: Source destination for the file from a network device that uses the Ymodem protocol. Table 25 URL Prefix Aliases for Network File Systems Alias Source or Destination ftp: Source or destination URL for an FTP network server. The syntax for this alias is as follows: ftp:[[[//username [:password]@]location]/directory]/filename. rcp: Source or destination URL for an rcp network server. The syntax for this alias is as follows: rcp:[[[//username@]location]/directory]/filename. tftp: Source or destination URL for a TFTP network server. The syntax for this alias is tftp:[[//location]/directory]/filename. copy /noverify CF-139 Cisco IOS Configuration Fundamentals Command Reference April 2010 You can enter on the command line all necessary source- and destination-URL information and the username and password to use, or you can enter the copy command and have the switch prompt you for any missing information. If you enter information, choose one of the following three options: running-config, startup-config, or a file system alias (see Table 23 through Table 26). The location of a file system dictates the format of the source or destination URL. The colon is required after the alias. However, earlier commands that do not require a colon remain supported but are unavailable in context-sensitive help. The entire copying process may take several minutes and differs from protocol to protocol and from network to network. In the alias syntax for ftp:, rcp:, and tftp:, the location is either an IP address or a hostname. The filename is specified for the directory that is used for file transfers. Enter the file verify auto command to set up verification globally. Examples This example shows how to disable the automatic image verification for the current copy operation: Router# copy /noverify tftp: sup-bootflash: ................................................. Table 26 URL Prefix Aliases for Local Writable Storage File Systems Alias Source or Destination bootflash: Source or destination URL for boot flash memory. disk0: and disk1: Source or destination URL of rotating media. flash: Source or destination URL for Flash memory. This alias is available on all platforms. For platforms that lack a Flash: device, note that flash: is aliased to slot0:, allowing you to refer to the main Flash memory storage area on all platforms. slavebootflas h: Source or destination URL for internal Flash memory on the slave RSP card of a device that is configured for HSA. slaveram: NVRAM on a slave RSP card of a device that is configured for HSA. slavedisk0: Source or destination URL of the first PCMCIA card on a slave RSP card of a device that is configured for HSA. slavedisk1: Source or destination URL of the second PCMCIA slot on a slave RSP card of a device that is configured for HSA. slaveslot0: Source or destination URL of the first PCMCIA card on a slave RSP card of a router configured for HSA—Available on systems that are configured with a Supervisor Engine 2. slaveslot1: Source or destination URL of the second PCMCIA slot on a slave RSP card of a router configured for HSA—Available on systems that are configured with a Supervisor Engine 2. slot0: Source or destination URL of the first PCMCIA Flash memory card—Available on systems that are configured with a Supervisor Engine 2. slot1: Source or destination URL of the second PCMCIA Flash memory card—Available on systems that are configured with a Supervisor Engine 2. copy /noverify CF-140 Cisco IOS Configuration Fundamentals Command Reference April 2010 [OK - 24301348 bytes] 24301348 bytes copied in 157.328 secs (154463 bytes/sec) Router# Related Commands Command Description file verify auto Verifies the compressed Cisco IOS image checksum. verify Verifies the checksum of a file on a Flash memory file system or compute an MD5 signature for a file. databits CF-141 Cisco IOS Configuration Fundamentals Command Reference April 2010 databits To set the number of data bits per character that are interpreted and generated by the router hardware, use the databits command in line configuration mode. To restore the default value, use the no form of the command. databits {5 | 6 | 7 | 8} no databits Syntax Description Defaults Eight data bits per character Command Modes Line configuration Command History Usage Guidelines The databits line configuration command can be used to mask the high bit on input from devices that generate 7 data bits with parity. If parity is being generated, specify 7 data bits per character. If no parity generation is in effect, specify 8 data bits per character. The other keywords are supplied for compatibility with older devices and generally are not used. Examples The following example sets the number of data bits per character to seven on line 4: Router(config)# line 4 Router(config-line)# databits 7 Related Commands 5 Five data bits per character. 6 Six data bits per character. 7 Seven data bits per character. 8 Eight data bits per character. This is the default. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description data-character-bits Sets the number of data bits per character that are interpreted and generated by the Cisco IOS software. databits CF-142 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal databits Changes the number of data bits per character for the current terminal line for this session. terminal data-character-bits Sets the number of data bits per character that are interpreted and generated by the Cisco IOS software for the current line and session. Command Description data-character-bits CF-143 Cisco IOS Configuration Fundamentals Command Reference April 2010 data-character-bits To set the number of data bits per character that are interpreted and generated by the Cisco IOS software, use the data-character-bits command in line configuration mode. To restore the default value, use the no form of this command. data-character-bits {7 | 8} no data-character-bits Syntax Description Defaults Eight data bits per character Command Modes Line configuration Command History Usage Guidelines The data-character-bits line configuration command is used primarily to strip parity from X.25 connections on routers with the protocol translation software option. The data-character-bits line configuration command does not work on hard-wired lines. Examples The following example sets the number of data bits per character to seven on virtual terminal line (vty) 1: Router(config)# line vty 1 Router(config-line)# data-character-bits 7 Related Commands 7 Seven data bits per character. 8 Eight data bits per character. This is the default. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description terminal data-character-bits Sets the number of data bits per character that are interpreted and generated by the Cisco IOS software for the current line and session. default-value exec-character-bits CF-144 Cisco IOS Configuration Fundamentals Command Reference April 2010 default-value exec-character-bits To define the EXEC character width for either 7 bits or 8 bits, use the default-value exec-character-bits command in global configuration mode. To restore the default value, use the no form of this command. default-value exec-character-bits {7 | 8} no default-value exec-character-bits Syntax Description Defaults 7-bit ASCII character set Command Modes Global configuration Command History Usage Guidelines Configuring the EXEC character width to 8 bits allows you to add graphical and international characters in banners, prompts, and so on. However, setting the EXEC character width to 8 bits can also cause failures. If a user on a terminal that is sending parity enters the help command, an “unrecognized command” message appears because the system is reading all 8 bits, although the eighth bit is not needed for the help command. Examples The following example selects the full 8-bit ASCII character set for EXEC banners and prompts: Router(config)# default-value exec-character-bits 8 Related Commands 7 Selects the 7-bit ASCII character set. This is the default. 8 Selects the full 8-bit ASCII character set. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description default-value special-character-bits Configures the flow control default value from a 7-bit width to an 8-bit width. exec-character-bits Configures the character widths of EXEC and configuration command characters. length Sets the terminal screen length. terminal exec-character-bits Locally changes the ASCII character set used in EXEC and configuration command characters for the current session. terminal special-character-bits Changes the ASCII character widths to accept special characters for the current terminal line and session. default-value special-character-bits CF-145 Cisco IOS Configuration Fundamentals Command Reference April 2010 default-value special-character-bits To configure the flow control default value from a 7-bit width to an 8-bit width, use the default-value special-character-bits command in global configuration mode. To restore the default value, use the no form of this command. default-value special-character-bits {7 | 8} no default-value special-character-bits Syntax Description Defaults 7-bit character set Command Modes Global configuration Command History Usage Guidelines Configuring the special character width to 8 bits allows you to add graphical and international characters in banners, prompts, and so on. Examples The following example selects the full 8-bit special character set: Router(config)# default-value special-character-bits 8 Related Commands 7 Selects the 7-bit character set. This is the default. 8 Selects the full 8-bit character set. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description default-value exec-character-bits Defines the EXEC character width for either 7 bits or 8 bits. exec-character-bits Configures the character widths of EXEC and configuration command characters. length Sets the terminal screen length. terminal exec-character-bits Locally changes the ASCII character set used in EXEC and configuration command characters for the current session. terminal special-character-bits Changes the ASCII character widths to accept special characters for the current terminal line and session. define interface-range CF-146 Cisco IOS Configuration Fundamentals Command Reference April 2010 define interface-range To create an interface-range macro, use the define interface-range command in global configuration mode. define interface-range macro-name interface-range Syntax Description Defaults This command has no default settings. Command Modes Global configuration Command History Usage Guidelines The macro name is a 32-character maximum character string. Amn interface range for a macro can contain up to five ranges. An interface range cannot span slots. Use this format when entering the interface-range: • interface-type slot/first-interface - last-interface Valid values for card-type are as follows: • ethernet • fastethernet • gigabitethernet • loopback • tengigabitethernet • tunnel • vlan vlan-id (valid values are from 1 to 4094) • port-channel interface-number (valid values are from 1 to 256) • ge-wan—supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2 • pos—supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2 • atm—supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2 macro-name Name of the interface range macro; the macro name can contain up to 32 characters. interface-range Interface range. For a list of valid values for interface ranges, see the “Usage Guidelines” section. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. define interface-range CF-147 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples This example shows how to create a multiple-interface macro: Router(config)# define interface-range macro1 ethernet 1/2 - 5, fastethernet 5/5 - 10 Router(config)# Related Commands Command Description interface range Executes a command on multiple ports at the same time. delete CF-148 Cisco IOS Configuration Fundamentals Command Reference April 2010 delete To delete a file on a Flash memory device or NVRAM, use the delete command in EXEC, privileged EXEC, or diagnostic mode. delete url [/force | /recursive] Syntax Description Command Modes EXEC (>) Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines If you attempt to delete the configuration file or image specified by the CONFIG_FILE or BOOTLDR environment variable, the system prompts you to confirm the deletion. Also, if you attempt to delete the last valid system image specified in the BOOT environment variable, the system prompts you to confirm the deletion. When you delete a file in Flash memory, the software simply marks the file as deleted, but it does not erase the file. To later recover a “deleted” file in Flash memory, use the undelete EXEC command. You can delete and undelete a file up to 15 times. url Cisco IOS File System URL of the file to be deleted. Include the file system prefix, followed by a colon, and, optionally, the name of a file or directory. See Table 27 for list of supported URLs. /force (Optional) Deletes the specified file or directory without prompting you for verification. Note Use this keyword with caution: the system will not ask you to confirm the file deletion. /recursive (Optional) Deletes all files in the specified directory, as well as the directory itself. Release Modification 11.0 This command was introduced. 12.3(14)T The usbflash[0-9]: and usbtoken[0-9]: options were added to the list of Cisco IOS File System URLs. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Routers and the following enhancements were introduced: • This command was introduced in diagnostic mode for the first time. The command can be entered in both privileged EXEC and diagnostic mode on the Cisco ASR1000 Series Routers. • The harddisk:, obfl:, stby-bootflash:, stby-harddisk:, stby-nvram:, stby-obfl:, stby-usb[0-1]:, and usb[0-1]: url options were introduced. delete CF-149 Cisco IOS Configuration Fundamentals Command Reference April 2010 To permanently delete all files marked “deleted” on a linear Flash memory device, use the squeeze EXEC command. Table 27 contains a list of Cisco IOS File System URLs. Examples The following example deletes the file named test from the Flash card inserted in slot 0: Router# delete slot0:test Delete slot0:test? [confirm] Related Commands Table 27 URL File System Prefix Keywords Prefix Filesystem bootflash: Delete the file from boot Flash memory. flash: Delete the file from Flash memory. harddisk: Delete the file from the harddisk file system. nvram: Delete the from the router NVRAM. obfl: Delete the file from the onboard failure logging file system. slot0: Delete the file from the first PCMCIA Flash memory card. stby-bootflash: Delete the file from the standby bootflash file system. stby-harddisk: Delete the file from the standby harddisk file system. stby-nvram: Delete the from the router NVRAM on the standby hardware. stby-obfl: Delete the file from the onboard failure logging file system on the standby hardware. stby-usb[0-1]: Delete the file from the standby USB Flash drive. usb[0-1]; Delete the file from the USB Flash drive. usbflash[0-9]: Delete the file from the USB Flash drive. usbtoken[0-9]: Delete the file from the USB eToken. Command Description cd Changes the default directory or file system. dir Displays a list of files on a file system. show bootvar Displays the contents of the BOOT environment variable, the name of the configuration file pointed to by the CONFIG_FILE environment variable, the contents of the BOOTLDR environment variable, and the configuration register setting. squeeze Permanently deletes Flash files by squeezing a Class A Flash file system. undelete Recovers a file marked “deleted” on a Class A or Class B Flash file system. diag CF-150 Cisco IOS Configuration Fundamentals Command Reference April 2010 diag To perform field diagnostics on a line card, on the Gigabit Route Processor (GRP), on the Switch Fabric Cards (SFCs), and on the Clock Scheduler Card (CSC) in Cisco 12000 series Gigabit Switch Routers (GSRs), use the diag command in privileged EXEC mode. To disable field diagnostics on a line card, use the no form of this command. diag slot-number [halt | previous | post | verbose [wait] | wait] no diag slot-number Syntax Description Defaults No field diagnostics tests are performed on the line card. Command Modes Privileged EXEC Command History Usage Guidelines The diag command must be executed from the GRP main console port. Perform diagnostics on the CSC only if a redundant CSC is in the router. slot-number Slot number of the line card you want to test. Slot numbers range from 0 to 11 for the Cisco 12012 and 0 to 7 for the Cisco 12008 router. Slot numbers for the CSC are 16 and 17, and for the FSC are 18, 19, and 20. halt (Optional) Stops the field diagnostic testing on the line card. previous (Optional) Displays previous test results (if any) for the line card. post (Optional) Initiates an EPROM-based extended power-on self-test (EPOST) only. The EPOST test suite is not as comprehensive as the field diagnostics, and a pass/fail message is the only message displayed on the console. verbose [wait] (Optional) Enables the maximum status messages to be displayed on the console. By default, only the minimum status messages are displayed on the console. If you specify the optional wait keyword, the Cisco IOS software is not automatically reloaded on the line card after the test completes. wait (Optional) Stops the automatic reloading of the Cisco IOS software on the line card after the completion of the field diagnostic testing. If you use this keyword, you must use the microcode reload slot global configuration command, or manually remove and insert the line card (to power it up) in the slot so that the GRP will recognize the line card and download the Cisco IOS software image to the line card. Release Modification 11.2 GS This command was introduced to support the Cisco 12000 series GSR. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. diag CF-151 Cisco IOS Configuration Fundamentals Command Reference April 2010 Diagnostics will stop and ask you for confirmation before altering the router’s configuration. For example, running diagnostics on a SFC or CSC will cause the fabric to go from full bandwidth to one-fourth bandwidth. Bandwidth is not affected by GRP or line card diagnostics. The field diagnostic software image is bundled with the Cisco IOS software and is downloaded automatically from the GRP to the target line card prior to testing. Caution Performing field diagnostics on a line card stops all activity on the line card. Before the diag EXEC command begins running diagnostics, you are prompted to confirm the request to perform field diagnostics on the line card. In normal mode, if a test fails, the title of the failed test is displayed on the console. However, not all tests that are performed are displayed. To view all the tests that are performed, use the verbose keyword. After all diagnostic tests are completed on the line card, a PASSED or TEST FAILURE message is displayed. If the line card sends a PASSED message, the Cisco IOS software image on the line card is automatically reloaded unless the wait keyword is specified. If the line card sends a TEST FAILURE message, the Cisco IOS software image on the line card is not automatically reloaded. If you want to reload the line card after it fails diagnostic testing, use the microcode reload slot global configuration command. Note When you stop the field diagnostic test, the line card remains down (that is, in an unbooted state). In most cases, you stopped the testing because you need to remove the line card or replace the line card. If that is not the case, and you want to bring the line card back up (that is, online), you must use the microcode reload global configuration command or power cycle the line card. If the line card fails the test, the line card is defective and should be replaced. In future releases this might not be the case because DRAM and SDRAM SIMM modules might be field replaceable units. For example, if the DRAM test failed you might only need to replace the DRAM on the line card. For more information, refer to the Cisco 12000 series installation and configuration guides. Examples In the following example, a user is shown the output when field diagnostics are performed on the line card in slot 3. After the line card passes all field diagnostic tests, the Cisco IOS software is automatically reloaded on the card. Before starting the diagnostic tests, you must confirm the request to perform these tests on the line card because all activity on the line card is halted. The total/indiv. timeout set to 600/220 sec. message indicates that 600 seconds are allowed to perform all field diagnostics tests, and that no single test should exceed 220 seconds to complete. Router# diag 3 Running Diags will halt ALL activity on the requested slot. [confirm] Router# Launching a Field Diagnostic for slot 3 Running DIAG config check RUNNING DIAG download to slot 3 (timeout set to 400 sec.) sending cmd FDIAG-DO ALL to fdiag in slot 3 (total/indiv. timeout set to 600/220 sec.) Field Diagnostic ****PASSED**** for slot 3 Field Diag eeprom values: run 159 fial mode 0 (PASS) slot 3 last test failed was 0, error code 0 diag CF-152 Cisco IOS Configuration Fundamentals Command Reference April 2010 sending SHUTDOWN FDIAG_QUIT to fdiag in slot 3 Board will reload . . . Router# In the following example, a user is shown the output when field diagnostics are performed on the line card in slot 3 in verbose mode: Router# diag 3 verbose Running Diags will halt ALL activity on the requested slot. [confirm] Router# Launching a Field Diagnostic for slot 3 Running DIAG config check RUNNING DIAG download to slot 3 (timeout set to 400 sec.) sending cmd FDIAG-DO ALL to fdiag in slot 3 (total/indiv. timeout set to 600/220 sec.) FDIAG_STAT_IN_PROGRESS: test #1 R5K Internal Cache FDIAG_STAT_PASS test_num 1 FDIAG_STAT_IN_PROGRESS: test #2 Sunblock Ordering FDIAG_STAT_PASS test_num 2 FDIAG_STAT_IN_PROGRESS: test #3 Dram Datapins FDIAG_STAT_PASS test_num 3 . . . Field Diags: FDIAG_STAT_DONE Field Diagnostic ****PASSED**** for slot 3 Field Diag eeprom values: run 159 fial mode 0 (PASS) slot 3 last test failed was 0, error code 0 sending SHUTDOWN FDIAG_QUIT to fdiag in slot 3 Board will reload . . . Router# Related Commands Command Description microcode reload Reloads the Cisco IOS image on a line card on the Cisco 7000 series with RSP7000, Cisco 7500 series, or Cisco 12000 series routers after all microcode configuration commands have been entered. diagnostic bootup level CF-153 Cisco IOS Configuration Fundamentals Command Reference April 2010 diagnostic bootup level To set the diagnostic bootup level, use the diagnostic bootup level command in global configuration mode. To skip all diagnostic tests, use the no form of this command. diagnostic bootup level {minimal | complete} no diagnostic bootup level Syntax Description Command Default None Command Modes Global configuration (config) Command History Usage Guidelines Setting the diagnostic level determines the level of testing that occurs when the system or module is reset. The two levels are as follows: • Complete—Runs all tests. • Minimal—Runs only EARL tests for the supervisor engine and loopback tests for all ports in the system. Note Although the default is minimal, you can set the diagnostic level to complete for troubleshooting hardware problems. In certain circumstances, you might want to skip the bootup online diagnostics completely. For example, you might skip the bootup online diagnostics to verify that a port is as bad as online diagnostics reports. To skip online diagnostic testing completely, use the no diagnostic bootup level command. For information on the diagnostic test types, use the show diagnostic command. minimal Specifies minimal diagnostics. See the Usage Guidelines section for additional information. complete Specifies complete diagnostics. See the Usage Guidelines section for additional information. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SCC The command was integrated in this release to support Generic Online Diagnostics (GOLD) functionality for Cisco UBR10012 Universal Broadband Router. diagnostic bootup level CF-154 Cisco IOS Configuration Fundamentals Command Reference April 2010 The new level takes effect at the next reload or the next time that an online insertion and removal is performed. Examples The following example shows how to set the diagnostic bootup level: Router(config)# diagnostic bootup level complete Related Commands Command Description show diagnostic bootup level Displays the coverage level for the configured bootup diagnostics. diagnostic cns CF-155 Cisco IOS Configuration Fundamentals Command Reference April 2010 diagnostic cns To configure the Cisco Networking Services (CNS) diagnostics, use the diagnostic cns command in global configuration mode. To disable sending diagnostic results to the CNS event bus., use the no form of this command. diagnostic cns {publish | subscribe} [subject] no diagnostic cns {publish | subscribe} [subject] Syntax Description Defaults This command has no default settings. Command Modes Global configuration Command History Usage Guidelines The online diagnostics receive events by subscribing to an event subject name. The subject is the event that you subscribe (receive) or publish (generate) through the CNS bus. The diagnostic cns publish command sends diagnostic results to a remote network application to make decisions and take corrective actions that are based on the diagnostic results. The diagnostic cns subscribe command receives messages from remote network applications to perform diagnostic tests or retrieve diagnostic results. Examples This example shows how to enable the publishing of diagnostic results: Router(config)# diagnostic cns publish Router(config)# This example shows how to receive messages from remote network applications to perform diagnostic tests or retrieve diagnostic results: Router(config)# diagnostic cns subscribe Router(config)# publish Sends diagnostic results to a remote network application to make decisions and take corrective actions that are based on the diagnostic results. subscribe Receives messages from remote network applications to perform diagnostic tests or retrieve diagnostic results. subject (Optional) Event subject name. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA. This command was integrated into Cisco IOS Release 12.2(33)SRA. diagnostic cns CF-156 Cisco IOS Configuration Fundamentals Command Reference April 2010 This example shows how to set the default to publish: Router(config)# default diagnostic cns publish Router(config)# Related Commands Command Description show diagnostic cns Displays the information about the CNS subject. diagnostic event-log size CF-157 Cisco IOS Configuration Fundamentals Command Reference April 2010 diagnostic event-log size To modify the diagnostic event log size dynamically, use the diagnostic event-log size command in global configuration mode. To return to the default settings, use the no form of this command. diagnostic event-log size size no diagnostic event-log size Syntax Description Command Default The event log size is 500 entries. Command Modes Global configuration (config) Command History Usage Guidelines The events are dynamically allocated and stored in a circular queue. You can enter either the default diagnostic event-log size command or the no diagnostic event-log size command to return to the default settings. Examples The following example shows how to set the diagnostic event-log size: Router(config)# diagnostic event-log size 600 Related Commands size Diagnostic event-log sizes. The valid values range from 1 to 10000 entries. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA. This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SCC The command was integrated in this release to support Generic Online Diagnostics (GOLD) functionality for Cisco UBR10012 Universal Broadband Router. Command Description show diagnostic events Displays the event log for the diagnostic events. diagnostic level CF-158 Cisco IOS Configuration Fundamentals Command Reference April 2010 diagnostic level To turn on power-on diagnostic tests for the network service engines (NSEs) installed in a Cisco 7300 series router, use the diagnostic level command in privileged EXEC configuration mode. There is no no form of this command. diagnostic level {power-on | bypass} Syntax Description Defaults No diagnostic tests are performed. Command Modes Privileged EXEC Command History Usage Guidelines Use this command to enable power-on diagnostic tests to run on the installed NSEs of a Cisco 7300 series router when the system is booted. It is recommended that you issue this command only if you are experiencing problems with an NSE and are planning on rebooting the router. Issuing this command causes an increase in the boot time. Examples The following example shows how to enable diagnostic power-on tests: diagnostic level power-on The following sample output shows the output that is displayed upon system bootup after a power cycle or router crash: . . . System Power On Diagnostics DRAM Size ....................128 MB Testing DRAM..................Passed Level2 Cache .................Present Testing Level2 Cache (256 KB)Passed Level3 Cache .................Present power-on Power-on diagnostic tests are performed at system bootup on the NSEs. bypass No diagnostic tests are performed. This is the default. Release Modification 12.1(10)EX2 This command was introduced. 12.2(18)S This command was introduced on Cisco 7304 routers running Cisco IOS Release 12.2 S. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware. diagnostic level CF-159 Cisco IOS Configuration Fundamentals Command Reference April 2010 Testing Level3 Cache (1024 KB)Passed System Power On Diagnostics Complete Note This output is displayed when the system is booting, not when the command is issued. Related Commands Command Description debug redundancy Enables NSE redundancy debugging. show c7300 Displays the types of cards (NSE and line cards) installed in a Cisco 7300 series router. show redundancy (7300) Displays redundancy information for the active and standby NSEs. diagnostic monitor CF-160 Cisco IOS Configuration Fundamentals Command Reference April 2010 diagnostic monitor To configure health-monitoring diagnostic testing, use the diagnostic monitor command in global configuration mode. To disable testing, use the no form of this command. diagnostic monitor interval {module num} test {test-id | test-id-range | all} [hour hh] [min mm] [second ss] [millisec ms] [day day] diagnostic monitor syslog diagnostic monitor {module num} test {test-id | test-id-range | all} no diagnostic monitor {interval | syslog} Cisco UBR10012 Router diagnostic monitor {bay slot/bay | slot slot-no | subslot slot/sub-slot} test {test-id | test-id-range | all} diagnostic monitor interval {bay slot/bay | slot slot-no | subslot slot/sub-slot} test {test-id | test-id-range | all} {hh:mm:ss} {milliseconds} {number-of-days} diagnostic monitor syslog diagnostic monitor threshold {bay slot/bay | slot slot-no | subslot slot/sub-slot} test {test-id | test-id-range | all} {failure count no-of-allowed-failures} Syntax Description interval Sets the interval between testing. module num Specifies the module number. test Specifies a test to run. test-id Identification number for the test to run. See the Usage Guidelines section for additional information. test-id-range Range of identification numbers for tests to be run. run. See the Usage Guidelines section for additional information. all Runs all the diagnostic tests. hour hh (Optional) Specifies the number of hours between tests. See the Usage Guidelines section for formatting guidelines. min mm (Optional) Specifies the number of minutes between tests. See the Usage Guidelines section for formatting guidelines. second ss (Optional) Specifies the number of seconds between tests. See the Usage Guidelines section for formatting guidelines. millisec ms (Optional) Specifies the number of milliseconds between tests; see the “Usage Guidelines” section for formatting guidelines. day day (Optional) Specifies the number of days between tests. See the Usage Guidelines section for formatting guidelines. syslog Enables system logging messages when a health-monitoring test fails. diagnostic monitor CF-161 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Default The defaults are as follows: • Depending on the test run, monitoring may be enabled or disabled. • Depending on the test run, the default monitoring interval varies. • syslog is enabled. Command Modes Global configuration (config) Command History Usage Guidelines Use these guidelines when scheduling testing: • test-id—Enter the show diagnostic content command to display the test ID list. • test-id-range—Enter the show diagnostic content command to display the test ID list. Enter the range as integers separated by a comma and a hyphen (for example, 1,3-6 specifies test IDs 1, 3, 4, 5, and 6). • hh—Enter the hours from 1 to 24. bay slot/bay Indicates the card slot and bay number where the diagnostic test is run periodically and monitored. The bay keyword is used to refer a SPA on the router. The valid range for the slot number is from 1 to 8 and 0 to 3 for the bay number. slot slot-no Indicates the slot number of the full-height line card where the diagnostic test is run periodically and monitored. The slot keyword is used to refer a full-height line card on the router. The valid range for the slot is from 1 to 8. subslot slot/sub-slot Indicates the slot and subslot number of half-height line card on which the diagnostic test is run periodically and monitored. The subslot keyword is used to refer a half-height line card on the router. The valid range for the slot number is from 1 to 8 and 0 to 1 for the subslot number. threshold Configures the failure threshold value for the specified bay, slot, or subslot. failure count no-of-allowed-fail ures Configures the count for maximum failures allowed after which the failed test results are displayed in the output of the show diagnostic results command. The range for number of allowed failures is 0 to 99. hh:mm:ss Hours, minutes, and seconds interval configured to run the test again. milliseconds Number of milliseconds between tests. no-of -days Number of days between tests. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SCC The command was integrated in this release to support Generic Online Diagnostics (GOLD) functionality for Cisco UBR10012 Universal Broadband Router. The keywords bay, slot, and subslot were added for the Cisco UBR10012 Universal Broadband Router. diagnostic monitor CF-162 Cisco IOS Configuration Fundamentals Command Reference April 2010 • mm—Enter the minutes from 1 to 60. • day—Enter the day of the week as a number from 1 to 7 (1 is Sunday). • ss—Enter the seconds from 1 to 60. • ms—Enter the milliseconds from 1 to 1000. Enter the [no] diagnostic monitor test {test-id | test-id-range | all} command to enable or disable the specified health monitoring test. When entering the diagnostic monitor {module num} test {test-id | test-id-range | all} command, observe the following: • Required – Isolate network traffic by disabling all connected ports and do not pump test packets during the test. – Remove all modules for testing FIB TCAM and SSRAM memory on the PFC of the supervisor engine. – Reset the system or the test module before putting the system back into the normal operating mode. • Recommended – If the DFC module is present, remove all modules, and then reboot the system before starting the memory test on the central PFC3B of the supervisor engine. – Turn off all background health-monitoring tests on the supervisor engine and the modules using the no diagnostic monitor {module num} test {test-id | test-id-range | all} command. The FIB TCAM test for central PFC3BXL or PFC3B (on the supervisor engine) takes approximately 4 hours and 30 minutes. The FIB TCAM test for the distributed PFC3BXL or PFC3B (on the DFC module) takes approximately 16 hours. You can run the FIB TCAM test on multiple DFC3BX modules simultaneously. Cisco UBR10012 Router The command syntax to refer a line card or SPAs is different on Cisco UBR10012 Router. The keyword is slot x for a full-height line card, slot x/y for a half-height card, and bay x/y for a SPA. To monitor a diagnostic test periodically, you first need to configure the hours, minutes, and seconds interval to run the diagnostic test using the diagnostic monitor interval command. An error message is displayed, if the interval is not configured before enabling the monitoring. To store log details for failed tests, execute the diagnostic monitor syslog command. A threshold value to specify the maximum count for allowed failures is configured using the diagnostic monitor threshold command. The failed test results can be viewed using the show diagnostic results command, after the number of failed test reaches the maximum number of allowed failures configured using the diagnostic monitor threshold command. diagnostic monitor CF-163 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example shows how to run the specified test every 3 days, 10 hours, and 2 minutes: Router(config)# diagnostic monitor interval module 1 test 1 day 3 hours 10 min 2 The following example shows how to enable the generation of a syslog message when any health-monitoring test fails: Router(config)# diagnostic monitor syslog Cisco UBR10012 Router The following example shows a sample output of an error message displayed when monitoring is enabled before configuring the test interval: Router(config)# diagnostic monitor bay 1/0 test 2 Aug 12 18:04:56.280: %DIAG-3-MONITOR_INTERVAL_ZERO: Bay 1/0: Monitoring interval is 0. Cannot enable monitoring for Test #2 The following example shows how to configure the periodic interval for running diagnostic tests on the the router before enabling monitoring: Router(config)# diagnostic monitor interval bay 1/0 test 2 06:00:00 100 10 The following example shows how to enable the diagnostic monitoring on bay 1/0: Router(config)# diangostic monitor bay 1/0 test 2 The following example shows how to enable logging of failed messages to syslog: Router(config)# diangostic monitor syslog The following example shows how to configure the failure threshold value after which the failed test results are displayed in the command output for show diagnostic results: Router(config)# diagnostic monitor threshold bay 1/0 test 2 failure count 10 Related Commands Command Description show diagnostic content Displays test information including test ID, test attributes, and supported coverage test levels for each test and for all modules. diagnostic ondemand CF-164 Cisco IOS Configuration Fundamentals Command Reference April 2010 diagnostic ondemand To configure the on-demand diagnostics, use the diagnostic ondemand command in privileged EXEC mode. diagnostic ondemand {iteration iteration-count | action-on-failure {continue error-count | stop}} Syntax Description Command Default The default settings are as follows: • iteration-count is 1. • action-on-error is continue. • error-count is 0. Command Modes Privileged EXEC (#) Command History Usage Guidelines Entering 0 for the error-count sets the number of errors that are allowed to unlimited. iteration iteration-count Sets the number of times the same test to rerun when the command is issued. The valid range for iteration-count is between 1 to 999. action-on-failure Sets the execution action when a failure is detected. continue Continues testing when a test failure is detected. stop Stops testing when a test failure is detected. error-count (Optional) Number of errors that are allowed before stopping. This argument is used with the continue option. The valid range for error-count is from 0 to 65534. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SCC The command was integrated in this release to support Generic Online Diagnostics (GOLD) functionality for Cisco UBR10012 Universal Broadband Router. diagnostic ondemand CF-165 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example shows how to set the ondemand testing iteration count: Router# diagnostic ondemand iteration 4 Router# The following example shows how to set the execution action when an error is detected: Router# diagnostic ondemand action-on-failure continue 2 Router# Related Commands Command Description show diagnostic ondemand settings Displays the settings for on-demand diagnostics. diagnostic schedule test CF-166 Cisco IOS Configuration Fundamentals Command Reference April 2010 diagnostic schedule test To set the scheduling of test-based diagnostic testing for a specific module or schedule a supervisor engine switchover, use the diagnostic schedule test command in global configuration mode. To remove the scheduling, use the no form of this command. diagnostic schedule module {num | active-sup-slot} test {test-id | test-id-range | all} [port {num | num-range | all}] {on mm dd yyyy hh:mm | daily hh:mm} | weekly day-of-week hh:mm} no diagnostic schedule test Syntax Description Defaults This command has no default settings. Command Modes Global configuration Command History module num Specifies the module number. module active-sup-slot Specifies the slot number of the active supervisor engine. test-id Identification number for the test to be run; see the “Usage Guidelines” section for additional information. test-id-range Range of identification numbers for tests to be run; see the “Usage Guidelines” section for additional information. all Runs all diagnostic tests. port (Optional) Specifies the port to schedule testing. num (Optional) Port number. num-range (Optional) Range of port numbers, separated by a hyphen. all Specifies all ports. on mm dd yyyy hh:mm Specifies the scheduling of a test-based diagnostic task; see the “Usage Guidelines” section for formatting guidelines. daily hh:mm Specifies the daily scheduling of a test-based diagnostic task; see the “Usage Guidelines” section for formatting guidelines. weekly day-of-week hh:mm Specifies the weekly scheduling of a test-based diagnostic task; see the “Usage Guidelines” section for formatting guidelines. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17b)SXA This command was changed to support scheduled switchover for supervisor engines. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. diagnostic schedule test CF-167 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines Use these guidelines when scheduling testing: • test-id—Enter the show diagnostic content command to display the test ID list. • test-id-range—Enter the show diagnostic content command to display the test ID list. Enter the range as integers separated by a comma and a hyphen (for example, 1,3-6 specifies test IDs 1, 3, 4, 5, and 6). • num-range—Enter the range as integers separated by a comma and a hyphen (for example, you can enter 1,3-6 to specify ports 1, 3, 4, 5, and 6). • mm—Spell out the month such as january, february ... december (either uppercase or lowercase characters). • dd—Enter the day as a 2-digit number. • yyyy—Enter the year as a 4-digit number. • hh:mm—Enter the time as a 2-digit number (for a 24-hour clock) for hours:minutes; the colon (:) is required. • day-of-week—Spell out the day of the week, such as monday, tuesday... sunday (either uppercase or lowercase characters). • port {num | num-range | all}—Is not supported when specifying a scheduled switchover. Enter the show diagnostic content command to display the test ID list. You can use the diagnostic schedule module active-sup-slot test test-id command to schedule a switchover from the active supervisor engine to the standby supervisor engine. Enter the show diagnostic content active-sup-slot command to display the test ID list and look for the test ID in the ScheduleSwitchover field. You can specify a periodic switchover (daily or weekly) or a single switchover occurrence at a specific time using these commands: • diagnostic schedule module active-sup-slot test test-id on mm dd yyyy hh:mm • diagnostic schedule module active-sup-slot test test-id daily hh:mm • diagnostic schedule module active-sup-slot test test-id weekly day-of-week hh:mm Note To avoid system downtime in the event that the standby supervisor engine cannot switch over the system, we recommend that you schedule a switchover from the standby supervisor engine to the active supervisor engine 10 minutes after the switchover occurs. See the “Examples” section for additional information. Examples This example shows how to schedule the diagnostic testing on a specific date and time for a specific module and port: Router(config)# diagnostic schedule module 1 test 1,2,5-9 port 3 on january 3 2003 23:32 Router(config)# This example shows how to schedule the diagnostic testing to occur daily at a certain time for a specific port and module: Router(config)# diagnostic schedule module 1 test 1,2,5-9 port 3 daily 12:34 Router(config)# diagnostic schedule test CF-168 Cisco IOS Configuration Fundamentals Command Reference April 2010 This example shows how to schedule the diagnostic testing to occur weekly on a certain day for a specific port and module: Router(config)# diagnostic schedule module 1 test 1,2,5-9 port 3 weekly friday 09:23 Router(config)# This example shows how to schedule a switchover for the active supervisor engine every Friday at 10:00 pm, and switch the standby supervisor engine back to the active supervisor engine 10 minutes after the switchover occurs. For this example, these conditions apply: • test-id is 32. • The active supervisor engine is in slot 5. • The standby supervisor engine is in slot 6. Related Commands Command Description show diagnostic content Displays test information including test ID, test attributes, and supported coverage test levels for each test and for all modules. show diagnostic schedule Displays the current scheduled diagnostic tasks. diagnostic start CF-169 Cisco IOS Configuration Fundamentals Command Reference April 2010 diagnostic start To run the specified diagnostic test, use the diagnostic start command in privileged EXEC mode. diagnostic start module num test {test-id | test-id-range | minimal | complete | basic | per-port | non-disruptive | all} [port {num | port#-range | all}] diagnostic start system test all Cisco UBR10012 Universal Broadband Router diagnostic start {bay slot/bay | slot slot-no} test {test-id | test-id-range | all | complete | minimal | non-disruptive} diagnostic start {subslot slot/sub-slot} test {test-id | test-id-range | all | complete | minimal | non-disruptive | per-port [port {num | port#-range | all}]} Syntax Description module num Specifies the module number. test Specifies a test to run. test-id Identification number for the test to run. See the Usage Guidelines section for additional information. test-id-range Range of identification numbers for tests to run. See the Usage Guidelines section for additional information. minimal Runs minimal bootup diagnostic tests. complete Runs complete bootup diagnostic tests. basic Runs basic on-demand diagnostic tests. per-port Runs per-port level tests. non-disruptive Runs the non disruptive health-monitoring tests. all Runs all diagnostic tests. port num (Optional) Specifies the interface port number. port port#-range (Optional) Specifies the interface port number range. See the Usage Guidelines section for additional information. port all (Optional) Specifies all ports. system test all Runs all disruptive and nondisruptive diagnostic tests at once. All test dependencies are handled automatically. bay slot/bay Indicates the card slot and bay number where the diagnostic test is executed. The bay keyword is used to refer a SPA on the router. The valid range for the slot number is from 1 to 8 and 0 to 3 for the bay number. slot slot-no Indicates the slot number of the full-height line card where the diagnostic test is executed. The slot keyword is used to refer a full-height line card on the router. The valid range for slot is from 1 to 8. subslot slot/sub-slot Indicates the slot and subslot number of half-height line card where the diagnostic test is executed. The subslot keyword is used to refer a half-height line card on the router. The valid range for the slot number is from 1 to 8 and 0 to 1 for the subslot number. diagnostic start CF-170 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Default None Command Modes Privileged EXEC (#) Command History Usage Guidelines Note Running all online diagnostic tests disrupts normal system operation. Reset the system after the diagnostic start system test all command has completed. Do not insert, remove, or power down line cards or the supervisor while the system test is running. Do not issue any diagnostic command other than the diagnostic stop system test all command while the system test is running. Make sure no traffic is running in background. Note Do not enter the diagnostic start module x test all command on systems that are configured with a DFC3A because this command causes the TCAM test to fail. Enter the show diagnostic content command to display the test ID list. Enter the test-id-range or port#-range as integers separated by a comma and a hyphen (for example, 1,3-6 specifies test IDs 1, 3, 4, 5, and 6). Use diagnostic stop command to stop the testing process. Cisco UBR10012 Router The command syntax to refer a line card or SPAs is different on Cisco UBR10012 Router. The keyword is slot x for a full-height line card, slot x/y for a half-height card, and bay x/y for a SPA. Note To start a diagnostic test on the Cisco UBR10012 Router execute the command diagnostic stop with the bay, slot or subslot keyword respectively. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17a)SX This command was changed to include the complete and basic keywords. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2.(33)SXH This command was changed to include the system test all keywords. 12.2(33)SCC The command was integrated in this release to support Generic Online Diagnostics (GOLD) functionality for Cisco UBR10012 Universal Broadband Router. The keywords bay, slot, and subslot were added for the Cisco UBR10012 Universal Broadband Router. diagnostic start CF-171 Cisco IOS Configuration Fundamentals Command Reference April 2010 The GOLD test cases used to poll for system errors in Cisco IOS Software Release 12.2(33)SCC are Low Latency Queueing (LLQ) drop, Cable Line Card (CLC) memory leak, and Guardian index leak tests. Examples The following example shows how to run the specified diagnostic test at the specified slot: Router# diagnostic start module 1 test 5 Module 1:Running test(s) 5 may disrupt normal system operation Do you want to run disruptive tests? [no] yes 00:48:14:Running OnDemand Diagnostics [Iteration #1] ... 00:48:14:%DIAG-SP-6-TEST_RUNNING:Module 1:Running TestNewLearn{ID=5} ... 00:48:14:%DIAG-SP-6-TEST_OK:Module 1:TestNewLearn{ID=5} has completed successfully 00:48:14:Running OnDemand Diagnostics [Iteration #2] ... 00:48:14:%DIAG-SP-6-TEST_RUNNING:Module 1:Running TestNewLearn{ID=5} ... 00:48:14:%DIAG-SP-6-TEST_OK:Module 1:TestNewLearn{ID=5} has completed successfully Router# This example shows how to start all online diagnostic tests: Router# diagnostic start system test all ************************************************************************* * WARNING: * * 'diagnostic start system test all' will disrupt normal system * * operation. The system requires RESET after the command * * 'diagnostic start system test all' has completed prior to * * normal use. * * * * IMPORTANT: * * 1. DO NOT INSERT, OIR, or POWER DOWN Linecards or * * Supervisor while system test is running. * * * * 2. DO NOT ISSUE ANY DIAGNOSTIC COMMAND except * * "diagnostic stop system test all" while system test * * is running. * * * * 3. PLEASE MAKE SURE no traffic is running in background. * ************************************************************************* Do you want to continue? [no]: Cisco UBR10012 Router The following example shows how to run a diagnostic test with test id 2 on a SPA: ubr-122s-1# diagnostic start bay 1/0 test 2 ubr-122s-1# Aug 5 09:24:42.019: %DIAG-6-TEST_RUNNING: Bay 1/0: Running TestModenaLLQDrops{I D=2} ... Aug 5 09:24:42.019: %DIAG-6-TEST_OK: Bay 1/0: TestModenaLLQDrops{ID=2} has comp leted successfully Related Commands Command Description diagnostic schedule Sets the diagnostic test schedule for a particular bay, slot, or subslot. show diagnostic description Provides the description for the diagnostic tests. diagnostic stop Runs the specified diagnostic test. show diagnostic content module Displays the available diagnostic tests. diagnostic start CF-172 Cisco IOS Configuration Fundamentals Command Reference April 2010 diagnostic bootup level Configures the diagnostic bootup level. diagnostic event-log size Modifies the diagnostic event-log size dynamically. diagnostic monitor Configures the health-monitoring diagnostic testing. diagnostic ondemand Configures the on-demand diagnostics. show diagnostic bootup Displays the configured diagnostics level at bootup. show diagnostic events Displays the diagnostic event log. show diagnostic ondemand settings Displays the settings for the on-demand diagnostics. show diagnostic result Displays the diagnostic test results for a module. show diagnostic schedule Displays the current scheduled diagnostic tasks. show diagnostic status Displays the running diagnostics tests. Command Description diagnostic stop CF-173 Cisco IOS Configuration Fundamentals Command Reference April 2010 diagnostic stop To stop the testing process, use the diagnostic stop command in privileged EXEC mode. diagnostic stop module num Cisco UBR10012 Universal Broadband Router diagnostic stop {bay slot/bay | slot slot-no | subslot slot/subslot} Syntax Description Command Default None Command Modes Privileged EXEC (#) Command History Usage Guidelines Use the diagnostic start command to start the testing process. Cisco UBR10012 Router The command syntax to refer a line card or SPAs is different on Cisco UBR10012 Router. The keyword is slot x for a full-height line card, slot x/y for a half-height card, and bay x/y for a SPA. module num Module number. bay slot/bay Indicates the card slot and bay number of the SPA for which the diagnostic test has stopped. The bay keyword is used to refer a SPA on the router. The valid range for the slot number is from 1 to 8 and 0 to 3 for the bay number. slot slot-no Indicates the slot number of full height line card for which the diagnostic test has to be stopped. The slot keyword is used to refer a full-height line card on the router. Valid range for the slot is from 1 to 8. subslot slot/subslot Indicates the slot and subslot number of half-height line card for which the diagnostic test has to be stopped. The subslot keyword is used to refer a half-height line card on the router. The valid range for the slot number is from 1 to 8 and 0 to 1 for the subslot number. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SCC The command was integrated in this release to support Generic Online Diagnostics (GOLD) functionality for Cisco UBR10012 Universal Broadband Router. The keywords bay, slot, and subslot were added for the Cisco UBR10012 Universal Broadband Router. diagnostic stop CF-174 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note To stop a diagnostic test on the Cisco UBR10012 Router execute the command diagnostic stop with the bay, slot or subslot keyword respectively. The GOLD test cases used to poll for system errors in Cisco IOS Software Release 12.2(33)SCC are Low Latency Queueing (LLQ) drop, Cable Line Card (CLC) memory leak, and line card index leak tests. Examples This example shows how to stop the diagnostic test process: Router# diagnostic stop module 3 Router# This example shows how to stop the diagnostic test process for subslot 5/0 on the Cisco UBR10012 Universal Broadband Router: Router# diagnostic stop subslot 5/0 Router# Related Commands Command Description diagnostic schedule Sets the diagnostic test schedule for a particular bay, slot, or subslot. show diagnostic description Provides the description for the diagnostic tests. diagnostic start Stops the specified diagnostic test. show diagnostic content module Displays the available diagnostic tests. diagnostic bootup level Configures the diagnostic bootup level. diagnostic event-log size Modifies the diagnostic event-log size dynamically. diagnostic monitor Configures the health-monitoring diagnostic testing. diagnostic ondemand Configures the on-demand diagnostics. show diagnostic bootup Displays the configured diagnostics level at bootup. show diagnostic events Displays the diagnostic event log. show diagnostic ondemand settings Displays the settings for the on-demand diagnostics. show diagnostic result Displays the diagnostic test results for a module. show diagnostic schedule Displays the current scheduled diagnostic tasks. show diagnostic status Displays the running diagnostics tests. dir CF-175 Cisco IOS Configuration Fundamentals Command Reference April 2010 dir To display a list of files on a file system, use the dir command in EXEC, privileged EXEC, or diagnostic mode. dir [/all] [/recursive] [all-filesystems] [filesystem:][file-url] Syntax Description Defaults The default file system is specified by the cd command. When you omit the /all keyword, the Cisco IOS software displays only undeleted files. Command Modes EXEC (>) Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines Use the show (flash file system) command to display more detail about the files in a particular file system. /all (Optional) Lists deleted files, undeleted files, and files with errors. /recursive (Optional) Lists files recursively. all-filesystems (Optional) Lists all files in all filesystems on the router. filesystem: (Optional) File system or directory containing the files to list, followed by a colon. file-url (Optional) The name of the files to display on a specified device. The files can be of any type. You can use wildcards in the filename. A wildcard character (*) matches all patterns. Strings after a wildcard are ignored. Release Modification 11.0 This command was introduced. 12.3 A timestamp that shows the offset from Coordinated Universal Time (UTC) was added to the dir command display. 12.3(14)T The usbflash[0-9]: and usbtoken[0-9]: options were added as available file systems. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.4(11)T This command was integrated into the Cisco 7200VXR NPE-G2 platform. Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Routers, and the following enhancements were introduced: • The command was made available in diagnostic mode. • The /recursive option was introduced. • The file systems available with the Cisco ASR 1000 Series Routers became available as filesystem: options. dir CF-176 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following is sample output from the dir command: Router# dir slot0: Directory of slot0:/ 1 -rw- 4720148 Dec 29 2003 17:49:36 -08:00 hampton/nitro/c7200-j-mz 2 -rw- 4767328 Jan 02 2004 18:42:53 -08:00 c7200-js-mz 5 -rw- 639 Jan 03 2004 12:09:32 -08:00 rally 7 -rw- 639 Jan 03 2004 12:37:13 -08:00 the_time 20578304 bytes total (3104544 bytes free) Router# dir /all slot0: Directory of slot0:/ 1 -rw- 4720148 Dec 15 2003 17:49:36 -08:00 hampton/nitro/c7200-j-mz 2 -rw- 4767328 Jan 02 2004 18:42:53 -08:00 c7200-js-mz 3 -rw- 7982828 Jan 02 2004 18:48:14 -08:00 [rsp-jsv-mz] 4 -rw- 639 Jan 03 2004 12:09:17 -08:00 the_time] 5 -rw- 639 Jan 03 1994 12:09:32 -08:00 rally 6 -rw- 639 Jan 03 1994 12:37:01 -08:00 [the_time] 7 -rw- 639 Jan 03 1994 12:37:13 -08:00 Table 28 describes the significant fields shown in the output. Related Commands Table 28 dir Field Descriptions Field Description 1 Index number of the file. -rw- Permissions. The file can be any or all of the following: • d—directory • r—readable • w—writable • x—executable 4720148 Size of the file. Dec 15 2003 17:49:36 Last modification date. -08:00 Conversion to local time in hours from Coordinated Universal Time (UTC). In the example, -08:00 indicates that the given time is 8 hours behind UTC or Pacific Standard Time (PST). hampton/nitro/c7200-j-mz Filename. Deleted files are indicated by square brackets around the filename. Command Description cd Changes the default directory or file system. delete Deletes a file on a Flash memory device. undelete Recovers a file marked “deleted” on a Class A or Class B Flash file system. disable CF-177 Cisco IOS Configuration Fundamentals Command Reference April 2010 disable To exit privileged EXEC mode and return to user EXEC mode, or to exit to a lower privilege level, enter the disable command in EXEC, privileged EXEC, or diagnostic mode. disable [privilege-level] Syntax Description Command Modes EXEC (>) Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines Up to 16 security levels can be configured using Cisco IOS software. If such levels are configured on a system, using this command with the privilege-level option allows you to exit to a lower security level. If a level is not specified, the user will exit to the user EXEC mode, which is the default. Note Five EXEC commands are associated with privilege level 0: disable, enable, exit, help, and logout. If you configure a privilege level greater than 0, these five commands will not be included in the command set for that privilege level. Examples In the following example, the user enters privileged EXEC mode using the enable command, then exits back to user EXEC mode using the disable command. Note that the prompt for user EXEC mode is >, and the prompt for privileged EXEC mode is #. Router> enable Password: Router# disable Router> Related Commands privilege-level (Optional) Specific privilege level (other than user EXEC mode). Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Routers, and became available in diagnostic mode. Command Description enable Enables higher privilege level access, such as privileged EXEC mode. disconnect-character CF-178 Cisco IOS Configuration Fundamentals Command Reference April 2010 disconnect-character To define a character to disconnect a session, use the disconnect-character command in line configuration mode. To remove the disconnect character, use the no form of this command. disconnect-character ascii-number no disconnect-character Syntax Description Defaults No disconnect character is defined. Command Modes Line configuration Command History Usage Guidelines See the “ASCII Character Set and Hex Values” appendix for a list of ASCII characters. The Break character is represented by zero; NULL cannot be represented. To use the session-disconnect character in normal communications, precede it with the escape character. Examples The following example defines the disconnect character for virtual terminal line 4 as Escape, which is decimal character 27: Router(config)# line vty 4 Router(config-line)# disconnect-character 27 ascii-number Decimal representation of the session disconnect character. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. dispatch-character CF-179 Cisco IOS Configuration Fundamentals Command Reference April 2010 dispatch-character To define a character that causes a packet to be sent, use the dispatch-character command in line configuration mode. To remove the definition of the specified dispatch character, use the no form of this command. dispatch-character ascii-number1 [ascii-number2 . . . ascii-number] no dispatch-character ascii-number1 [ascii-number2 . . . ascii-number] Syntax Description Defaults No dispatch character is defined. Command Modes Line configuration Command History Usage Guidelines See the “ASCII Character Set and Hex Values” appendix for a list of ASCII characters. The dispatch-character command defines one or more dispatch characters that cause a packet to be sent even if the dispatch timer has not expired. Use of a dispatch character causes the Cisco IOS software to attempt to buffer characters into larger-sized packets for transmission to the remote host. Enable the dispatch-character command from the session that initiates the connection, not from the incoming side of a streaming Telnet session. This command can take multiple arguments, so you can define any number of characters as dispatch characters. Examples The following example defines the Return character (decimal 13) as the dispatch character for virtual terminal line (vty) line 4: Router(config)# line vty 4 Router(config-line)# dispatch-character 13 ascii-number1 Decimal representation of the desired dispatch character. ascii-number2 . . . ascii-number (Optional) Additional decimal representations of characters. This syntax indicates that you can define any number of characters as dispatch characters. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. dispatch-character CF-180 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description dispatch-machine Specifies an identifier for a TCP packet dispatch state machine on a particular line. dispatch-timeout Sets the character dispatch timer. state-machine Specifies the transition criteria for the state of a particular state machine. terminal dispatch-character Defines a character that causes a packet to be sent for the current session. dispatch-machine CF-181 Cisco IOS Configuration Fundamentals Command Reference April 2010 dispatch-machine To specify an identifier for a TCP packet dispatch state machine on a particular line, use the dispatch-machine command in line configuration mode. To disable a state machine on a particular line, use the no form of this command. dispatch-machine name no dispatch-machine Syntax Description Defaults No dispatch state machine identifier is defined. Command Modes Line configuration Command History Usage Guidelines When the dispatch-timeout command is specified, a packet being built will be sent when the timer expires, and the state will be reset to zero. Any dispatch characters specified using the dispatch-character command are ignored when a state machine is also specified. If a packet becomes full, it will be sent regardless of the current state, but the state will not be reset. The packet size depends on the traffic level on the asynchronous line and the dispatch-timeout value. There is always room for 60 data bytes. If the dispatch-timeout value is greater than or equal to 100 milliseconds, a packet size of 536 (data bytes) is allocated. Examples The following example specifies the name linefeed for the state machine: Router(config)# state-machine linefeed 0 0 9 0 Router(config)# state-machine linefeed 0 11 255 0 Router(config)# state-machine linefeed 0 10 10 transmit Router(config)# line 1 Router(config-line)# dispatch-machine linefeed Related Commands name Name of the state machine that determines when to send packets on the asynchronous line. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description dispatch-character Defines a character that causes a packet to be sent. dispatch-machine CF-182 Cisco IOS Configuration Fundamentals Command Reference April 2010 dispatch-timeout Sets the character dispatch timer. state-machine Specifies the transition criteria for the state of a particular state machine. Command Description dispatch-timeout CF-183 Cisco IOS Configuration Fundamentals Command Reference April 2010 dispatch-timeout To set the character dispatch timer, use the dispatch-timeout command in line configuration mode. To remove the timeout definition, use the no form of this command. dispatch-timeout milliseconds no dispatch-timeout Syntax Description Defaults No dispatch timeout is defined. Command Modes Line configuration Command History Usage Guidelines Use this command to increase the processing efficiency for the remote host. The dispatch-timeout line configuration command causes the software to buffer characters into packets for transmission to the remote host. The Cisco IOS software sends a packet a specified amount of time after the first character is put into the buffer. You can use the dispatch-timeout and dispatch-character line configuration commands together. In this case, the software dispatches a packet each time the dispatch character is entered, or after the specified dispatch timeout interval, depending on which condition is met first. Note The system response time might appear intermittent if the timeout interval is greater than 100 milliseconds and remote echoing is used. For lines with a reverse-Telnet connection, use a dispatch-timeout value less than 10 milliseconds. Examples The following example sets the dispatch timer to 80 milliseconds for virtual terminal line (vty) lines 0 through 4: Router(config)# line vty 0 4 Router(config-line)# dispatch-timeout 80 milliseconds Integer that specifies the number of milliseconds (ms) that the Cisco IOS software waits after putting the first character into a packet buffer before sending the packet. During this interval, more characters can be added to the packet, which increases the processing efficiency of the remote host. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. dispatch-timeout CF-184 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description buffer-length Specifies the maximum length of data streams forwarded on a line. dispatch-character Defines a character that causes a packet to be sent. dispatch-machine Specifies an identifier for a TCP packet dispatch state machine on a particular line. state-machine Specifies the transition criteria for the state of a particular state machine. terminal dispatch-timeout Sets the character dispatch timer for the current session. do CF-185 Cisco IOS Configuration Fundamentals Command Reference April 2010 do To execute user EXEC or privileged EXEC commands from global configuration mode or other configuration modes or submodes, use the do command in any configuration mode. do command Syntax Description Command Default A user EXEC or privileged EXEC command is not executed from a configuration mode. Command Modes All configuration modes Command History Usage Guidelines Use this command to execute user EXEC or privileged EXEC commands (such as show, clear, and debug commands) while configuring your routing device. After the EXEC command is executed, the system will return to the configuration mode you were using. Tip This command can be useful for saving your configuration to the startup-config file without having to return to the user EXEC mode or privileged EXEC mode (do copy running-config startup-config) or for checking the status of a feature (using a do show command) while configuring the feature. Caution Do not enter the do command in user EXEC mode or privileged EXEC mode. Interruption of service might occur. You cannot use the do command to execute the configure terminal command because entering the configure terminal command changes the user EXEC mode or privileged EXEC mode to the global configuration mode. You cannot use the do command to execute copy or write commands in the global configuration or any other configuration mode or submode. command The user EXEC or privileged EXEC command to be executed. Release Modification 12.2(8)T This command was introduced. 12.2(14)S This command was integrated into Cisco IOS Release 12.2(14)S. 12.2(14)SX Support for this command was added for the Supervisor Engine 720. 12.2(17a)SX This command was changed to support the copy command restriction. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. do CF-186 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example shows how to enter the show interfaces serial privileged EXEC command from within global configuration mode: Router(config)# do show interfaces serial 3/0 Serial3/0 is up, line protocol is up Hardware is M8T-RS232 MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec, rely 255/255, load 1/255 Encapsulation HDLC, loopback not set, keepalive set (10 sec) Last input never, output 1d17h, output hang never Last clearing of “show interface” counters never . . . The following example shows how to enter the clear vpdn tunnel user EXEC or privileged EXEC command from within VPDN configuration mode: Router(config-vpdn)# do clear vpdn tunnel Related Commands Command Description clear vpdn tunnel Shuts down a specified VPDN tunnel and all sessions within the tunnel. configure terminal Enters global configuration mode. copy Copies any file from a source to a destination. show interfaces Displays statistics for all interfaces configured on the router or access server. write core Tests the configuration of a core dump setup. downward-compatible-config CF-187 Cisco IOS Configuration Fundamentals Command Reference April 2010 downward-compatible-config To generate a configuration that is compatible with an earlier Cisco IOS release, use the downward-compatible-config command in global configuration mode. To disable this function, use the no form of this command. downward-compatible-config version no downward-compatible-config Syntax Description Defaults Disabled Command Modes Global configuration Command History Usage Guidelines In Cisco IOS Release 10.3, IP access lists changed format. Use the downward-compatible-config command to regenerate a configuration in a format prior to Release 10.3 if you are going to downgrade from your software version to version 10.2 or 10.3. The earliest version value this command accepts is 10.2. When this command is configured, the router attempts to generate a configuration that is compatible with the specified version. Note that this command affects only IP access lists. Under some circumstances, the software might not be able to generate a fully backward-compatible configuration. In such a case, the software issues a warning message. Examples The following example generates a configuration file compatible with Cisco IOS Release 10.2 access lists: Router(config)# downward-compatible-config 10.2 Related Commands version Cisco IOS release number, not earlier than Release 10.2. Release Modification 11.1 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description access-list (extended) Provides extended access lists that allow more detailed access lists. access-list (standard) Defines a standard XNS access list. editing CF-188 Cisco IOS Configuration Fundamentals Command Reference April 2010 editing To reenable Cisco IOS enhanced editing features for a particular line after they have been disabled, use the editing command in line configuration mode. To disable these features, use the no form of this command. editing no editing Syntax Description This command has no arguments or keywords. Defaults Enabled Command Modes Line configuration Command History Usage Guidelines Enhanced editing features are enabled by default. However, there may be situations in which you need to disable these features. The no form of this command disables these enhanced editing features, and the plain form of the command can be used to reenable these features. Table 29 provides a description of the keys used to enter and edit commands when the editing features are enabled. Ctrl indicates the Control key, which must be pressed simultaneously with its associated letter key. Esc indicates the Escape key, which must be pressed first, followed by its associated letter key. A comma is used in the following table to indicate a key sequence (the comma key should not be pressed). Keys are not case sensitive. Many letters used for CLI navigation and editing were chosen to provide an easy way of remembering their functions. In the following table (Table 29), characters are bolded in the “Function Summary” column to indicate the relation between the letter used and the function. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. editing CF-189 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 29 Command Editing Keys and Functions Keys Function Summary Function Details Tab Complete command Completes a partial command name entry. When you enter a unique set of characters and press the Tab key, the system completes the command name. If you enter a set of characters that could indicate more than one command, the system beeps to indicate an error. To view the commands which match the set of characters you have entered, enter a question mark (?) immediately following the partial command (no space). The CLI will then list the commands that begin with that string. Return (at the command line) Execute Executes the command. Return (at the --More-- prompt) Continue Displays the next line of output. Space Bar (at the --More-- prompt) Continue Displays the next screen of output. The amount of output you see will depend on the screen depth setting of your terminal. Delete or Backspace Backspace Erases the character to the left of the cursor. Left Arrow1 or Ctrl-B Back character Moves the cursor one character to the left. When you enter a command that extends beyond a single line, you can press the Left Arrow or Ctrl-B keys repeatedly to scroll back toward the system prompt and verify the beginning of the command entry. Right Arrow1 or Ctrl-F Forward character Moves the cursor one character to the right. Esc, B Back word Moves the cursor back one word. Esc, F Forward word Moves the cursor forward one word. Ctrl-A Beginning of line Moves the cursor to the beginning of the line. Ctrl-E End of line Moves the cursor to the end of the command line. Ctrl-D Delete character Deletes the character at the cursor. Esc, D Delete next word Deletes from the cursor to the end of the word. Ctrl-W Delete previous word Deletes the word to the left of the cursor. Ctrl-K Delete line forward Deletes all characters from the cursor to the end of the command line. Ctrl-U or Ctrl-X Delete line backward Deletes all characters from the cursor back to the beginning of the command line. Ctrl-T Transpose characters Transposes the character to the left of the cursor with the character located at the cursor. editing CF-190 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, enhanced editing mode is disabled on line 3: Router(config)# line 3 Router(config-line)# no editing Related Commands Ctrl-R or Ctrl-L Redisplay line Redisplays the system prompt and command line. Ctrl-V or Esc, Q Ignore editing Inserts a code to indicate to the system that the keystroke immediately following should be treated as a command entry, not as an editing key. Up Arrow1 or Ctrl-P Previous command Recalls commands in the history buffer, beginning with the most recent command. Repeat the key sequence to recall successively older commands. Down Arrow1 or Ctrl-N (next) Next command Returns to more recent commands in the history buffer (after recalling commands with the Up Arrow or Ctrl-P). Repeat the key sequence to recall successively more recent commands. Ctrl-Y Recall last deleted command Recalls the most recent entry in the delete buffer. The delete buffer contains the last ten items you have deleted or cut. Ctrl-Y can be used in conjunction with Esc Y. Esc, Y Recall next deleted command Recalls the next entry in the delete buffer. The delete buffer contains the last ten items you have deleted. Press Ctrl-Y first to recall the most recent entry. Then press Esc Y up to nine times to recall the remaining entries in the buffer. If you bypass an entry, continue to press Esc Y to cycle back to it. Esc, C Capitalize word Capitalizes the word from the cursor to the end of the word. Esc, U Make word uppercase Changes all letters from the cursor to the next space on the line appear in uppercase letters. Esc, L Make word lowercase Changes the word to lowercase from the cursor to the end of the word. 1. The arrow keys function only with ANSI-compatible terminals. Table 29 Command Editing Keys and Functions (continued) Keys Function Summary Function Details Command Description terminal editing Controls CLI enhanced editing feature for the current terminal session. enable CF-191 Cisco IOS Configuration Fundamentals Command Reference April 2010 enable To change the privilege level for a CLI session or to use a CLI view for a CLI session, use the enable command in either user EXEC, privileged EXEC, or diagnostic mode. enable [privilege-level] [view [view-name]] Syntax Description Defaults Privilege-level 15 (privileged EXEC) Command Modes User EXEC (>) Privileged EXEC (#) Diagnostic Mode (diag) Command History Usage Guidelines By default, using the enable command without the privilege-level argument in user EXEC mode causes the router to enter privileged EXEC mode (privilege-level 15). Entering privileged EXEC mode enables the use of privileged commands. Because many of the privileged commands set operating parameters, privileged access should be password-protected to prevent unauthorized use. If the system administrator has set a password with the enable password global configuration command, you are prompted to enter the password before being allowed access to privileged EXEC mode. The password is case sensitive. privilege-level (Optional) Privilege level at which to log in. view (Optional) Enters into root view, which enables users to configure CLI views. Note This keyword is required if you want to configure a CLI view. view-name (Optional) Enters or exits a specified command-line interface (CLI) view. This keyword can be used to switch from one CLI view to another CLI view. Release Modification 10.0 This command was introduced. 12.3(7)T The view keyword and view-name argument were added. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SRB The view keyword and view-name argument were integrated into Cisco IOS Release 12.2(33)SRB. 12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(22)SB. Cisco IOS XE Release 2.1 This command became available on the ASR 1000 Series Routers, and became available in diagnostic mode for the first time. enable CF-192 Cisco IOS Configuration Fundamentals Command Reference April 2010 If an enable password has not been set, only enable mode can be accessed through the console connection. Security levels can be set by an administrator using the enable password and privilege level commands. Up to 16 privilege levels can be specified, using the numbers 0 through 15. Using these privilege levels, the administrator can allow or deny access to specific commands. Privilege level 0 is associated with user EXEC mode, and privilege level 15 is associated with privileged EXEC mode. For more information on defined privilege levels, see the Cisco IOS Security Configuration Guide and the Cisco IOS Security Command Reference publications. If a level is not specified when entering the enable command, the user will enter the default mode of privileged EXEC (level 15). Accessing a CLI View CLI views restrict user access to specified CLI and configuration information. To configure and access CLI views, users must first enter into root view, which is accomplished via the enable view command (without the view-name argument). Thereafter, users are prompted for a password, which is the same password as the privilege level 15 password. The view-name argument is used to switch from one view to another view. To prevent dictionary attacks, a user is prompted for a password even if an incorrect view name is given. The user is denied access only after an incorrect view name and password are given. Examples In the following example, the user enters privileged EXEC mode (changes to privilege-level 15) by using the enable command without a privilege-level argument. The system prompts the user for a password before allowing access to the privileged EXEC mode. The password is not printed to the screen. The user then exits back to user EXEC mode using the disable command. Note that the prompt for user EXEC mode is the greater than symbol (>), and the prompt for privileged EXEC mode is the number sign (#). Router> enable Password: Router# disable Router> The following example shows which commands are available inside the CLI view “first” after the user has logged into this view: Router# enable view first Password: 00:28:23:%PARSER-6-VIEW_SWITCH:successfully set to view 'first'. Router# ? Exec commands: configure Enter configuration mode enable Turn on privileged commands exit Exit from the EXEC show Show running system information Router# show ? ip IP information parser Display parser information version System hardware and software status enable CF-193 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router# show ip ? access-lists List IP access lists accounting The active IP accounting database aliases IP alias table arp IP ARP table as-path-access-list List AS path access lists bgp BGP information cache IP fast-switching route cache casa display casa information cef Cisco Express Forwarding community-list List community-list dfp DFP information dhcp Show items in the DHCP database drp Director response protocol dvmrp DVMRP information eigrp IP-EIGRP show commands extcommunity-list List extended-community list flow NetFlow switching helper-address helper-address table http HTTP information igmp IGMP information irdp ICMP Router Discovery Protocol . . The following example shows how to use the enable view command to switch from the root view to the CLI view “first”: Router# enable view Router# 01:08:16:%PARSER-6-VIEW_SWITCH:successfully set to view 'root'. Router# ! Enable the show parser view command from the root view Router# show parser view Current view is 'root' ! Enable the show parser view command from the root view to display all views Router# show parser view all Views Present in System: View Name: first View Name: second ! Switch to the CLI view “first.” Router# enable view first Router# 01:08:09:%PARSER-6-VIEW_SWITCH:successfully set to view 'first'. ! Enable the show parser view command from the CLI view “first.” Router# show parser view Current view is 'first' Related Commands Command Description disable Exits from privileged EXEC mode to user EXEC mode, or, if privilege levels are set, to the specified privilege level. enable password Sets a local password to control access to various privilege levels. privilege level (global) Sets a privilege level for a command. privilege level (line) Sets a privilege level for a command for a specific line. end CF-194 Cisco IOS Configuration Fundamentals Command Reference April 2010 end To end the current configuration session and return to privileged EXEC mode, use the end command in global configuration mode. end Syntax Description This command has no arguments or keywords. Defaults No default behavior or values. Command Modes Global configuration Command History Usage Guidelines This command will bring you back to privileged EXEC mode regardless of what configuration mode or configuration submode you are in. Note This global configuration command can be used in any configuration mode. Use this command when you are done configuring the system and you want to return to EXEC mode to perform verification steps. Examples In the following example, the end command is used to exit from ALPS ASCU configuration mode and return to privileged EXEC mode. A show command is used in privileged EXEC mode to verify the configuration. Router# configure terminal Router(config)# interface serial 1:1 Router(config-if)# alps ascu 4B Router(config-alps-ascu)# end Router# show interface serial 1:1 Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description exit (global) Exits from the current configuration mode. environment-monitor shutdown temperature CF-195 Cisco IOS Configuration Fundamentals Command Reference April 2010 environment-monitor shutdown temperature To enable monitoring of the environment sensors, use the environment-monitor shutdown temperature command in global configuration mode. To disable monitoring of the environment sensors, use the no form of this command. environment-monitor shutdown temperature [rommon | powerdown] no environment-monitor shutdown temperature [rommon | powerdown] Syntax Description Defaults By default, rommon is enabled. Command Modes Global configuration Command History Examples This example shows how to place the supervisor engine in ROMMON when a major active alarm occurs: Router(config)# environment-monitor shutdown temperature rommon Router(config)# This example shows how to power down the supervisor engine when a major active alarm occurs: Router(config)# environment-monitor shutdown temperature powerdown Router(config)# rommon (Optional) Places the supervisor engine in ROMMON when a major active alarm is identified. powerdown (Optional) Powers down the supervisor engine when a new active major alarm is identified. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(18)SXF17 Support for powerdown keyword added. 12.2(33)SXH6 Support for powerdown keyword added. environment temperature-controlled CF-196 Cisco IOS Configuration Fundamentals Command Reference April 2010 environment temperature-controlled To enable the ambient temperature control, use the environment temperature-controlled command in global configuration mode. To disable the ambient temperature control, use the no form of this command. environment temperature-controlled no environment temperature-controlled Syntax Description This command has no arguments or keywords. Defaults This command has no default settings. Command Modes Global configuration Command History Usage Guidelines This command does not affect temperature monitoring and alarm thresholds; it only affects whether a module may be powered on. The software does not validate the inlet temperature. If you enter the no form of this command and the cooling capacity is reduced below the module cooling requirement, a syslog warning (and SNMP alarm) is generated. This module status does not change, and an environmental alarm is not raised when you enter the no form of this command. Examples This example shows how to enable the ambient temperature control: Router(config)# environment temperature-controlled Router(config)# This example shows how to disable the ambient temperature control: Router(config)# no environment temperature-controlled Router(config)# Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. erase CF-197 Cisco IOS Configuration Fundamentals Command Reference April 2010 erase To erase a file system or all files available on a file system, use the erase command in privileged EXEC or diagnostic mode. erase {/all nvram: | /no-squeeze-reserve-space | filesystem: | startup-config} Cisco 7600 Series Routers and Cisco ASR1000 Series Routers erase {/all nvram: | filesystem: | startup-config} Syntax Description Command Modes Privileged EXEC (#) Diagnostic (#) Command History Usage Guidelines The erase nvram: command replaces the write erase command and the erase startup-config command. Caution When you use the erase command to erase a file system, you cannot recover the files in the file system. The word help feature is disabled for the erase command. You must enter the complete command name to enable the command. The parser does not complete the command name if you enter partial syntax of the command and press the Tab key. For more information on the word help feature, refer to the Using the Cisco IOS Command-Line Interface feature guide. The erase command can be used on Class B and Class C flash file systems only. /all Erases all files in the specified file system. filesystem: File system name, followed by a colon. For example, flash: or nvram:. /no-squeeze-reserve-space Disables the squeeze operation to conserve memory and makes the erase command compatible with older file systems. startup-config Erases the contents of the configuration memory. Release Modification 11.0 This command was introduced. 12.2(11)T This command was modified. The /no-squeeze-reserve-space keyword was added. 12.2(14)SX This command was modified. Support for this command was added for the Supervisor Engine 720. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was modified. The command was introduced in diagnostic mode on the Cisco ASR 1000 Series Routers, and the /all keyword was added. erase CF-198 Cisco IOS Configuration Fundamentals Command Reference April 2010 Class A flash file systems cannot be erased. You can delete individual files using the delete command and then reclaim the space using the squeeze command. You can use the format command to format the flash file system. The format command when used on ATA disk clears the File Allocation Table (FAT) and root directory entries only. The data is not erased. The erase nvram: command erases NVRAM. On Class A file system platforms, if the CONFIG_FILE variable specifies a file in flash memory, the specified file will be marked “deleted.” The erase /all nvram: command erases all files on NVRAM, including private NVRAM. The /no-squeeze-reserve-space keyword is available on systems with small amounts of flash memory in order to conserve memory. When a squeeze operation is performed, the last two erase sectors are permanently reserved for the squeeze logs and squeeze buffer. The /no-squeeze-reserve-space keyword prevents the reservation of space that guarantees the ability to run the squeeze command. Disabling the squeeze operation keeps these memory sectors free. If any sectors using squeeze data are detected, they will be erased when the /no-squeeze-reserve-space keyword is used. The /no-squeeze-reserve-space keyword increases the available amount of usable flash space, but you may not be able to run the squeeze command. This is typically fine if the file system (such as flash) is used to store a single, large file. For example, an IOS image. On Class C flash file systems, space is dynamically reclaimed when you use the delete command. You can also use either the format or erase command to reinitialize a Class C flash file system. Note Use the context-sensitive help to determine which file systems can be used for the erase command. The output will vary based on the platform. Examples The following example shows how to erase the NVRAM, including the startup configuration located there: Router# erase nvram: The following example shows how to erase all of partition 2 in internal flash memory: Router# erase flash:2 System flash directory, partition 2: File Length Name/status 1 1711088 dirt/images/c3600-i-mz [1711152 bytes used, 15066064 available, 16777216 total] Erase flash device, partition 2? [confirm] Are you sure? [yes/no]: yes Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee ...erased The following example shows how to erase flash memory when flash is partitioned, but no partition is specified in the command: Router# erase flash: System flash partition information: Partition Size Used Free Bank-Size State Copy-Mode 1 4096K 2048K 2048K 2048K Read Only RXBOOT-FLH 2 4096K 2048K 2048K 2048K Read/Write Direct [Type ? for partition directory; ? for full directory; q to abort] Which partition? [default = 2] erase CF-199 Cisco IOS Configuration Fundamentals Command Reference April 2010 The system will prompt only if there are two or more read/write partitions. If the partition entered is not valid or is the read-only partition, the process terminates. You can enter a partition number, a question mark (?) for a directory display of all partitions, or a question mark and a number (?number) for directory display of a particular partition. The default is the first read/write partition. System flash directory, partition 2: File Length Name/status 1 3459720 master/igs-bfpx.100-4.3 [3459784 bytes used, 734520 available, 4194304 total] Erase flash device, partition 2? [confirm] Related Commands Command Description boot config Specifies the device and filename of the configuration file from which the router configures itself during initialization (startup). delete Deletes a file on a flash memory device. more nvram:startup-config Displays the startup configuration file contained in NVRAM or specified by the CONFIG_FILE environment variable. squeeze Removes all deleted files from the flash file system and recovers the memory space used by deleted files. show bootvar Displays the contents of the BOOT environment variable, the name of the configuration file pointed to by the CONFIG_FILE environment variable, the contents of the BOOTLDR environment variable, and the configuration register setting. undelete Recovers a file marked “deleted” on a Class A or Class B flash file system. write erase The write erase command is replaced by the erase nvram: command. See the description of the erase command for more information erase bootflash CF-200 Cisco IOS Configuration Fundamentals Command Reference April 2010 erase bootflash The erase bootflash: and erase bootflash commands have identical functions. See the description of the erase command in this chapter for more information. errdisable detect cause CF-201 Cisco IOS Configuration Fundamentals Command Reference April 2010 errdisable detect cause To enable the error-disable detection, use the errdisable detect cause command in global configuration mode. To disable the error-disable detection, use the no form of this command. errdisable detect cause {all | dtp-flap | l2ptguard | link-flap | packet-buffer-error | pagp-flap | udld} no errdisable detect cause {all | dtp-flap | l2ptguard | link-flap | pagp-flap | udld} Syntax Description Defaults Enabled for all causes Command Modes Global configuration Command History Usage Guidelines Note Entering the no errdisable detect cause packet-buffer-error command allows you to detect the fault that triggers a power cycle of the affected module. A cause (bpduguard, dtp-flap, link-flap, pagp-flap, root-guard, udld) is defined as the reason why the error-disabled state occurred. When a cause is detected on an interface, the interface is placed in an error-disabled state (an operational state that is similiar to the link-down state). You must enter the shutdown and then the no shutdown commands to recover an interface manually from the error-disable state. all Specifies error-disable detection for all error-disable causes. dtp-flap Specifies detection for the DTP flap error-disable cause. l2ptguard Specifies detection for the Layer 2 protocol-tunnel error-disable cause. link-flap Specifies detection for the link flap error-disable cause. packet-buffer-error Causes the packet buffer error to error-disable the affected port. pagp-flap Specifies detection for the PAgP flap error-disable cause. udld Specifies detection for the UDLD error-disable cause. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17b)SXA This command was changed to include the packet-buffer-error keyword. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. errdisable detect cause CF-202 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples This example shows how to enable the error-disable detection for the Layer 2 protocol-tunnel guard error-disable cause: Router(config)# errdisable detect cause l2ptguard Router(config)# Related Commands Command Description show errdisable detect Displays the error-disable detection status. show interfaces status Displays the interface status or a list of interfaces in an error-disabled state on LAN ports only. errdisable recovery CF-203 Cisco IOS Configuration Fundamentals Command Reference April 2010 errdisable recovery To configure the recovery mechanism variables, use the errdisable recovery command in global configuration mode. To return to the default state, use the no form of this command. errdisable recovery {cause {all | arp-inspection | bpduguard | channel-misconfig | dhcp-rate-limit | dtp-flap | gbic-invalid | l2ptguard | link-flap | pagp-flap | psecure-violation | security-violation | udld | unicast-flood} | interval interval} no errdisable recovery {cause {all | arp-inspection | bpduguard | channel-misconfig | dhcp-rate-limit | dtp-flap | gbic-invalid | l2ptguard | link-flap | pagp-flap | psecure-violation | security-violation | udld | unicast-flood} | interval interval} Syntax Description Command Default The recovery mechanisms are disabled. Command Modes Global configuration Command History cause Enables error-disable recovery from a specific cause. all Enables the recovery timers for all error-disable causes. arp-inspection Enables error-disable recovery from an ARP inspection cause. bpduguard Enables the recovery timer for the BPDU-guard error-disable cause. channel-misconfig Enables the recovery timer for the channel-misconfig error-disable cause. dhcp-rate-limit Enables the recovery timer for the DHCP-rate-limit error-disable cause. dtp-flap Enables the recovery timer for the DTP-flap error-disable cause. gbic-invalid Enables the recovery timer for the GBIC-invalid error-disable cause. l2ptguard Enables the recovery timer for the L2PT error-disable cause. link-flap Enables the recovery timer for the link-flap error-disable cause. pagp-flap Enables the recovery timer for the PAgP-flap error-disable cause. psecure-violation Enables the recovery timer for the psecure-violation error-disable cause. security-violation Enables the automatic recovery of ports that were disabled because of 802.1X security violations. udld Enables the recovery timer for the UDLD error-disable cause. unicast-flood Enables the recovery timer for the unicast-flood error-disable cause. interval interval Specifies the time, in seconds, to recover from a specified error-disable cause. Range: 30 to 86400. Default: 300. Release Modification 12.2(14)SX This command was introduced on the Supervisor Engine 720. 12.2(17d)SXB This command was implemented on the Supervisor Engine 2. 12.2(18)SXD The arp-inspection keyword was added. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. errdisable recovery CF-204 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines A cause (bpduguard, channel-misconfig, dhcp-rate-limit, dtp-flap, l2ptguard, link-flap, pagp-flap, psecure-violation, security-violation, udld, or unicast-flood) is defined as the reason why the error-disabled state occurred. When a cause is detected on an interface, the interface is placed in an error-disabled state (an operational state that is similar to the link-down state). If you do not enable error-disable recovery for the cause, the interface stays in the error-disabled state until a shutdown and no shutdown occurs. If you enable recovery for a cause, the interface is brought out of the error-disabled state and allowed to retry operation once all the causes have timed out. You must enter the shutdown command and then the no shutdown command to manually recover an interface from the error-disabled state. Note Each time you want enter the errdisable recovery cause command to add a new reason for recovery, it takes up a separate line; each new reason does not get appended to the original single line. This means you must enter each new reason separately. Examples This example shows how to enable the recovery timer for the BPDU-guard error-disable cause: Router(config)# errdisable recovery cause bpduguard This example shows how to set the recovery timer to 300 seconds: Router(config)# errdisable recovery interval 300 Related Commands Command Description show errdisable recovery Displays the information about the error-disable recovery timer. show interfaces status Displays the interface status or a list of interfaces in an error-disabled state on LAN ports only. escape-character CF-205 Cisco IOS Configuration Fundamentals Command Reference April 2010 escape-character To define a system escape character, use the escape-character command in line configuration mode. To set the escape character to Break, use the no or default form of this command. escape-character {break | char | default | none | soft} no escape-character [soft] default escape-character [soft] Syntax Description Defaults The default escape key sequence is Ctrl-Shift-6 (Ctrl-^) or Ctrl-Shift-6, X (^^X). The X is generally only required for modem connections. The default escape-character command sets the escape character to Break (the default setting for Break is Ctrl-C). Command Modes Line configuration Command History Usage Guidelines See the “ASCII Character Set and Hexidecimal Values” appendix for a list of ASCII characters. The escape character (or key sequence) suspends any actively running processes and returns you to privileged EXEC mode or, if a menu is being used, to the system menu interface. The escape character is used for interrupting or aborting a process started by previously executed command. Examples of processes from which you can escape include Domain-Name lookup, ping, trace, and Telnet sessions initiated from the device to which you are connected. To view the current setting of the escape sequence for a line, use the show line command followed by the specific line identifier (for example, show line 0, or show line console). The default escape sequence for a line is often displayed as ^^X . The first caret symbol represents the Control (Ctrl) key, the second caret symbol is literal (Shift-6), and the X is literal (for most systems, the X is not required). break Sets the escape character to Break. Note that the Break key should not be used as an escape character on a console terminal. char Character (for example, !) or its ASCII decimal representation (integer in the range of 0 to 255) to be used as the escape character. default Sets the escape key sequence to the default of Ctrl-^, X. none Disables escape entirely. soft Sets an escape character that will wait until pending input is processed before it executes. Release Modification 10.0 This command was introduced. 11.3 The soft keyword was added. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. escape-character CF-206 Cisco IOS Configuration Fundamentals Command Reference April 2010 To set the escape key for the active terminal line session, use the terminal escape-character command. The Break key cannot be used as an escape character on a console terminal because the Cisco IOS software interprets Break as an instruction to halt the system. Depending upon the configuration register setting, break commands issued from the console line either will be ignored or cause the server to shut down. To send an escape sequence over a Telnet connection, press Ctrl-Shift-6 twice. The escape-character soft form of this command defines a character or character sequence that will cause the system to wait until pending input is processed before suspending the current session. This option allows you to program a key sequence to perform multiple actions, such as using the F1 key to execute a command, then execute the escape function after the first command is executed. The following restrictions apply when using the soft keyword: • The length of the logout sequence must be 14 characters or fewer. • The soft escape character cannot be the same as the generic Cisco escape character, Break, or the characters b, d, n, or s. • The soft escape character should be an ASCII value from 1 to 127. Do not use the number 30. Examples The following example sets the escape character for the console line to the keyboard entry Ctrl-P, which is represented by the ASCII decimal value of 16: Router(config)# line console Router(config-line)# escape-character 16 The following example sets the escape character for line 1 to !, which is represented in the configuration file as the ASCII number 33: Router(config)# line 1 Router(config-line)# escape-character ! Router(config-line)# end Router# show running-config Building configuration... . . . line 1 autoselect during-login autoselect ppp modem InOut transport preferred none transport output telnet escape-character 33 Related Commands Command Description show line Displays information about the specified line connection, or all the lines. terminal escape-character Sets the escape character for the current terminal line for the current session. exec CF-207 Cisco IOS Configuration Fundamentals Command Reference April 2010 exec To allow an EXEC process on a line, use the exec command in line configuration mode. To turn off the EXEC process for the specified line, use the no form of this command. exec no exec Syntax Description This command has no arguments or keywords. Defaults The EXEC processes is enabled on all lines. Command Modes Line configuration Command History Usage Guidelines When you want to allow only an outgoing connection on a line, use the no exec command. The no exec command allows you to disable the EXEC process for connections which may attempt to send unsolicited data to the router. (For example, the control port of a rack of modems attached to an auxiliary port of router.) When certain types of data are sent to a line connection, an EXEC process can start, which makes the line unavailable. When a user tries to Telnet to a line with the EXEC process disabled, the user will get no response when attempting to log on. Examples The following example disables the EXEC process on line 7. Router(config)# line 7 Router(config-line)# no exec Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. exec-banner CF-208 Cisco IOS Configuration Fundamentals Command Reference April 2010 exec-banner To reenable the display of EXEC and message-of-the-day (MOTD) banners on the specified line or lines, use the exec-banner command in line configuration mode. To suppress the banners on the specified line or lines, use the no form of this command. exec-banner no exec-banner Syntax Description This command has no arguments or keywords. Defaults Enabled on all lines Command Modes Line configuration Command History Usage Guidelines This command determines whether the router will display the EXEC banner and the message-of-the-day (MOTD) banner when an EXEC session is created. These banners are defined with the banner exec and banner motd global configuration commands. By default, these banner are enabled on all lines. Disable the EXEC and MOTD banners using the no exec-banner command. This command has no effect on the incoming banner, which is controlled by the banner incoming command. The MOTD banners can also be disabled by the no motd-banner line configuration command, which disables MOTD banners on a line. If the no exec-banner command is configured on a line, the MOTD banner will be disabled regardless of whether the motd-banner command is enabled or disabled. Table 30 summarizes the effects of the exec-banner command and the motd-banner command. For reverse Telnet connections, the EXEC banner is never displayed. Instead, the incoming banner is displayed. The MOTD banner is displayed by default, but it is disabled if either the no exec-banner command or no motd-banner command is configured. Table 31 summarizes the effects of the exec-banner command and the motd-banner command for reverse Telnet connections. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 30 Banners Displayed Based On exec-banner and motd-banner Combinations exec-banner (default) no exec-banner motd-banner (default) MOTD banner EXEC banner None no motd-banner EXEC banner None exec-banner CF-209 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example suppresses the EXEC and MOTD banners on virtual terminal lines 0 to 4: Router(config)# line vty 0 4 Router(config-line)# no exec-banner Related Commands Table 31 Banners Displayed Based On exec-banner and motd-banner Combinations for Reverse Telnet Sessions to Async Lines exec-banner (default) no exec-banner motd-banner (default) MOTD banner Incoming banner Incoming banner no motd-banner Incoming banner Incoming banner Command Description banner exec Defines and enables a customized banner to be displayed whenever the EXEC process is initiated. banner incoming Defines and enables a customized message to be displayed when there is an incoming connection to a terminal line from a host on the network. banner motd Defines and enables a customized message-of-the-day banner. motd-banner Controls (enables or disables) the display of message-of-the-day banners on a specified line or lines. exec-character-bits CF-210 Cisco IOS Configuration Fundamentals Command Reference April 2010 exec-character-bits To configure the character widths of EXEC and configuration command characters, use the exec-character-bits command in line configuration mode. To restore the default value, use the no form of this command. exec-character-bits {7 | 8} no exec-character-bits Syntax Description Defaults 7-bit ASCII character set Command Modes Line configuration Command History Usage Guidelines Setting the EXEC character width to 8 allows you to use special graphical and international characters in banners, prompts, and so on. However, setting the EXEC character width to 8 bits can cause failures. If a user on a terminal that is sending parity enters the help command, an “unrecognized command” message appears because the system is reading all 8 bits, and the eighth bit is not needed for the help command. Note If you are using the autoselect function, set the activation character to the default (Return) and the value for exec-character-bits to 7. If you change these defaults, the application will not recognize the activation request. Examples The following example enables full 8-bit international character sets, except for the console, which is an ASCII terminal. It illustrates use of the default-value exec-character-bits global configuration command and the exec-character-bits line configuration command. Router(config)# default-value exec-character-bits 8 Router(config)# line 0 Router(config-line)# exec-character-bits 7 7 Selects the 7-bit character set. This is the default. 8 Selects the full 8-bit character set for use of international and graphical characters in banner messages, prompts, and so on. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. exec-character-bits CF-211 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description default-value exec-character-bits Defines the EXEC character width for either 7 bits or 8 bits. default-value special-character-bits Configures the flow control default value from a 7-bit width to an 8-bit width. length Sets the terminal screen length. terminal exec-character-bits Locally changes the ASCII character set used in EXEC and configuration command characters for the current session. terminal special-character-bits Changes the ASCII character widths to accept special characters for the current terminal line and session. exec-timeout CF-212 Cisco IOS Configuration Fundamentals Command Reference April 2010 exec-timeout To set the interval that the EXEC command interpreter waits until user input is detected, use the exec-timeout command in line configuration mode. To remove the timeout definition, use the no form of this command. exec-timeout minutes [seconds] no exec-timeout Syntax Description Defaults 10 minutes Command Modes Line configuration Command History Usage Guidelines If no input is detected during the interval, the EXEC facility resumes the current connection. If no connections exist, the EXEC facility returns the terminal to the idle state and disconnects the incoming session. To specify no timeout, enter the exec-timeout 0 0 command. Examples The following example sets a time interval of 2 minutes, 30 seconds: Router(config)# line console Router(config-line)# exec-timeout 2 30 The following example sets a time interval of 10 seconds: Router(config)# line console Router(config-line)# exec-timeout 0 10 minutes Integer that specifies the number of minutes. The default is 10 minutes. seconds (Optional) Additional time intervals in seconds. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. execute-on CF-213 Cisco IOS Configuration Fundamentals Command Reference April 2010 execute-on To execute commands on a line card, use the execute-on command in privileged EXEC mode. execute-on {slot slot-number | all | master} command Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Use this command to execute a command on one or all line cards to monitor and maintain information on one or more line cards (for example, a line card in a specified slot on a dial shelf). This allows you to issue commands remotely; that is, to issue commands without needing to log in to the line card directly. The all form of the command allows you to issue commands to all the line cards without having to log in to each in turn. Though this command does not have a no form, note that it is possible to use the no form of the remotely executed commands used in this command. Tip This command is useful when used with show EXEC commands (such as show version), because you can verify and troubleshoot the features found only on a specific line card. Please note, however, that because not all statistics are maintained on the line cards, the output from some of the show commands might not be consistent. Cisco 12000 GSR Guidelines and Restrictions You can use the execute-on privileged EXEC command only from Cisco IOS software running on the GRP card. slot slot-number Executes the command on the line card in the specified slot. Slot numbers can be chosen from the following ranges: • Cisco 12012 router: 0 to 11 • Cisco 12008 access server: 0 to 7 • Cisco AS5800 access server: 0 to 13 all Executes the command on all line cards. master (AS5800 only) Executes the designated command on a Dial Shelf Controller (DSC). Do not use this option; it is used for technical support troubleshooting only. command Cisco IOS command to remotely execute on the line card. Release Modification 11.2 GS This command was introduced to support Cisco 12000 series Gigabit Switch Routers. 11.3(2)AA This command was implemented in images for the Cisco AS5800 series. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. execute-on CF-214 Cisco IOS Configuration Fundamentals Command Reference April 2010 Timesaver Though you can use the attach privileged EXEC command to execute commands on a specific line card, using the execute-on slot command saves you some steps. For example, first you must use the attach command to connect to the Cisco IOS software running on the line card. Next you must issue the command. Finally you must disconnect from the line card to return to the Cisco IOS software running on the GRP card. With the execute-on slot command, you can perform three steps with one command. In addition, the execute-on all command allows you to perform the same command on all line cards simultaneously. Cisco AS5800 Guidelines and Restrictions The purpose of the command is to conveniently enable certain commands to be remotely executed on the dial shelf cards from the router without connecting to each line card. This is the recommended procedure, because it avoids the possibility of adversely affecting a good configuration of a line card in the process. The execute-on command does not give access to every Cisco IOS command available on the Cisco AS5800 access server. In general, the purpose of the execute-on command is to provide access to statistical reports from line cards without directly connecting to the dial shelf line cards. Caution Do not use this command to change configurations on dial shelf cards, because such changes will not be reflected in the router shelf. Using this command makes it possible to accumulate inputs for inclusion in the show tech-support command. The master form of the command can run a designated command remotely on the router from the DSC card. However, using the console on the DSC is not recommended. It is used for technical support troubleshooting only. The show tech-support command for each dial shelf card is bundled into the router shelf's show tech-support command via the execute-on facility. The execute-on command also support interactive commands such as the following: router: execute-on slave slot slot ping The execute-on command has the same limitations and restrictions as a vty telnet client has; that is, it cannot reload DSC using the following command: router: execute-on slave slot slot reload You can use the execute-on command to enable remote execution of the commands included in the following partial list: • debug dsc clock • show context • show diag • show environment • show dsc clock • show dsi • show dsip • show tech-support execute-on CF-215 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, the user executes the show controllers command on the line card in slot 4 of a Cisco 12000 series GSR: Router# execute-on slot 4 show controllers ========= Line Card (Slot 4) ======= Interface POS0 Hardware is BFLC POS lcpos_instance struct 6033A6E0 RX POS ASIC addr space 12000000 TX POS ASIC addr space 12000100 SUNI framer addr space 12000400 SUNI rsop intr status 00 CRC16 enabled, HDLC enc, int clock no loop Interface POS1 Hardware is BFLC POS lcpos_instance struct 6033CEC0 RX POS ASIC addr space 12000000 TX POS ASIC addr space 12000100 SUNI framer addr space 12000600 SUNI rsop intr status 00 CRC32 enabled, HDLC enc, int clock no loop Interface POS2 Hardware is BFLC POS lcpos_instance struct 6033F6A0 RX POS ASIC addr space 12000000 TX POS ASIC addr space 12000100 SUNI framer addr space 12000800 SUNI rsop intr status 00 CRC32 enabled, HDLC enc, int clock no loop Interface POS3 Hardware is BFLC POS lcpos_instance struct 60341E80 RX POS ASIC addr space 12000000 TX POS ASIC addr space 12000100 SUNI framer addr space 12000A00 SUNI rsop intr status 00 CRC32 enabled, HDLC enc, ext clock no loop Router# Related Commands Command Description attach Connects you to a specific line card for the purpose of executing commands using the Cisco IOS software image on that line card. exit (EXEC) CF-216 Cisco IOS Configuration Fundamentals Command Reference April 2010 exit (EXEC) To close an active terminal session by logging off the router, use the exit command in EXEC mode. exit Syntax Description This command has no arguments or keywords. Defaults No default behavior or values Command Modes EXEC Command History Usage Guidelines Use the exit command in EXEC mode to exit the active session (log off the device). This command can be used in any EXEC mode (such as User EXEC mode or Privileged EXEC mode) to exit from the EXEC process. Examples In the following example, the exit (global) command is used to move from global configuration mode to privileged EXEC mode, the disable command is used to move from privileged EXEC mode to user EXEC mode, and the exit (EXEC) command is used to log off (exit the active session): Router(config)# exit Router# disable Router> exit Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description disconnect Disconnects a line. end Ends your configuration session by exiting to EXEC mode. exit (global) Exits from the current configuration mode to the next highest configuration mode. logout Closes your connection to the device (equivilant to the exit command). exit (global) CF-217 Cisco IOS Configuration Fundamentals Command Reference April 2010 exit (global) To exit any configuration mode to the next highest mode in the CLI mode hierarchy, use the exit command in any configuration mode. exit Syntax Description This command has no arguments or keywords. Defaults No default behavior or values Command Modes All configuration modes Command History Usage Guidelines The exit command is used in the Cisco IOS CLI to exit from the current command mode to the next highest command mode in the CLI mode hierarchy. For example, use the exit command in global configuration mode to return to privileged EXEC mode. Use the exit command in interface, line, or router configuration mode to return to global configuration mode. Use the exit command in subinterface configuration mode to return to interface configuration mode. At the highest level, EXEC mode, the exit command will exit the EXEC mode and disconnect from the router interface (see the description of the exit (EXEC) command for details). Examples The following example shows how to exit from the subinterface configuration mode and to return to the interface configuration mode: Router(config-subif)# exit Router(config-if)# The following example displays an exit from the interface configuration mode to return to the global configuration mode: Router(config-if)# exit Router(config)# Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description disconnect Disconnects a line. end Ends your configuration session by exiting to privileged EXEC mode. exit (EXEC) Closes the active terminal session by logging off the router. file prompt CF-218 Cisco IOS Configuration Fundamentals Command Reference April 2010 file prompt To specify the level of prompting, use the file prompt command in global configuration mode. file prompt [alert | noisy | quiet] Syntax Description Defaults alert Command Modes Global configuration Command History Usage Guidelines Use this command to change the amount of confirmation needed for different file operations. This command affects only prompts for confirmation of operations. The router will always prompt for missing information. Examples The following example configures confirmation prompting for all file operations: Router(config)# file prompt noisy alert (Optional) Prompts only for destructive file operations. This is the default. noisy (Optional) Confirms all file operation parameters. quiet (Optional) Seldom prompts for file operations. Release Modification 11.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. file verify auto CF-219 Cisco IOS Configuration Fundamentals Command Reference April 2010 file verify auto To enable automatic image verification, use the file verify auto command in global configuration mode. To disable automatic image verification, use the no form of this command. file verify auto no file verify auto Syntax Description This command has no arguments or keywords. Defaults Image verification is not automatically applied to all images that are copied or reloaded onto a router. Command Modes Global configuration Command History Usage Guidelines Image verification is accomplished by verifying the compressed Cisco IOS image checksum. Image verification allows users to automatically verify the integrity of all Cisco IOS images. Thus, users can be sure that the image is protected from accidental corruption, which can occur at any time during transit, starting from the moment the files are generated by Cisco until they reach the user. The file verify auto command enables image verification globally; that is, all images that are to be copied (via the copy command) or reloaded (via the reload command) are automatically verified. Although both the copy and reload commands have a /verify keyword that enables image verification, you must issue the keyword each time you want to copy or reload an image. The file verify auto command enables image verification by default so you no longer have to specify image verification multiple times. If you have enabled image verification by default but prefer to disable verification for a specific image copy or reload, the /noverify keyword along with either the copy or the reload command will override the file verify auto command. Examples The following example shows how to enable automatic image verification: Router(config)# file verify auto Release Modification 12.2(18)S This command was introduced. 12.0(26)S This command was integrated into Cisco IOS Release 12.0(26)S. 12.2(14)SX This command was integrated into Cisco IOS Release 12.2(14)SX and implemented on the Supervisor Engine 720. 12.2(17d)SXB Support was added for the Supervisor Engine 2. 12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. file verify auto CF-220 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description copy Copies any file from a source to a destination. copy/noverify Disables the automatic image verification for the current copy operation. reload Reloads the operating system. verify Verifies the checksum of a file on a Flash memory file system or computes an MD5 signature for a file. format CF-221 Cisco IOS Configuration Fundamentals Command Reference April 2010 format To format a Class A, Class B, or Class C flash memory file system, use the format command in privileged EXEC or diagnostic mode. Class B and Class C Flash File Systems format filesystem1: Class A Flash File System format [spare spare-number] filesystem1: [[filesystem2:][monlib-filename]] Syntax Description Command Default spare-number: 0 monlib-filename: The monlib file bundled with the system software Command Modes Privileged EXEC (#) Diagnostic (diag) spare (Optional) Reserves spare sectors as specified by the spare-number argument when you format flash memory. spare-number (Optional) Number of the spare sectors to reserve in formatted flash memory. Valid values are from 0 to 16. The default value is 0. filesystem1: Flash memory to format, followed by a colon. Valid values for use with the Cisco 7600 series router are disk0:, disk1:, bootflash:, slot0:, sup-slot0:, and sup-bootflash:; see the “Usage Guidelines” section for additional information. Valid values for use with the ASR1000 Series Routers are bootflash:, harddisk:, stby-harddisk:, obfl:, and usb[0-1];. filesystem2: (Optional) File system containing the monlib file to use for formatting the argument filesystem1 followed by a colon. monlib-filename (Optional) Name of the ROM monitor library file (monlib file) to use for formatting the filesystem1 argument. The default monlib file is the one bundled with the system software. Dual Route Switch Processors (RSP) High System Availability (HSA) Functionality When this command is used with Dual RSPs and you do not specify the monlib-filename argument, the system takes the ROM monitor library file from the slave image bundle. If you specify the monlib-filename argument, the system assumes that the files reside on the slave devices. format CF-222 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command History Usage Guidelines Reserve a certain number of memory sectors as spares, so that if some sectors fail, most of the flash memory card can still be used. Otherwise, you must reformat the flash card after some of the sectors fail. Use this command to format Class A, B, or C flash memory file systems. The Cisco 7600 series router supports only Class A and Class C flash file systems. In some cases, you might need to insert a new Personal Computer Memory Card Industry Association (PCMCIA) flash memory or flash PC card and load images or backup configuration files onto it. Before you can use a new flash memory or flash PC card, you must format it. Sectors in flash memory or flash PC cards can fail. Reserve certain flash memory or flash PC sectors as “spares” by using the optional spare-number argument on the format command to specify 0 to 16 sectors as spares. If you reserve a small number of spare sectors for emergencies, you can still use most of the flash memory or flash PC card. If you specify 0 spare sectors and some sectors fail, you must reformat the flash memory or flash PC card, thereby erasing all existing data. The monlib file is the ROM monitor library. The ROM monitor uses this file to access files in the flash file system. The Cisco IOS system software contains a monlib file. Use the show disk0: all command to display monlib file details. When this command is used with HSA and you do not specify the monlib-filename argument, the system takes the ROM monitor library file from the slave image bundle. If you specify the monlib-filename argument, the system assumes that the files reside on the slave devices. In the command syntax, the filesystem1: argument specifies the device to format and the filesystem2: argument specifies the optional device containing the monlib file used to format the filesystem1: argument. The device determines which monlib file to use, as follows: • If you omit the optional filesystem2: and monlib-filename arguments, the system formats the filesystem1: argument using the monlib file already bundled with the system software. • If you omit only the optional filesystem2: argument, the system formats the filesystem1: argument using the monlib file from the device you specified with the cd command. • If you omit only the optional monlib-filename argument, the system formats filesystem1: using the filesystem2: monlib file. Release Modification 11.0 This command was introduced. 12.2(14)SX Support for this command was added for the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.3(14)T Support for Class B Flash (USB Flash and USB eToken) File Systems was added as part of the “USB Storage” feature. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR1000 Series Routers and the following enhancements were introduced: • This command was introduced in diagnostic mode for the first time. The command can be entered in both privileged EXEC and diagnostic mode on the Cisco ASR1000 Series Routers. • The harddisk:, obfl:, stby-harddisk:, stby-usb[0-1]: and usb[0-1]: filesystem1: options were introduced. format CF-223 Cisco IOS Configuration Fundamentals Command Reference April 2010 • When you specify both arguments—filesystem2: and monlib-filename—the system formats the filesystem1: argument using the monlib file from the specified device. • You can specify the filesystem1: arguments’s own monlib file in this argument. If the system cannot find a monlib file, it terminates its formatting. Note Most platforms do not support booting from images stored on flash memory cards. You should reboot your device only from integrated memory locations, such as NVRAM. Cisco 7600 Series Router Notes The bootflash:, slot0:, sup-slot0:, and sup-bootflash: keywords are supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2. Use the format command to format Class A or C flash memory file systems. • The disk0: and disk1: keywords are for Class C file systems. • The bootflash:, slot0:, sup-slot0:, and sup-bootflash: keywords are for Class A file systems. The disk0: keyword is supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2 only. Cisco ASR 1000 Series Routers Notes This command is available in both privileged EXEC and diagnostic mode on the Cisco ASR1000 Series Routers. Examples The following example shows how to format a flash memory card that is inserted in slot 0: Router# format slot0: Running config file on this device, proceed? [confirm] y All sectors will be erased, proceed? [confirm] y Enter volume id (up to 31 characters): Formatting sector 1 (erasing) Format device slot0 completed When the console returns to the EXEC prompt, the new flash memory card is formatted and ready for use. This example shows how to format a CompactFlash PC card that is inserted in slot 0: Router# format disk0: Running config file on this device, proceed? [confirm] y All sectors will be erased, proceed? [confirm] y Enter volume id (up to 31 characters): Formatting sector 1 (erasing) Format device disk0 completed When the console returns to the EXEC prompt, the new CompactFlash PC card is formatted and ready for use. Related Commands Command Description cd Changes the default directory or file system. copy Copies any file from a source to a destination. format CF-224 Cisco IOS Configuration Fundamentals Command Reference April 2010 delete Deletes a file on a flash memory device. show disk0: all Displays ATA MONLIB file information for disk0. show file systems Lists available file systems. squeeze Permanently deletes flash files by squeezing a Class A flash file system. undelete Recovers a file marked “deleted” on a Class A or Class B flash file system. Command Description fsck CF-225 Cisco IOS Configuration Fundamentals Command Reference April 2010 fsck To check a File Allocation Table (FAT)-based disk, a flash file system, or a Class C file system for damage and to repair any problems, use the fsck command in privileged EXEC or diagnostic mode. Supported Platforms Other than the Cisco 7600 Series and Cisco ASR1000 Series Routers fsck [/nocrc] [/automatic] [/all] [/force] [filesystem:] Cisco 7600 Series Routers fsck [/automatic] [/all] [/force] [filesystem:] Cisco ASR 1000 Series Routers fsck [/all] [/force] [filesystem:] Syntax Description Command Default A FAT-based disk, flash file system, or Class C file system is not checked for damage and repaired. If you do not enter the /automatic keyword, command-line interface (CLI) prompts for actions are issued. For the Cisco 7600 series router, if you do not specify the disk0: keyword, the current file system is checked. This command is available in both privileged EXEC and diagnostic mode on the Cisco ASR1000 series routers. Command Modes Privileged EXEC (#) Diagnostic (diag) /nocrc (Optional) This keyword is available for Class C flash file systems only. Omits cyclic redundancy checks (CRCs). /automatic (Optional) This keyword is available for Advanced Technology Attachment (ATA) FAT-based disks only. Specifies that the check and repair actions should proceed automatically. This option can be used to skip the prompts for each check and repair action. Note This command also specifies the automatic mode for the Cisco 7600 series router; see the “Usage Guidelines” section for additional information. /all (Optional) Specifies that all partitions on the disk be checked for problems. /force (Optional) Ensures forced termination of simultaneous file operations on the same device. filesystem: The file system prefix indicating the disk to be checked. The colon (:) is required. Typically, the file system prefix will be disk0: or disk1:. In case of dual processors, the file system on the redundant supervisor engine can also be specified. fsck CF-226 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command History Usage Guidelines Supported Platforms Other than Cisco 7600 Series Router This command performs all steps necessary to remove corrupted files and reclaim unused disk space. Changes include checking for incorrect file sizes, cluster loops, and so on. The default form of this command issues multiple prompts to confirm each of the changes. However, you can skip these prompts by using the /automatic keyword when issuing the command. When you use the /automatic keyword you are prompted to confirm that you want the automatic option. Prompts for actions will be skipped, but all actions performed are displayed to the terminal (see the example below). This command works with ATA Personal Computer Memory Card Industry Association (PCMCIA) cards formatted in Disk Operating System (DOS), or for Class C flash file systems. Note Only one partition (the active partition) is checked in the ATA disk. Cisco 7600 Series Router The disk0: or slavedisk0: file systems are the only file systems in the Cisco 7600 series routers on which you can run the File-System-Check (fsck) utility. The slavedisk0: file system appears in redundant supervisor engine systems only. This command is valid only on Class C flash file systems and only on PCMCIA ATA flash disks and CompactFlash disks. The output for the fsck slavedisk0: command is similar to the fsck disk0: command output. If you do not enter any arguments, the current file system is used. Use the pwd command to display the current file system. Release Modification 11.3 AA This command was introduced. 12.0(22)S This command was implemented on the Cisco 7000 family of routers and on the Cisco 10000 series router and the Gigabit Switch Router (GSR) to support ATA disks. 12.2(13)T This command was integrated into Cisco IOS Release 12.2(13)T. 12.2(14)SX This command was modified. Support for this command was added for the Supervisor Engine 720. 12.2(17d)SXB This command was modified. Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Routers and the following enhancements were introduced: • This command was introduced in diagnostic mode for the first time. The command can be entered in both privileged EXEC and diagnostic mode on the Cisco ASR 1000 series routers. • The /all option was introduced. • The harddisk:, obfl:, stby-harddisk:, stby-usb[0-1]:,and usb[0-1]: filesystem: options were introduced. 15.0(1)M This command was modified. The /force keyword was added. fsck CF-227 Cisco IOS Configuration Fundamentals Command Reference April 2010 If you enter the disk0: or slavedisk0: keyword, the fsck utility checks the selected file system for problems. If a problem is detected, a prompt is displayed asking if you want the problem fixed. If you enter the /automatic keyword, you are prompted to confirm that you want the automatic mode. In automatic mode, problems are fixed automatically and you are not prompted to confirm. If you do not specify the /force keyword, any simultaneous file operations on the same device are not terminated. Instead, an error message stating files are open for read or write access appears. If you specify the /force keyword, the fsck utility terminates files that are open for read or write access and continues to check for problems. Table 32 lists the checks and actions that are performed by the fsck utility. Table 32 fsck Utility Checks and Actions Checks Actions Checks the boot sector and the partition table and reports the errors. No action. Validates the media with the signature in the last 2 bytes of the first sector (0x55 and 0xaa, respectively). No action. Checks the os_id to find whether this is a FAT-12 or FAT-16 file system (valid values include 0, 1, 4, and 6). No action. Checks the number of FAT’s field (correct values are 1 and 2). No action. Checks these values: • n_fat_sectors cannot be less than 1. • n_root_entries cannot be less than 16. • n_root_sectors cannot be less than 2. • base_fat_sector, n_sectors_per_cluster, n_heads, n_sectors_per_track is not 0. No action. Checks the files and FAT for these errors: Checks the FAT for invalid cluster numbers. If the cluster is a part of a file chain, the cluster is changed to end of file (EOF). If the cluster is not part of a file chain, it is added to the free list and unused cluster chain. Table 33 lists valid cluster numbers; numbers other than those listed in Table 33 are invalid numbers. Checks the file’s cluster chain for loops. If the loop is broken, the file is truncated at the cluster where the looping occurred. Checks the directories for nonzero size fields. If directories are found with nonzero size fields, the size is reset to zero. Checks for invalid start cluster file numbers. If the start cluster number of a file is invalid, the file is deleted. Checks files for bad or free clusters. If the file contains bad or free clusters, the file is truncated at the last good cluster; an example is the cluster that points to this bad/free cluster. Checks to see if the file’s cluster chain is longer than indicated by the size fields. If the file’s cluster chain is longer than indicated by the size fields, the file size is recalculated and the directory entry is updated. fsck CF-228 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 33 lists the valid cluster numbers. Numbers other than those listed in Table 33 are invalid numbers. Examples Supported Platforms Other than the Cisco 7600 Series Router The following example shows sample output from the fsck command in automatic mode: Router# fsck /automatic disk1: Proceed with the automatic mode? [yes] y Checking the boot sector and partition table... Checking FAT, Files and Directories... Start cluster of file disk1:/file1 is invalid, removing file File disk1:/file2 has a free/bad cluster, truncating... File disk1:/file2 truncated. File disk1:/file3 has a free/bad cluster, truncating... File disk1:/file3 truncated. File disk1:/file4 has a invalid cluster, truncating... File disk1:/file4 truncated. File disk1:/file5 has a invalid cluster, truncating... File disk1:/file5 truncated. File disk1:/file6 has a invalid cluster, truncating... File disk1:/file6 truncated. File size of disk1:/file7 is not correct, correcting it File disk1:/file8 cluster chain has a loop, truncating it File disk1:/file8 truncated. File disk1:/file9 cluster chain has a loop, truncating it File disk1:/file9 truncated. File disk1:/file16 has a free/bad cluster, truncating... File disk1:/file16 truncated. File disk1:/file20 has a free/bad cluster, truncating... File disk1:/file20 truncated. Reclaiming unused space... Created file disk1:/fsck-4 for an unused cluster chain Created file disk1:/fsck-41 for an unused cluster chain Checks to see if two or more files share the same cluster (crosslinked). If two or more files are crosslinked, you are prompted to accept the repair, and one of the files is truncated. Checks to see if the file’s cluster chain is shorter than is indicated by the size fields. If the file’s cluster chain is shorter than is indicated by the size fields, the file size is recalculated and the directory entry is updated. Checks to see if there are any unused cluster chains. If unused cluster chains are found, new files are created and linked to that file with the name fsck-start cluster. Table 32 fsck Utility Checks and Actions (continued) Checks Actions Table 33 Valid Cluster Numbers Cluster FAT-12 FAT-16 Next entry in the chain 2-FEF 2-FFEF Last entry in chain FF8-FFF FFF8-FFFF Available cluster 0 0 Bad Cluster FF7 FFF7 fsck CF-229 Cisco IOS Configuration Fundamentals Command Reference April 2010 Created file disk1:/fsck-73 for an unused cluster chain Created file disk1:/fsck-106 for an unused cluster chain Created file disk1:/fsck-121 for an unused cluster chain Created file disk1:/fsck-132 for an unused cluster chain Created file disk1:/fsck-140 for an unused cluster chain Created file disk1:/fsck-156 for an unused cluster chain Created file disk1:/fsck-171 for an unused cluster chain Created file disk1:/fsck-186 for an unused cluster chain Created file disk1:/fsck-196 for an unused cluster chain Created file disk1:/fsck-235 for an unused cluster chain Created file disk1:/fsck-239 for an unused cluster chain Updating FAT... fsck of disk1: complete Cisco 7600 Series Router This example shows how to run a check of the current file system: Router# fsck Checking the boot sector and partition table... Checking FAT, Files and Directories... Files 1) disk0:/FILE3 and 2) disk0:/FILE2 have a common cluster. Press 1/2 to truncate or any other character to ignore[confirm] q Ignoring this error and continuing with the rest of the check... Files 1) disk0:/FILE5 and 2) disk0:/FILE4 have a common cluster. Press 1/2 to truncate or any other character to ignore[confirm] 1 File disk0:/FILE5 truncated. Files 1) disk0:/FILE7 and 2) disk0:/FILE6 have a common cluster. . . . 1) disk0:/FILE15 and 2) disk0:/FILE13 have a common cluster. Press 1/2 to truncate or any other character to ignore[confirm] i Ignoring this error and continuing with the rest of the check... Reclaiming unused space... Created file disk0:/fsck-11 for an unused cluster chain Created file disk0:/fsck-20 for an unused cluster chain Created file disk0:/fsck-30 for an unused cluster chain Created file disk0:/fsck-35 for an unused cluster chain Created file disk0:/fsck-40 for an unused cluster chain Created file disk0:/fsck-46 for an unused cluster chain Created file disk0:/fsck-55 for an unused cluster chain Created file disk0:/fsck-62 for an unused cluster chain Created file disk0:/fsck-90 for an unused cluster chain Updating FAT... fsck of disk0: complete Related Commands fsck CF-230 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Description cd Changes the default directory or file system. pwd Shows the current setting of the cd command. full-help CF-231 Cisco IOS Configuration Fundamentals Command Reference April 2010 full-help To get help for the full set of user-level commands, use the full-help command in line configuration mode. full-help Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes Line configuration Command History Usage Guidelines The full-help command enables (or disables) an unprivileged user to see all of the help messages available. It is used with the show ? command. Examples In the following example, the show ? command is used first with full-help disabled. Then full-help is enabled for the line, and the show ? command is used again to demonstrate the additional help output that is displayed. Router> show ? bootflash Boot Flash information calendar Display the hardware calendar clock Display the system clock context Show context information dialer Dialer parameters and statistics history Display the session command history hosts IP domain-name, lookup style, nameservers, and host table isdn ISDN information kerberos Show Kerberos Values modemcap Show Modem Capabilities database ppp PPP parameters and statistics rmon rmon statistics sessions Information about Telnet connections snmp snmp statistics terminal Display terminal configuration parameters users Display information about terminal lines version System hardware and software status Router> enable Password: Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. full-help CF-232 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)# line console 0 Router(config-line)# full-help Router(config-line)# exit Router# %SYS-5-CONFIG_I: Configured from console by console Router# disable Router> show ? access-expression List access expression access-lists List access lists aliases Display alias commands apollo Apollo network information appletalk AppleTalk information arp ARP table async Information on terminal lines used as router interfaces bootflash Boot Flash information bridge Bridge Forwarding/Filtering Database [verbose] bsc BSC interface information bstun BSTUN interface information buffers Buffer pool statistics calendar Display the hardware calendar . . . translate Protocol translation information ttycap Terminal capability tables users Display information about terminal lines version System hardware and software status vines VINES information vlans Virtual LANs Information whoami Info on current tty line x25 X.25 information xns XNS information xremote XRemote statistics Related Commands Command Description help Displays a brief description of the help system. help CF-233 Cisco IOS Configuration Fundamentals Command Reference April 2010 help To display a brief description of the help system, use the help command in any command mode. help Syntax Description This command has no arguments or keywords. Defaults No default behavior or values. Command Modes User EXEC Privileged EXEC All configuration modes Command History Usage Guidelines The help command provides a brief description of the context-sensitive help system, which functions as follows: • To list all commands available for a particular command mode, enter a question mark (?) at the system prompt. • To obtain a list of commands that begin with a particular character string, enter the abbreviated command entry immediately followed by a question mark (?). This form of help is called word help, because it lists only the keywords or arguments that begin with the abbreviation you entered. • To list the keywords and arguments associated with a command, enter a question mark (?) in place of a keyword or argument on the command line. This form of help is called command syntax help, because it lists the keywords or arguments that apply based on the command, keywords, and arguments you have already entered. Examples In the following example, the help command is used to display a brief description of the help system: Router# help Help may be requested at any point in a command by entering a question mark '?'. If nothing matches, the help list will be empty and you must backup until entering a '?' shows the available options. Two styles of help are provided: 1. Full help is available when you are ready to enter a command argument (e.g. 'show ?') and describes each possible argument. 2. Partial help is provided when an abbreviated argument is entered Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. help CF-234 Cisco IOS Configuration Fundamentals Command Reference April 2010 and you want to know what arguments match the input (e.g. 'show pr?'.) The following example shows how to use word help to display all the privileged EXEC commands that begin with the letters “co.” The letters entered before the question mark are reprinted on the next command line to allow the user to continue entering the command. Router# co? configure connect copy Router# co The following example shows how to use command syntax help to display the next argument of a partially complete access-list command. One option is to add a wildcard mask. The symbol indicates that the other option is to press Enter to execute the command without adding any more keywords or arguments. The characters entered before the question mark are reprinted on the next command line to allow the user to continue entering the command or to execute that command as it is. Router(config)# access-list 99 deny 131.108.134.234 ? A.B.C.D Mask of bits to ignore Router(config)# access-list 99 deny 131.108.134.234 Related Commands Command Description full-help Enables help for the full set of user-level commands for a line. hidekeys CF-235 Cisco IOS Configuration Fundamentals Command Reference April 2010 hidekeys To suppress the display of password information in configuration log files, use the hidekeys command in configuration change logger configuration mode. To allow the display of password information in configuration log files, use the no form of this command. hidekeys no hidekeys Syntax Description This command has no arguments or keywords. Command Default Password information is displayed. Command Modes Configuration change logger configuration Command History Usage Guidelines Enabling the hidekeys command increases security by preventing password information from being displayed in configuration log files. Examples The following example shows how to prevent password information from being displayed in configuration log files: Router# configure terminal ! Router(config)# archive Router(config-archive)# log config Router(config-archive-log-config)# hidekeys Router(config-archive-log-config)# end Related Commands Release Modification 12.3(4)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(27)SBC This command was integrated into Cisco IOS Release 12.2(27)SBC. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. Command Description archive Enters archive configuration mode. log config Enters configuration change logger configuration mode. logging enable Enables the logging of configuration changes. hidekeys CF-236 Cisco IOS Configuration Fundamentals Command Reference April 2010 logging size Specifies the maximum number of entries retained in the configuration log. notify syslog Enables the sending of notifications of configuration changes to a remote syslog. show archive log config Displays entries from the configuration log. Command Description history CF-237 Cisco IOS Configuration Fundamentals Command Reference April 2010 history To enable the command history function, use the history command in line configuration mode. To disable the command history function, use the no form of this command. history no history Syntax Description This command has no arguments or keywords. Defaults Enabled with ten command lines in the buffer. Command Modes Line configuration Command History Usage Guidelines The command history function provides a record of EXEC commands that you have entered. This function is particularly useful for recalling long or complex commands or entries, including access lists. To change the number of command lines that the system will record in its history buffer, use the history size line configuration command. The history command enables the history function with the last buffer size specified or, if there was not a prior setting, with the default of ten lines. The no history command disables the history function. The show history EXEC command will list the commands you have entered, but you can also use your keyboard to display individual commands. Table 34 lists the keys you can use to recall commands from the command history buffer. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 34 History Keys Key(s) Functions Ctrl-P or Up Arrow1 1. The arrow keys function only with ANSI-compatible terminals. Recalls commands in the history buffer in a backward sequence, beginning with the most recent command. Repeat the key sequence to recall successively older commands. Ctrl-N or Down Arrow1 Returns to more recent commands in the history buffer after recalling commands with Ctrl-P or the Up Arrow. Repeat the key sequence to recall successively more recent commands. history CF-238 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, the command history function is disabled on line 4: Router(config)# line 4 Router(config-line)# no history Related Commands Command Description history size Sets the command history buffer size for a particular line. show history Lists the commands you have entered in the current EXEC session. terminal history Enables the command history function for the current terminal session or changes the size of the command history buffer for the current terminal session. history size CF-239 Cisco IOS Configuration Fundamentals Command Reference April 2010 history size To change the command history buffer size for a particular line, use the history size command in line configuration mode. To reset the command history buffer size to ten lines, use the no form of this command. history size number-of-lines no history size Syntax Description Defaults 10 command lines Command Modes Line configuration Command History Usage Guidelines The history size command should be used in conjunction with the history and show history commands. The history command enables or disables the command history function. The show history command lists the commands you have entered in the current EXEC session. The number of commands that the history buffer will show is set by the history size command. Note The history size command only sets the size of the buffer; it does not reenable the history function. If the no history command is used, the history command must be used to reenable this function. Examples The following example displays line 4 configured with a history buffer size of 35 lines: Router(config)# line 4 Router(config-line)# history size 35 Related Commands number-of-lines Specifies the number of command lines that the system will record in its history buffer. The range is from 0 to 256. The default is 10. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description history Enables or disables the command history function. show history Lists the commands you have entered in the current EXEC session. terminal history size Enables the command history function for the current terminal session or changes the size of the command history buffer for the current terminal session. hold-character CF-240 Cisco IOS Configuration Fundamentals Command Reference April 2010 hold-character To define the local hold character used to pause output to the terminal screen, use the hold-character command in line configuration mode. To restore the default, use the no form of this command. hold-character ascii-number no hold-character Syntax Description Defaults No hold character is defined. Command Modes Line configuration Command History Usage Guidelines The Break character is represented by zero; NULL cannot be represented. To continue the output, enter any character after the hold character. To use the hold character in normal communications, precede it with the escape character. See the “ASCII Character Set” appendix for a list of ASCII characters. Examples The following example sets the hold character to Ctrl-S, which is ASCII decimal character 19: Router(config)# line 8 Router(config-line)# hold-character 19 Related Commands ascii-number ASCII decimal representation of a character or control sequence (for example, Ctrl-P). Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description terminal hold-character Sets or changes the hold character for the current session. hostname CF-241 Cisco IOS Configuration Fundamentals Command Reference April 2010 hostname To specify or modify the host name for the network server, use the hostname command in global configuration mode. hostname name Syntax Description Command Default The default host name is Router. Command Modes Global configuration Command History Usage Guidelines The host name is used in prompts and default configuration filenames. Do not expect case to be preserved. Uppercase and lowercase characters look the same to many internet software applications. It may seem appropriate to capitalize a name the same way you might do in English, but conventions dictate that computer names appear all lowercase. For more information, refer to RFC 1178, Choosing a Name for Your Computer. The name must also follow the rules for ARPANET host names. They must start with a letter, end with a letter or digit, and have as interior characters only letters, digits, and hyphens. Names must be 63 characters or fewer. A host name of less than 10 characters is recommended. For more information, refer to RFC 1035, Domain Names—Implementation and Specification. On most systems, a field of 30 characters is used for the host name and the prompt in the CLI. Note that the length of your host name may cause longer configuration mode prompts to be truncated. For example, the full prompt for service profile configuration mode is: (config-service-profile)# However, if you are using the host-name of "Router", you will only see the following prompt (on most systems): Router(config-service-profil)# If the hostname is longer, you will see even less of the prompt: Basement-rtr2(config-service)# Keep this behavior in mind when assigning a name to your system (using the hostname global configuration command). If you expect that users will be relying on mode prompts as a CLI navigation aid, you should assign host names of no more than nine characters. name New host name for the network server. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. hostname CF-242 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example changes the host name to “host1”: Router(config)# hostname sandbox host1(config)# Related Commands Command Description setup Enables you to make major changes to your configurations, for example, adding a protocol suit, making major addressing scheme changes, or configuring newly installed interfaces. hw-module reset CF-243 Cisco IOS Configuration Fundamentals Command Reference April 2010 hw-module reset To reset a module by turning the power off and then on, use the hw-module reset command in privileged EXEC mode. hw-module module num reset Syntax Description Command Default This command has no default settings. Command Modes Privileged EXEC Command History Usage Guidelines The num argument designates the module number. Valid values depend on the chassis that is used. For example, if you have a 13-slot chassis, valid values for the module number are from 1 to 13. Examples This example shows how to reload a specific module: Router# hw-module module 3 reset module num Applies the command to a specific module; see the “Usage Guidelines” section for valid values. Release Modification 12.2(14)SX This command was introduced on the Supervisor Engine 720. 12.2(17d)SXB This command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(31)SB2 This command was integrated into Cisco IOS 12.2(31)SB2. hw-module shutdown CF-244 Cisco IOS Configuration Fundamentals Command Reference April 2010 hw-module shutdown To shut down the module, use the hw-module shutdown command in privileged EXEC mode. hw-module module num shutdown Syntax Description Defaults This command has no default settings. Command Modes Privileged EXEC Command History Usage Guidelines This command is supported on the SSL Services Module and the NAM. If you enter the hw-module shutdown command to shut down the module, you will have to enter the no power enable module command and the power enable module command to restart (power down and then power up) the module. Examples This example shows how to shut down and restart the module: Router# hw-module module 3 shutdown Router# no power enable module 3 Router# power enable module 3 module num Applies the command to a specific module; see the “Usage Guidelines” section for valid values. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. insecure CF-245 Cisco IOS Configuration Fundamentals Command Reference April 2010 insecure To configure a line as insecure, use the insecure command in line configuration mode. To disable this function, use the no form of this command. insecure no insecure Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes Line configuration Command History Usage Guidelines Use this command to identify a modem line as insecure for DEC local area transport (LAT) classification. Examples In the following example, line 10 is configured as an insecure dialup line: Router(config)# line 10 Router(config-line)# insecure Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. international CF-246 Cisco IOS Configuration Fundamentals Command Reference April 2010 international If you are using Telnet to access a Cisco IOS platform and you want to display 8-bit and multibyte international characters (for example, Kanji) and print the Escape character as a single character instead of as the caret and bracket symbols (^[), use the international command in line configuration mode. To display characters in 7-bit format, use the no form of this command. international no international Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes Line configuration Command History Usage Guidelines If you are configuring a Cisco IOS platform using the Cisco web browser user interface (UI), this function is enabled automatically when you enable the Cisco web browser UI using the ip http server global configuration command. Examples The following example enables a Cisco IOS platform to display 8-bit and multibyte characters and print the Escape character as a single character instead of as the caret and bracket symbols (^[) when you are using Telnet to access the platform: line vty 4 international Related Commands Release Modification 11.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description terminal international Prints the Escape character as a single character instead of as the caret and bracket symbols (^[) for a current Telnet session in instances when you are using Telnet to access a Cisco IOS platform and you want to display 8-bit and multibyte international characters (for example, Kanji). ip bootp server CF-247 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip bootp server To enable the Bootstrap Protocol (BOOTP) service on your routing device, use the ip bootp server command in global configuration mode. To disable BOOTP services, use the no form of the command. ip bootp server no ip bootp server Syntax Description This command has no arguments or keywords. Defaults Enabled Command Modes Global configuration Command History Usage Guidelines By default, the BOOTP service is enabled. When disabled, the no ip bootp server command will appear in the configuration file. The integrated Dynamic Host Configuration Protocol (DHCP) server was introduced in Cisco IOS Release 12.0(1)T. Because DHCP is based on BOOTP, both of these services share the “well-known” UDP server port of 67 (per RFC 951, RFC 1534, and RFC 2131; the client port is 68). To disable DHCP services (DHCP relay and DHCP server), use the no service dhcp command. To disable BOOTP services (in releases 12.2(8)T and later), but leave DHCP services enabled, use the ip dhcp bootp ignore command. If both the BOOTP server and DHCP server are disabled, “ICMP port unreachable” messages will be sent in response to incoming requests on port 67, and the original incoming packet will be discarded. If DHCP is enabled, using the no ip bootp server command by itself will not stop the router from listening on UDP port 67. Note As with all minor services, the async line BOOTP service should be disabled on your system if you do not have a need for it in your network. Any network device that has User Data Protocol (UDP), TCP, BOOTP, DHCP, or Finger services should be protected by a firewall or have the services disabled to protect against Denial of Service attacks. Release Modification 11.2 This command was introduced. 12.0(1)T The DHCP relay agent and DHCP server features were introduced. BOOTP forwarding is now handled by the DHCP relay agent implementation. 12.2(8)T The ip dhcp bootp ignore command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. ip bootp server CF-248 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, BOOTP and DHCP services are disabled on the router: Router(config)# no ip bootp server Router(config)# no service dhcp Related Commands Command Description ip dhcp bootp ignore Configures the Cisco IOS DHCP server to selectively ignore and not reply to received Bootstrap Protocol (BOOTP) request packets, allowing you continue using DHCP while disabling BOOTP. service dhcp Enables the Cisco IOS Dynamic Host Configuration Protocol (DHCP) server and relay agent features. ip finger CF-249 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip finger To configure a system to accept Finger protocol requests (defined in RFC 742), use the ip finger command in global configuration mode. To disable this service, use the no form of this command. ip finger [rfc-compliant] no ip finger Syntax Description Defaults Disabled Command Modes Global configuration Command History Usage Guidelines The Finger service allows remote users to view the output equivalent to the show users [wide] command. When ip finger is configured, the router will respond to a telnet a.b.c.d finger command from a remote host by immediately displaying the output of the show users command and then closing the connection. When the ip finger rfc-compliant command is configured, the router will wait for input before displaying anything (as required by RFC 1288). The remote user can then enter the Return key to display the output of the show users EXEC command, or enter /W to display the output of the show users wide EXEC command. After this information is displayed, the connection is closed. Note As with all minor services, the Finger service should be disabled on your system if you do not have a need for it in your network. Any network device that has UDP, TCP, BOOTP, or Finger services should be protected by a firewall or have the services disabled to protect against Denial of Service attacks. Because of the potential for hung lines, the rfc-compliant form of this command should not be configured for devices with more than 20 simultaneous users. rfc-compliant (Optional) Configures the system to wait for “Return” or “/W” input when processing Finger requests. This keyword should not be used for those systems. Release Modification 11.3 This command was introduced. 12.1(5), 12.1(5)T This command was changed from being enabled by default to being disabled by default. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. ip finger CF-250 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example disables the Finger protocol: Router(config)# no ip finger ip ftp passive CF-251 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip ftp passive To configure the router to use only passive FTP connections, use the ip ftp passive command in global configuration mode. To allow all types of FTP connections, use the no form of this command. ip ftp passive no ip ftp passive Syntax Description This command has no arguments or keywords. Defaults All types of FTP connections are allowed. Command Modes Global configuration Command History Examples In the following example, the router is configured to use only passive FTP connections: Router(config)# ip ftp passive Related Commands Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description ip ftp password Specifies the password to be used for FTP connections. ip ftp source-interface Specifies the source IP address for FTP connections. ip ftp username Configures the username for FTP connections. ip ftp password CF-252 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip ftp password To specify the password to be used for File Transfer Protocol (FTP) connections, use the ip ftp password command in global configuration mode. To return the password to its default, use the no form of this command. ip ftp password [type] password no ip ftp password Syntax Description Defaults The router forms a password username@routername.domain. The variable username is the username associated with the current session, routername is the configured host name, and domain is the domain of the router. Command Modes Global configuration Command History Examples The following example configures the router to use the username “red” and the password “blue” for FTP connections: Router(config)# ip ftp username red Router(config)# ip ftp password blue Related Commands type (Optional) Type of encryption to use on the password. A value of 0 disables encryption. A value of 7 indicates proprietary encryption. password Password to use for FTP connections. Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description ip ftp password Specifies the password to be used for FTP connections. ip ftp source-interface Specifies the source IP address for FTP connections. ip ftp username Configures the username for FTP connections. ip ftp source-interface CF-253 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip ftp source-interface To specify the source IP address for File Transfer Protocol (FTP) connections, use the ip ftp source-interface command in global configuration mode. To use the address of the interface where the connection is made, use the no form of this command. ip ftp source-interface interface-type interface-number no ip ftp source-interface Syntax Description Command Default The FTP source address is the IP address of the interface that the FTP packets use to leave the router. Command Modes Global configuration (config) Command History Usage Guidelines Use this command to set the same source address for all FTP connections. In Cisco IOS 12.3(6) and later releases, FTP is VRF-aware, which means that FTP transfer is supported across an interface within a VRF instance. To specify a VRF as a source for FTP connections, the VRF must be associated with the same interface that you configure with the ip ftp source-interface command. In this configuration, FTP looks for the destination IP address for file transfer in the specified VRF table. If the specified source interface is not up, Cisco IOS software selects the address of the interface closest to the destination as the source address. Examples The following example shows how to configure the router to use the IP address associated with Ethernet interface 0 as the source address on all FTP packets, regardless of which interface is actually used to send the packet: Router> enable Router# configure terminal Router(config)# ip ftp source-interface ethernet 0 The following example shows how to configure the router to use the VRF table named vpn1 to look for the destination IP address for the transfer of FTP packets: interface-type interface-number The interface type and number to use to obtain the source address for FTP connections. Release Modification 10.3 This command was introduced. 12.3(6) Destination address lookup in a Virtual Private Network (VPN) routing and forwarding (VRF) table was added for the transfer of FTP packets. 12.3(8)T This command was integrated into Cisco IOS Release 12.3(8)T. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. ip ftp source-interface CF-254 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router# configure terminal Router(config)# ip ftp source-interface ethernet 0 Router(config)# ip vrf vpn1 Router(config-vrf)# rd 200:1 Router(config-vrf)# route-target both 200:1 Router(config-vrf)# interface ethernet 0 Router(config-if)# ip vrf forwarding vpn1 Router(config-if)# end Related Commands Command Description ip ftp passive Configures the router to use only passive FTP connections. ip ftp password Specifies the password to be used for FTP connections. ip ftp username Configures the username for FTP connections. ip ftp username CF-255 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip ftp username To configure the username for File Transfer Protocol (FTP) connections, use the ip ftp username command in global configuration mode. To configure the router to attempt anonymous FTP, use the no form of this command. ip ftp username username no ip ftp username Syntax Description Defaults The Cisco IOS software attempts an anonymous FTP. Command Modes Global configuration Command History Usage Guidelines The remote username must be associated with an account on the destination server. Examples In the following example, the router is configured to use the username “red” and the password “blue” for FTP connections: Router(config)# ip ftp username red Router(config)# ip ftp password blue Related Commands username Username for FTP connections. Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description ip ftp passive Configures the router to use only passive FTP connections. ip ftp password Specifies the password to be used for FTP connections. ip ftp source-interface Specifies the source IP address for FTP connections. ip rarp-server CF-256 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip rarp-server To enable the router to act as a Reverse Address Resolution Protocol (RARP) server, use the ip rarp-server command in interface configuration mode. To restore the interface to the default of no RARP server support, use the no form of this command. ip rarp-server ip-address no ip rarp-server ip-address Syntax Description Defaults Disabled Command Modes Interface configuration Command History Usage Guidelines This feature makes diskless booting of clients possible between network subnets where the client and server are on separate subnets. RARP server support is configurable on a per-interface basis, so that the router does not interfere with RARP traffic on subnets that need no RARP assistance. The Cisco IOS software answers incoming RARP requests only if both of the following two conditions are met: • The ip rarp-server command has been configured for the interface on which the request was received. • A static entry is found in the IP ARP table that maps the MAC address contained in the RARP request to an IP address. Use the show ip arp EXEC command to display the contents of the IP ARP cache. Sun Microsystems, Inc. makes use of RARP and UDP-based network services to facilitate network-based booting of SunOS on it’s workstations. By bridging RARP packets and using both the ip helper-address interface configuration command and the ip forward-protocol global configuration command, the Cisco IOS software should be able to perform the necessary packet switching to enable booting of Sun workstations across subnets. Unfortunately, some Sun workstations assume that the sender of the RARP response, in this case the router, is the host that the client can contact to TFTP load the bootstrap image. This causes the workstations to fail to boot. ip-address IP address that is to be provided in the source protocol address field of the RARP response packet. Normally, this is set to whatever address you configure as the primary address for the interface. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. ip rarp-server CF-257 Cisco IOS Configuration Fundamentals Command Reference April 2010 By using the ip rarp-server command, the Cisco IOS software can be configured to answer these RARP requests, and the client machine should be able to reach its server by having its TFTP requests forwarded through the router that acts as the RARP server. In the case of RARP responses to Sun workstations attempting to diskless boot, the IP address specified in the ip rarp-server interface configuration command should be the IP address of the TFTP server. In addition to configuring RARP service, the Cisco IOS software must be configured to forward UDP-based Sun portmapper requests to completely support diskless booting of Sun workstations. This can be accomplished using configuration commands of the following form: ip forward-protocol udp 111 interface interface name ip helper-address target-address RFC 903 documents the RARP. Examples The following partial example configures a router to act as a RARP server. The router is configured to use the primary address of the specified interface in its RARP responses. arp 172.30.2.5 0800.2002.ff5b arpa interface ethernet 0 ip address 172.30.3.100 255.255.255.0 ip rarp-server 172.30.3.100 In the following example, a router is configured to act as a RARP server, with TFTP and portmapper requests forwarded to the Sun server: ! Allow the router to forward broadcast portmapper requests ip forward-protocol udp 111 ! Provide the router with the IP address of the diskless sun arp 172.30.2.5 0800.2002.ff5b arpa interface ethernet 0 ! Configure the router to act as a RARP server, using the Sun Server's IP ! address in the RARP response packet. ip rarp-server 172.30.3.100 ! Portmapper broadcasts from this interface are sent to the Sun Server. ip helper-address 172.30.3.100 Related Commands Command Description ip forward-protocol Speeds up flooding of UDP datagrams using the spanning-tree algorithm. ip helper-address Forwards UDP broadcasts, including BOOTP, received on an interface. ip rcmd domain-lookup CF-258 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip rcmd domain-lookup To reenable the basic Domain Name Service (DNS) security check for rcp and rsh, use the ip rcmd domain-lookup command in global configuration mode. To disable the basic DNS security check for remote copy protocol (rcp) and remote shell protoco (rsh), use the no form of this command. ip rcmd domain-lookup no ip rcmd domain-lookup Syntax Description This command has no arguments or keywords. Defaults Enabled Command Modes Global configuration Command History Usage Guidelines The abbreviation RCMD (remote command) is used to indicate both rsh and rcp. DNS lookup for RCMD is enabled by default (provided general DNS services are enabled on the system using the ip domain-lookup command). The no ip rcmd domain-lookup command is used to disable the DNS lookup for RCMD. The ip rcmd domain-lookup command is used to reenable the DNS lookup for RCMD. DNS lookup for RCMD is performed as a basic security check. This check is performed using a host authentication process. When enabled, the system records the address of the requesting client. That address is mapped to a host name using DNS. Then a DNS request is made for the IP address for that host name. The IP address received is then checked against the original requesting address. If the address does not match with any of the addresses received from DNS, the RCMD request will not be serviced. This reverse lookup is intended to help protect against spoofing. However, please note that the process only confirms that the IP address is a valid “routable” address; it is still possible for a hacker to spoof the valid IP address of a known host. The DNS lookup is done after the TCP handshake but before the router (which is acting as a rsh/rcp server) sends any data to the remote client. The no ip rcmd domain-lookup will turn off DNS lookups for rsh and rcp only. The no ip domain-lookup command takes precedence over the ip rcmd domain-lookup command. This means that if the no ip domain-lookup command is in the current configuration, DNS will be bypassed for rcp and rsh even if the ip rcmd domain-lookup command is enabled. Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. ip rcmd domain-lookup CF-259 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, the DNS security check is disabled for RCMD (rsh/rcp): Router(config)# no ip rcmd domain-lookup Related Commands Command Description ip domain-lookup Enables the IP DNS-based host name-to-address translation. ip rcmd rcp-enable CF-260 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip rcmd rcp-enable To configure the Cisco IOS software to allow remote users to copy files to and from the router using remote copy protocol (rcp), use the ip rcmd rcp-enable command in global configuration mode. To disable rcp on the device, use the no form of this command. ip rcmd rcp-enable no ip rcmd rcp-enable Syntax Description This command has no arguments or keywords. Defaults To ensure security, the router is not enabled for rcp by default. Command Modes Global configuration Command History Usage Guidelines To allow a remote user to execute rcp commands on the router, you must also create an entry for the remote user in the local authentication database using the ip rcmd remote-host command. The no ip rcmd rcp-enable command does not prohibit a local user from using rcp to copy system images and configuration files to and from the router. To protect against unauthorized users copying the system image or configuration files, the router is not enabled for rcp by default. Examples In the following example, the rcp service is enabled on the system, the IP address assigned to the Loopback0 interface is used as the source address for outbound rcp and rsh packets, and access is granted to the user “netadmin3”on the remote host 172.16.101.101: Router(config)# ip rcmd rcp-enable Router(config)# ip rcmd source-interface Loopback0 Router(config)# ip rcmd remote-host router1 172.16.101.101 netadmin3 Related Commands Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description ip rcmd remote-host Creates an entry for the remote user in a local authentication database so that remote users can execute commands on the router using rsh or rcp. ip rcmd remote-host CF-261 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip rcmd remote-host To create an entry for the remote user in a local authentication database so that remote users can execute commands on the router using remote shell protocol (rsh) or remote copy protocol (rcp), use the ip rcmd remote-host command in global configuration mode. To remove an entry for a remote user from the local authentication database, use the no form of this command. ip rcmd remote-host local-username {ip-address | host-name} remote-username [enable [level]] no ip rcmd remote-host local-username {ip-address | host-name} remote-username [enable [level]] Syntax Description Defaults No entries are in the local authentication database. Command Modes Global configuration Command History Usage Guidelines A TCP connection to a router is established using an IP address. Using the host name is valid only when you are initiating an rcp or rsh command from a local router. The host name is converted to an IP address using DNS or host-name aliasing. local-username Name of the user on the local router. You can specify the router name as the username. This name needs to be communicated to the network administrator or to the user on the remote system. To be allowed to remotely execute commands on the router, the remote user must specify this value correctly. ip-address IP address of the remote host from which the local router will accept remotely executed commands. Either the IP address or the host name is required. host-name Name of the remote host from which the local router will accept remotely executed commands. Either the host name or the IP address is required. remote-username Name of the user on the remote host from which the router will accept remotely executed commands. enable [level] (Optional) Enables the remote user to execute privileged EXEC commands using rsh or to copy files to the router using rcp. The range is from 1 to 15. The default is 15. For information on the enable level, refer to the privilege level global configuration command in the Release 12.2 Cisco IOS Security Command Reference. Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. ip rcmd remote-host CF-262 Cisco IOS Configuration Fundamentals Command Reference April 2010 To allow a remote user to execute rcp or rsh commands on a local router, you must create an entry for the remote user in the local authentication database. You must also enable the router to act as an rsh or rcp server. To enable the router to act as an rsh server, issue the ip rcmd rsh-enable command. To enable the router to act as an rcp server, issue the ip rcmd rcp-enable command.The router cannot act as a server for either of these protocols unless you explicitly enable the capacity. A local authentication database, which is similar to a UNIX .rhosts file, is used to enforce security on the router through access control. Each entry that you configure in the authentication database identifies the local user, the remote host, and the remote user. To permit a remote user of rsh to execute commands in privileged EXEC mode or to permit a remote user of rcp to copy files to the router, specify the enable keyword and level. For information on the enable level, refer to the privilege level global configuration command in the Release 12.2 Cisco IOS Security Command Reference. An entry that you configure in the authentication database differs from an entry in a UNIX .rhosts file in the following aspect. Because the .rhosts file on a UNIX system resides in the home directory of a local user account, an entry in a UNIX .rhosts file need not include the local username; the local username is determined from the user account. To provide equivalent support on a router, specify the local username along with the remote host and remote username in each authentication database entry that you configure. For a remote user to be able to execute commands on the router in its capacity as a server, the local username, host address or name, and remote username sent with the remote client request must match values configured in an entry in the local authentication file. A remote client host should be registered with DNS. The Cisco IOS software uses DNS to authenticate the remote host’s name and address. Because DNS can return several valid IP addresses for a host name, the Cisco IOS software checks the address of the requesting client against all of the IP addresses for the named host returned by DNS. If the address sent by the requester is considered invalid, that is, it does not match any address listed with DNS for the host name, then the software will reject the remote-command execution request. Note that if no DNS servers are configured for the router, then that device cannot authenticate the host in this manner. In this case, the Cisco IOS software sends a broadcast request to attempt to gain access to DNS services on another server. If DNS services are not available, you must use the no ip domain-lookup command to disable the attempt to gain access to a DNS server by sending a broadcast request. If DNS services are not available and, therefore, you bypass the DNS security check, the software will accept the request to remotely execute a command only if all three values sent with the request match exactly the values configured for an entry in the local authentication file. Examples The following example allows the remote user named netadmin3 on a remote host with the IP address 172.16.101.101 to execute commands on router1 using the rsh or rcp protocol. User netadmin3 is allowed to execute commands in privileged EXEC mode. Router(config)# ip rcmd remote-host router1 172.16.101.101 netadmin3 enable Related Commands Command Description ip rcmd rcp-enable Configures the Cisco IOS software to allow remote users to copy files to and from the router. ip rcmd remote-host CF-263 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip domain-lookup Enables the IP DNS-based host name-to-address translation. ip rcmd rsh-enable Configures the router to allow remote users to execute commands on it using the rsh protocol. Command Description ip rcmd remote-username CF-264 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip rcmd remote-username To configure the remote username to be used when requesting a remote copy using remote copy protocol (rcp), use the ip rcmd remote-username command in global configuration mode. To remove from the configuration the remote username, use the no form of this command. ip rcmd remote-username username no ip rcmd remote-username username Syntax Description Defaults If you do not issue this command, the Cisco IOS software sends the remote username associated with the current tty process, if that name is valid, for rcp copy commands. For example, if the user is connected to the router through Telnet and the user was authenticated through the username command, then the software sends that username as the remote username. Note The remote username must be associated with an account on the destination server. If the username for the current tty process is not valid, the Cisco IOS software sends the host name as the remote username. For rcp boot commands, the Cisco IOS software sends the access server host name by default. Note For Cisco, tty lines are commonly used for access services. The concept of tty originated with UNIX. For UNIX systems, each physical device is represented in the file system. Terminals are called tty devices (tty stands for teletype, the original UNIX terminal). Command Modes Global configuration Command History Usage Guidelines The rcp protocol requires that a client send the remote username on an rcp request to the server. Use this command to specify the remote username to be sent to the server for an rcp copy request. If the server has a directory structure, as do UNIX systems, all files and images to be copied are searched for or written relative to the directory of the remote user’s account. username Name of the remote user on the server. This name is used for rcp copy requests. All files and images to be copied are searched for or written relative to the directory of the remote user’s account, if the server has a directory structure, for example, as do UNIX systems. Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. ip rcmd remote-username CF-265 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note Cisco IOS Release 10.3 added the ip keyword to rcmd commands. If you are upgrading from Release 10.2 to Release 10.3 or a later release, this keyword is automatically added to any rcmd commands you have in your Release 10.2 configuration files. Examples The following example configures the remote username to netadmin1: Router(config)# ip rcmd remote-username netadmin1 Related Commands Command Description boot network rcp Changes the default name of the network configuration file from which to load configuration commands. boot system rcp Specifies the system image that the router loads at startup. bridge acquire Forwards any frames for stations that the system has learned about dynamically. copy Copies any file from a source to a destination. ip rcmd rsh-enable CF-266 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip rcmd rsh-enable To configure the router to allow remote users to execute commands on it using remote shell protocol (rsh), use the ip rcmd rsh-enable command in global configuration mode. To disable a router that is enabled for rsh, use the no form of this command. ip rcmd rsh-enable no ip rcmd rsh-enable Syntax Description This command has no arguments or keywords. Defaults To ensure security, the router is not enabled for rsh by default. Command Modes Global configuration Command History Usage Guidelines rsh, used as a client process, gives users the ability to remotely get router information (such as status) without the need to connect into the router and then disconnect. This is valuable when looking at many statistics on many different routers. Use this command to enable the router to receive rsh requests from remote users. In addition to issuing this command, you must create an entry for the remote user in the local authentication database to allow a remote user to execute rsh commands on the router. The no ip rcmd rsh-enable command does not prohibit a local user of the router from executing a command on other routers and UNIX hosts on the network using rsh. The no form of this command only disables remote access to rsh on the router. Examples The following example enables a router as an rsh server: Router(config)# ip rcmd rsh-enable Related Commands Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description ip rcmd remote-host Creates an entry for the remote user in a local authentication database so that remote users can execute commands on the router using rsh or rcp. ip rcmd source-interface CF-267 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip rcmd source-interface To force remote copy protocol (rcp) or remote shell protocol (rsh) to use the IP address of a specified interface for all outgoing rcp/rsh communication packets, use the ip rcmd source-interface command in global configuration mode. To disable a previously configured ip rcmd source-interface command, use the no form of this command. ip rcmd source-interface interface-id no ip rcmd source-interface interface-id Syntax Description Defaults The address of the interface closest to the destination is used as the source interface for rcp/rsh communications. Command Modes Global configuration Command History Usage Guidelines If this command is not used, or if the interface specified in this command is not available (not up), the Cisco IOS software uses the address of the interface closest to the destination as the source address. Use this command to force the system to tag all outgoing rcp/rsh packets with the IP address associated with the specified interface. This address is used as the source address as long as the interface is in the up state. This command is especially useful in cases where the router has many interfaces, and you want to ensure that all rcp and/or rsh packets from this router have the same source IP address. A consistent address is preferred so that the other end of the connection (the rcp/rsh server or client) can maintain a single session. The other benefit of a consistent address is that an access list can be configured on the remote device. The specified interface must have an IP address associated with it. If the specified interface does not have an IP address or is in a down state, then rcp/rsh reverts to the default. To avoid this, add an IP address to the subinterface or bring the interface to the up state. Examples In the following example, Loopback interface 0 is assigned an IP address of 220.144.159.200, and the ip rcmd source-interface command is used to specify that the source IP address for all rcp/rsh packets will be the IP address assigned to the Loopback0 interface: interface Loopback0 interface-id The name and number used to identify the interface. For example, Loopback2. Release Modification 11.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. ip rcmd source-interface CF-268 Cisco IOS Configuration Fundamentals Command Reference April 2010 description Loopback interface ip address 220.144.159.200 255.255.255.255 no ip directed-broadcast ! . . . clock timezone GMT 0 ip subnet-zero no ip source-route no ip finger ip rcmd source-interface Loopback0 ip telnet source-interface Loopback0 ip tftp source-interface Loopback0 ip ftp source-interface Loopback0 ip ftp username cisco ip ftp password shhhhsecret no ip bootp server ip domain-name net.galaxy ip name-server 220.144.159.1 ip name-server 220.144.159.2 ip name-server 219.10.2.1 ! . . . Related Commands Command Description ip rcmd remote-host Creates an entry for the remote user in a local authentication database so that remote users can execute commands on the router using rsh or rcp. ip telnet source-interface CF-269 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip telnet source-interface To specify the IP address of an interface as the source address for Telnet connections, use the ip telnet source-interface command in global configuration mode. To reset the source address to the default for each connection, use the no form of this command. ip telnet source-interface interface no ip telnet source-interface Syntax Description Defaults The address of the closest interface to the destination is the source address. Command Modes Global configuration Command History Usage Guidelines Use this command to set the IP address of an interface as the source for all Telnet connections. If the specified interface is not up, the Cisco IOS software selects the address of the interface closest to the destination as the source address. Examples The following example forces the IP address for Ethernet interface 1 as the source address for Telnet connections: Router(config)# ip telnet source-interface Ethernet1 Related Commands interface The interface whose address is to be used as the source for Telnet connections. Release Modification 11.1 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description ip radius source-interface Forces RADIUS to use the IP address of a specified interface for all outgoing RADIUS packets. ip tftp source-interface CF-270 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip tftp source-interface To specify the IP address of an interface as the source address for TFTP connections, use the ip tftp source-interface command in global configuration mode. To return to the default, use the no form of this command. ip tftp source-interface interface-type interface-number no ip tftp source-interface Syntax Description Command Default The address of the closest interface to the destination is selected as the source address. Command Modes Global configuration Command History Usage Guidelines Use this command to set the IP address of an interface as the source for all TFTP connections. If the specified interface is not up, the Cisco IOS software selects the address of the interface closest to the destination as the source address. In Cisco IOS 12.3(6) and later releases, TFTP is VRF-aware, which means that TFTP transfer is supported across an interface within a Virtual Private Network (VPN) routing and forwarding (VRF) instance. To specify a VRF as a source for TFTP connections, the VRF must be associated with the same interface that you configure with the ip tftp source-interface command. In this configuration, TFTP looks for the destination IP address for file transfer in the specified VRF table. Examples The following example shows how to configure the router to use the IP address associated with loopback interface 0 as the source address for TFTP connections: configure terminal ! ip tftp source-interface loopback0 The following example shows how to configure the router to use the VRF table named vpn1 to look for the destination IP address for TFTP connections: interface-type interface-number The interface type and number whose address is to be used as the source for TFTP connections. Release Modification 11.1 This command was introduced. 12.3(6) Destination address lookup in a Virtual Private Network (VPN) routing and forwarding (VRF) table was added for the transfer of TFTP packets. 12.3(8)T This command was integrated into Cisco IOS Release 12.3(8)T. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. ip tftp source-interface CF-271 Cisco IOS Configuration Fundamentals Command Reference April 2010 configure terminal ! ip tftp source-interface ethernet 1/0 ! ip vrf vpn1 rd 100:1 route-target both 100:1 ! interface ethernet 1/0 ip vrf forwarding vpn1 end In this example, file transfer using TFTP is accomplished across an interface within a VRF (VRF vpn1) link. Related Commands Command Description ip ftp source-interface Forces outgoing FTP packets to use the IP address of a specified interface as the source address. ip radius source-interface Forces outgoing RADIUS packets to use the IP address of a specified interface as the source address. ip wccp web-cache accelerated CF-272 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip wccp web-cache accelerated To enable the hardware acceleration for WCCP version 1, use the ip wccp web-cache accelerated command in global configuration mode. To disable hardware acceleration, use the no form of this command. ip wccp web-cache accelerated [[group-address groupaddress] | [redirect-list access-list] | [group-list access-list] | [password password]] no ip wccp web-cache accelerated Syntax Description Defaults Disabled Command Modes Global configuration (config) Command History Usage Guidelines This command is supported on software releases later than cache engine software Release ACNS 4.2.1. The group-address group-address option requires a multicast address that is used by the router to determine which cache engine should receive redirected messages. This option instructs the router to use the specified multicast IP address to coalesce the “I See You” responses for the “Here I Am” messages that it has received on this group address. In addition, the response is sent to the group address. The default is for no group-address to be configured, so that all “Here I Am” messages are responded to with a unicast reply. group-address group-address (Optional) Directs the router to use a specified multicast IP address for communication with the WCCP service group. See the “Usage Guidelines” section for additional information. redirect-list access-list (Optional) Directs the router to use an access list to control traffic that is redirected to this service group. See the “Usage Guidelines” section for additional information. group-list access-list (Optional) Directs the router to use an access list to determine which cache engines are allowed to participate in the service group. See the “Usage Guidelines” section for additional information. password password (Optional) Specifies a string that directs the router to apply MD5 authentication to messages received from the service group specified by the service name given. See the “Usage Guidelines” section for additional information. Release Modification 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Cisco IOS Release 12.2(17d)SXB. 12.2(18)SXD1 This command was changed to support the Supervisor Engine 720. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. ip wccp web-cache accelerated CF-273 Cisco IOS Configuration Fundamentals Command Reference April 2010 The redirect-list access-list option instructs the router to use an access list to control the traffic that is redirected to the cache engines of the service group that is specified by the service-name given. The access-list argument specifies either a number from 1 to 99 to represent a standard or extended access-list number, or a name to represent a named standard or extended access list. The access list itself specifies the traffic that is permitted to be redirected. The default is for no redirect-list to be configured (all traffic is redirected). The group-list access-list option instructs the router to use an access list to control the cache engines that are allowed to participate in the specified service group. The access-list argument specifies either a number from 1 to 99 to represent a standard access-list number, or a name to represent a named standard access list. The access list specifies which cache engines are permitted to participate in the service group. The default is for no group-list to be configured, so that all cache engines may participate in the service group. The password can be up to seven characters. When you designate a password, the messages that are not accepted by the authentication are discarded. The password name is combined with the HMAC MD5 value to create security for the connection between the router and the cache engine. Examples This example shows how to enable the hardware acceleration for WCCP version 1: Router(config)# ip wccp web-cache accelerated Related Commands Command Description ip wccp version Specifies which version of WCCP to configure on your router. length CF-274 Cisco IOS Configuration Fundamentals Command Reference April 2010 length To set the terminal screen length, use the length command in line configuration mode. To restore the default value, use the no form of this command. length screen-length no length Syntax Description Defaults Screen length of 24 lines Command Modes Line configuration Command History Usage Guidelines The Cisco IOS software uses the value of this command to determine when to pause during multiple-screen output. Not all commands recognize the configured screen length. For example, the show terminal command assumes a screen length of 24 lines or more. Examples In the following example, the terminal type is specified and the screen pause function is disabled for the terminal connection on line 6: Router(config)# line 6 Router(config-line)# terminal-type VT220 Router(config-line)# length 0 Related Commands screen-length The number of lines on the screen. A value of zero disables pausing between screens of output. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description terminal length Sets the number of lines on the current terminal screen for the current session. load-interval CF-275 Cisco IOS Configuration Fundamentals Command Reference April 2010 load-interval To change the length of time for which data is used to compute load statistics, use the load-interval command in interface configuration mode or Frame Relay DLCI configuration mode. To revert to the default setting, use the no form of this command. load-interval seconds no load-interval seconds Syntax Description Command Default Enabled Command Modes Interface configuration Frame Relay DLCI configuration Command History Usage Guidelines To make computations more reactive to short bursts of traffic, you can shorten the length of time over which load averages are computed. If the load interval is set to 30 seconds, new data is used for load calculations over a 30-second period. This data is used to compute load statistics, including the input rate in bits and packets per second, the output rate in bits and packets per second, the load, and reliability. Load data is gathered every five seconds. This data is used for a weighted-average calculation in which recent load data has more weight in the computation than older load data. If the load interval is set to 30 seconds, the average is computed for the last 30 seconds of load data. If you change the calculation interval from the default of five minutes to a shorter period of time, the input and output statistics that are displayed by the show interface command or the show frame-relay pvc command will be more current and will be based on more nearly instantaneous data, rather than reflecting the average load over a longer period of time. This command is often used for dial backup purposes to increase or decrease the likelihood of implementation of a backup interface, but it can be used on any interface. seconds Length of time for which data is used to compute load statistics. Value is a multiple of 30, from 30 to 600 (30, 60, 90, 120, and so on). The default is 300 seconds. Release Modification 10.3 This command was introduced. 12.2(4)T This command was made available in Frame Relay DLCI configuration mode. 12.2(18)SXF Support for this command was introduced on the Supervisor Engine 720. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. load-interval CF-276 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples Interface Example In the following example, the default average of five minutes is changed to a 30-second average. A burst in traffic that would not trigger a dial backup for an interface configured with the default five-minute interval might trigger a dial backup for this interface, which is set for the shorter 30-second interval. Router(config)# interface serial 0 Router(config-if)# load-interval 30 Frame Relay PVC Example In the following example, the load interval is set to 60 seconds for a Frame Relay PVC with the DLCI 100: Router(config)# interface serial 1/1 Router(config-if)# frame-relay interface-dlci 100 Router(config-fr-dlci)# load-interval 60 Related Commands Command Description show interfaces Displays statistics for all interfaces configured on the router or access server. location CF-277 Cisco IOS Configuration Fundamentals Command Reference April 2010 location To provide a description of the location of a serial device, use the location command in line configuration mode. To remove the description, use the no form of this command. location text no location Syntax Description Defaults No location description is provided. Command Modes Line configuration Command History Usage Guidelines The location command enters information about the device location and status. Use the show users all EXEC command to display the location information. Examples In the following example, the location description for the console line is given as “Building 3, Basement”: Router(config)# line console Router(config-line)# location Building 3, Basement text Location description. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. lock CF-278 Cisco IOS Configuration Fundamentals Command Reference April 2010 lock To configure a temporary password on a line, use the lock command in EXEC mode. lock Syntax Description This command has no arguments or keywords. Defaults Not locked Command Modes EXEC Command History Usage Guidelines You can prevent access to your session while keeping your connection open by setting up a temporary password. To lock access to the terminal, perform the following steps: Step 1 Enter the lock command. The system prompts you for a password. Step 2 Enter a password, which can be any arbitrary string. The system will prompt you to confirm the password. The screen then clears and displays the message “Locked.” Step 3 To regain access to your sessions, reenter the password. The Cisco IOS software honors session timeouts on a locked lines. You must clear the line to remove this feature. The system administrator must set the line up to allow use of the temporary locking feature by using the lockable line configuration command. Examples The following example shows configuring the router as lockable, saving the configuration, and then locking the current session for the user: Router(config-line)# lockable Router(config-line)# ^Z Router# copy system:running-config nvram:startup-config Building configuration... OK Router# lock Password: Again: Locked Password: Router# Release Modification 10.0 This command was introduced in a release prior to Cisco IOS Release 10.0. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. lock CF-279 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description lockable Enables the lock EXEC command. login (EXEC) Enables or changes a login username. lockable CF-280 Cisco IOS Configuration Fundamentals Command Reference April 2010 lockable To enable use of the lock EXEC command, use the lockable command in line configuration mode. To reinstate the default (the terminal session cannot be locked), use the no form of this command. lockable no lockable Syntax Description This command has no arguments or keywords. Defaults Sessions on the line are not lockable (the lock EXEC command has no effect). Command Modes Line configuration Command History Usage Guidelines This command enables use of temporary terminal locking, which is executed using the lock EXEC command. Terminal locking allows a user keep the current session open while preventing access by other users. Examples In the following example, the terminal connection is configured as lockable, then the current connection is locked: Router# configure terminal Router(config)# line console 0 Router(config-line)# lockable Router(config)# ^Z Router# lock Password: Again: Locked Password: Router# Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description lock Prevents access to your session by other users by setting a temporary password on your terminal line. log config CF-281 Cisco IOS Configuration Fundamentals Command Reference April 2010 log config To enter configuration change logger configuration mode, use the log config command in archive configuration mode. log config Syntax Description This command has no arguments or keywords. Command Default None Command Modes Archive configuration Command History Examples The following example shows how to place the router in configuration change logger configuration mode: Router# configure terminal ! Router(config)# archive Router(config-archive)# log config Router(config-archive-log-config)# Related Commands Release Modification 12.3(4)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(27)SBC This command was integrated into Cisco IOS Release 12.2(27)SBC. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. Command Description archive Enters archive configuration mode. hidekeys Suppresses the display of password information in configuration log files. logging enable Enables the logging of configuration changes. logging size Specifies the maximum number of entries retained in the configuration log. notify syslog Enables the sending of notifications of configuration changes to a remote syslog. show archive log config Displays entries from the configuration log. logging enable CF-282 Cisco IOS Configuration Fundamentals Command Reference April 2010 logging enable To enable the logging of configuration changes, use the logging enable command in configuration change logger configuration mode. To disable the logging of configuration changes, use the no form of this command. logging enable no logging enable Syntax Description This command has no arguments or keywords. Command Default Configuration change logging is disabled. Command Modes Configuration change logger configuration Command History Usage Guidelines Use this command if you want to log configuration changes. If you disable configuration logging, all configuration log records that were collected are purged. Examples The following example shows how to enable configuration logging: Router# configure terminal ! Router(config)# archive Router(config-archive)# log config Router(config-archive-log-config)# logging enable Router(config-archive-log-config)# end The following example shows how to clear the configuration log by disabling and then reenabling the configuration log: Router# configure terminal ! Router(config)# archive Router(config-archive)# log config Router(config-archive-log-config)# no logging enable Router(config-archive-log-config)# logging enable Router(config-archive-log-config)# end Release Modification 12.3(4)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(27)SBC This command was integrated into Cisco IOS Release 12.2(27)SBC. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. logging event bundle-status CF-283 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands logging event bundle-status To enable message bundling, use the logging event bundle-status command in interface configuration mode. To disable message bundling, use the no form of this command. logging event bundle-status no logging event bundle-status Syntax Description Defaults Message bundling does not occur. Command Modes Global configuration Command History Usage Guidelines The logging event bundle-status command is not applicable on Port Channel or Ether-Channel interfaces. Command Description archive Enters archive configuration mode. hidekeys Suppresses the display of password information in configuration log files. log config Enters configuration change logger configuration mode. logging size Specifies the maximum number of entries retained in the configuration log. notify syslog Enables the sending of notifications of configuration changes to a remote syslog. show archive log config Displays entries from the configuration log. default Enables system logging of interface state-change events on all interfaces in the system. boot Enables system logging of interface state-change events on all interfaces in the system during system initialization. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. logging event bundle-status CF-284 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples This example shows how to enable the system logging of the interface state-change events on all interfaces in the system: Router(config)# logging event bundle-status Router(config)# end Router # show logging event bundle-status *Aug 4 17:36:48.240 UTC: %EC-SP-5-UNBUNDLE: Interface FastEthernet9/23 left the port-channel Port-channel2 *Aug 4 17:36:48.256 UTC: %LINK-SP-5-CHANGED: Interface FastEthernet9/23, changed state to administratively down *Aug 4 17:36:47.865 UTC: %EC-SPSTBY-5-UNBUNDLE: Interface FastEthernet9/23 left the port-channel Port-channel2 Router # show logging event bundle-status *Aug 4 17:37:35.845 UTC: %EC-SP-5-BUNDLE: Interface FastEthernet9/23 joined port-channel Port-channel2 *Aug 4 17:37:35.533 UTC: %EC-SPSTBY-5-BUNDLE: Interface FastEthernet9/23 joined port-channel Port-channel2 Related Commands Command Description show running-config Displays the status and configuration of the module or Layer 2 VLAN. logging event link-status (global configuration) CF-285 Cisco IOS Configuration Fundamentals Command Reference April 2010 logging event link-status (global configuration) To change the default or set the link-status event messaging during system initialization, use the logging event link-status command in global configuration mode. To disable the link-status event messaging, use the no form of this command. logging event link-status {default | boot} no logging event link-status {default | boot} Syntax Description Defaults Interface state-change messages are not sent. Command Modes Global configuration Command History Usage Guidelines You do not have to enter the logging event link-status boot command to enable link-status messaging during system initialization. The logging event link-status default command logs system messages even during system initialization. If you enter both the logging event link-status default and the no logging event link-status boot commands, the interface state-change events are logged after all modules in the Cisco 7600 series router come online after system initialization. The logging event link-status default and the no logging event link-status boot commands are saved and retained in the running configuration of the system. When both the logging event link-status default and the no logging event link-status boot commands are present in the running configuration and you want to display the interface state-change messages during system initialization, enter the logging event link-status boot command. Examples This example shows how to enable the system logging of the interface state-change events on all interfaces in the system: Router(config)# logging event link-status default Router(config)# default Enables system logging of interface state-change events on all interfaces in the system. boot Enables system logging of interface state-change events on all interfaces in the system during system initialization. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. logging event link-status (global configuration) CF-286 Cisco IOS Configuration Fundamentals Command Reference April 2010 This example shows how to enable the system logging of interface state-change events on all interfaces during system initialization: Router(config)# logging event link-status boot Router(config)# This example shows how to disable the system logging of interface state-change events on all interfaces: Router(config)# no logging event link-status default Router(config)# This example shows how to disable the system logging of interface state-change events during system initialization: Router(config)# no logging event link-status boot Router(config)# Related Commands Command Description show running-config Displays the status and configuration of the module or Layer 2 VLAN. logging event link-status (interface configuration) CF-287 Cisco IOS Configuration Fundamentals Command Reference April 2010 logging event link-status (interface configuration) To enable the link-status event messaging on an interface, use the logging event link-status command in interface configuration mode. To disable the link-status event messaging, use the no form of this command. logging event link-status no logging event link-status Syntax Description This command has no arguments or keywords. Defaults Interface state-change messages are not sent. Command Modes Interface configuration Command History Usage Guidelines To enable system logging of interface state-change events on a specific interface, enter the logging event link-status command. To enable system logging of interface state-change events on all interfaces in the system, enter the logging event link-status command. Examples This example shows how to enable the system logging of the interface state-change events on an interface: Router(config-if)# logging event link-status Router(config-if)# This example shows how to disable the system logging of the interface state-change events on an interface: Router(config-if)# no logging event link-status Router(config-if)# Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware. logging event link-status (interface configuration) CF-288 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description show running-config Displays the status and configuration of the module or Layer 2 VLAN. logging event subif-link-status CF-289 Cisco IOS Configuration Fundamentals Command Reference April 2010 logging event subif-link-status To enable the link-status event messaging on a subinterface, use the logging event subif-link-status command in interface configuration mode. To disable the link-status event messaging on a subinterface, use the no form of this command. logging event subif-link-status no logging event subif-link-status Syntax Description This command has no arguments or keywords. Defaults Subinterface state-change messages are not sent. Command Modes Interface configuration Command History Usage Guidelines This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 720. To enable system logging of interface state-change events on a specific subinterface, enter the logging event subif-link-status command. To enable system logging of interface state-change events on a specific interface, enter the logging event link-status command. To enable system logging of interface state-change events on all interfaces in the system, enter the logging event link-status command. Examples This example shows how to enable the system logging of the interface state-change events on a subinterface: Router(config-if)# logging event subif-link-status Router(config-if)# This example shows how to disable the system logging of the interface state-change events on a subinterface: Router(config-if)# no logging event subif-link-status Router(config-if)# Release Modification 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. logging event subif-link-status CF-290 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description show running-config Displays the status and configuration of the module or Layer 2 VLAN. logging event trunk-status CF-291 Cisco IOS Configuration Fundamentals Command Reference April 2010 logging event trunk-status To enable trunk status messaging, use the logging event trunk-status command in interface configuration mode. To disable trunk status messaging, use the no form of this command. logging event trunk-status no logging event trunk-status Syntax Description This command has no keywords or variables. Defaults This command has no default settings. Command Modes Interface configuration mode Command History Usage Guidelines The logging event bundle-status command is not applicable on Port Channel or Ether-Channel interfaces. Examples This example shows how to enable the trunk status messaging on physical ports: Router(config)# logging event trunk-status Router(config)# end Router# show logging event trunk-status *Aug 4 17:27:01.404 UTC: %DTP-SPSTBY-5-NONTRUNKPORTON: Port Gi3/3 has become non-trunk *Aug 4 17:27:00.773 UTC: %DTP-SP-5-NONTRUNKPORTON: Port Gi3/3 has become non-trunk Router# Release Modification 12.2(14)SX Support for this command was introduced. logging ip access-list cache (global configuration) CF-292 Cisco IOS Configuration Fundamentals Command Reference April 2010 logging ip access-list cache (global configuration) To configure the Optimized ACL Logging (OAL) parameters, use the logging ip access-list cache command in global configuration mode. To return to the default settings, use the no form of this command. logging ip access-list cache {entries entries | {interval seconds | rate-limit pps | threshold packets} no logging ip access-list cache [entries | interval | rate-limit | threshold] Syntax Description Defaults The defaults are as follows: • entries—8000 entries. • seconds—300 seconds (5 minutes). • rate-limit pps—0 (rate limiting is off) and all packets are logged. • threshold packets—0 (rate limiting is off) and the system log is not triggered by the number of packet matches. Command Modes Global configuration Command History Usage Guidelines This command is supported on Cisco 7600 series routers that are configured with a Supervisor Engine 720 only. OAL is supported on IPv4 unicast traffic only. You cannot configure OAL and VACL capture on the same chassis. OAL and VACL capture are incompatible. With OAL configured, use SPAN to capture traffic. If the entry is inactive for the duration that is specified in the update-interval seconds command, the entry is removed from the cache. entries entries Specifies the maximum number of log entries that are cached in the software; valid values are from 0 to 1048576 entries. interval seconds Specifies the maximum time interval before an entry is sent to syslog; valid values are from 5 to 86400 seconds. rate-limit pps Specifies the number of packets that are logged per second in the software; valid values are from 10 to 1000000 pps. threshold packets Specifies the number of packet matches before an entry is sent to syslog; valid values are from 1 to 1000000 packets. Release Modification 12.2(17d)SXB Support for this command was introduced on the Supervisor Engine 720. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. logging ip access-list cache (global configuration) CF-293 Cisco IOS Configuration Fundamentals Command Reference April 2010 If you enter the no logging ip access-list cache command without keywords, all the parameters are returned to the default values. You must set ICMP unreachable rate limiting to 0 if the OAL is configured to log denied packets. When enabling the IP "too short" check using the mls verify ip length minimum command, valid IP packets with with an IP protocol field of ICMP(1), IGMP(2), IP(4), TCP(6), UDP(17), IPv6(41), GRE(47), or SIPP-ESP(50) will be hardware switched. All other IP protocol fields are software switched. Caution Using optimized access-list logging (OAL) and the mls verify ip length minimum command together can cause routing protocol neighbor flapping as they are incompatible Examples This example shows how to specify the maximum number of log entries that are cached in the software: Router(config)# logging ip access-list cache entries 200 This example shows how to specify the maximum time interval before an entry is sent to the system log: Router(config)# logging ip access-list cache interval 350 This example shows how to specify the number of packets that are logged per second in the software: Router(config)# logging ip access-list cache rate-limit 100 This example shows how to specify the number of packet matches before an entry is sent to the system log: Router(config)# logging ip access-list cache threshold 125 Related Commands Command Description clear logging ip access-list cache Clears all the entries from the OAL cache and sends them to the syslog. logging ip access-list cache (interface configuration) Enables an OAL-logging cache on an interface that is based on direction. show logging ip access-list Displays information about the logging IP access list. update-interval seconds Removes entries from the cache that are inactive for the duration that is specified in the command. logging ip access-list cache (interface configuration) CF-294 Cisco IOS Configuration Fundamentals Command Reference April 2010 logging ip access-list cache (interface configuration) To enable an Optimized ACL Logging (OAL)-logging cache on an interface that is based on direction, use the logging ip access-list cache command in interface configuration mode. To disable OAL, use the no form of this command. logging ip access-list cache [in | out] no logging ip access-list cache Syntax Description Defaults Disabled Command Modes Interface configuration Command History Usage Guidelines This command is supported on Cisco 7600 series routers that are configured with a Supervisor Engine 720 only. This command is supported on traffic that matches the log keyword in the applied ACL. You must set ICMP unreachable rate limiting to 0 if the OAL is configured to log denied packets. On systems that are configured with a PFC3A, support for the egress direction on tunnel interfaces is not supported. OAL is supported on IPv4 unicast traffic only. You cannot configure OAL and VACL capture on the same chassis. OAL and VACL capture are incompatible. With OAL configured, use SPAN to capture traffic. If the entry is inactive for the duration that is specified in the update-interval seconds command, the entry is removed from the cache. If you enter the no logging ip access-list cache command without keywords, all the parameters are returned to the default values. When enabling the IP "too short" check using the mls verify ip length minimum command, valid IP packets with with an IP protocol field of ICMP(1), IGMP(2), IP(4), TCP(6), UDP(17), IPv6(41), GRE(47), or SIPP-ESP(50) will be hardware switched. All other IP protocol fields are software switched. in (Optional) Enables OAL on ingress packets. out (Optional) Enables OAL on egress packets. Release Modification 12.2(17d)SXB Support for this command was introduced on the Supervisor Engine 720. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. logging ip access-list cache (interface configuration) CF-295 Cisco IOS Configuration Fundamentals Command Reference April 2010 Caution Using optimized access-list logging (OAL) and the mls verify ip length minimum command together can cause routing protocol neighbor flapping as they are incompatible Examples This example shows how to enable OAL on ingress packets: Router(config-if)# logging ip access-list cache in This example shows how to enable OAL on egress packets: Router(config-if)# logging ip access-list cache out Related Commands Command Description clear logging ip access-list cache Clears all the entries from the OAL cache and sends them to the syslog. logging ip access-list cache (global configuration) Configures the OAL parameters. show logging ip access-list Displays information about the logging IP access list. update-interval seconds Removes entries from the cache that are inactive for the duration that is specified in the command. logging persistent (config-archive-log-cfg) CF-296 Cisco IOS Configuration Fundamentals Command Reference April 2010 logging persistent (config-archive-log-cfg) To enable the configuration logging persistent feature and to select how the configuration commands are to be saved to the Cisco IOS secure file system, use the logging persistent command in the log config submode of archive configuration mode. To disable this capability, use the no form of this command. logging persistent {auto | manual} no logging persistent {auto | manual} Syntax Description Command Default The configuration commands are not saved to the Cisco IOS secure file system. Command Modes Archive configuration mode, log config (configuration-change logger) submode (config-archive-log-cfg)# Command History Usage Guidelines When you use the manual keyword, you must save each configuration command manually to the Cisco IOS secure file system. To do this, you must use the archive log config persistent save command. Examples The following example automatically saves the configuration commands to the Cisco IOS secure file system: Router(config)# archive Router(config-archive)# log config Router(config-archive-log-cfg)# logging enable Router(config-archive-log-cfg)# logging persistent auto auto Specifies that each configuration command will be saved automatically to the Cisco IOS secure file system. manual Specifies that each configuration command must be saved manually to the Cisco IOS secure file system. Release Modification 12.0(26)S This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.4(11)T This command was integrated into Cisco IOS Release 12.4(11)T. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB. logging persistent (config-archive-log-cfg) CF-297 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description logging persistent reload Sequentially applies configuration commands in the configuration logger database to the running-config file after a reload. archive log config persistent save Saves the persisted commands in the configuration log to the Cisco IOS secure file system. logging persistent reload (config-archive-log-cfg) CF-298 Cisco IOS Configuration Fundamentals Command Reference April 2010 logging persistent reload (config-archive-log-cfg) To sequentially apply the configuration commands saved in the configuration logger database (since the last write memory command) to the running-config file after a reload, use the logging persistent reload command in configuration change logger configuration mode in archive configuration mode. To disable this capability, use the no form of this command. logging persistent reload no logging persistent reload Syntax Description This command has no arguments or keywords. Command Default The configuration commands saved in the configuration logger database are not applied to the running-config file. Command Modes Archive config mode; log config (configuration change logger) submode (config-archive-log-cfg)# Command History Usage Guidelines Use the logging persistent reload command when you want changed configuration commands to take effect on the next reload of the router. Examples The following example applies the configuration commands in the configuration logger database to the running-config file after the next reload: Router(config-archive-log-cfg)# logging persistent reload Related Commands Release Modification 12.2(33)SRA This command was introduced. 12.4(11)T This command was integrated into Cisco IOS Release 12.4(11)T. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB. Command Description logging persistent Enables the configuration logging persistent feature. logging size CF-299 Cisco IOS Configuration Fundamentals Command Reference April 2010 logging size To specify the maximum number of entries retained in the configuration log, use the logging size command in configuration change logger configuration mode. To reset the default value, use the no form of this command. logging size entries no logging size Syntax Description Defaults 100 entries Command Modes Configuration change logger configuration Command History Usage Guidelines When the configuration log is full, the oldest log entry will be removed every time a new entry is added. Note If a new log size is specified that is smaller than the current log size, the oldest entries will be immediately purged until the new log size is satisfied, regardless of the age of the log entries. Examples The following example shows how to specify that the configuration log may have a maximum of 200 entries: Router(config-archive-log-config)# logging size 200 The following example shows how to clear the configuration log by reducing the log size to 1, then resetting the log size to the desired value. Only the most recent configuration log file will be saved. Router(config)# archive Router(config-archive)# log config Router(config-archive-log-config)# logging size 1 Router(config-archive-log-config)# logging size 200 entries The maximum number of entries retained in the configuration log. Valid values range from 1 to 1000. The default value is 100 entries. Release Modification 12.3(4)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(27)SBC This command was integrated into Cisco IOS Release 12.2(27)SBC. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. logging size CF-300 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description archive Enters archive configuration mode. hidekeys Suppresses the display of password information in configuration log files. log config Enters configuration change logger configuration mode. logging enable Enables the logging of configuration changes. notify syslog Enables the sending of notifications of configuration changes to a remote syslog. show archive log config Displays entries from the configuration log. logging synchronous CF-301 Cisco IOS Configuration Fundamentals Command Reference April 2010 logging synchronous To synchronize unsolicited messages and debug output with solicited Cisco IOS software output and prompts for a specific console port line, auxiliary port line, or vty, use the logging synchronous command in line configuration mode. To disable synchronization of unsolicited messages and debug output, use the no form of this command. logging synchronous [level severity-level | all] [limit number-of-lines] no logging synchronous [level severity-level | all] [limit number-of-lines] Syntax Description Defaults This command is disabled. If you do not specify a severity level, the default value of 2 is assumed. If you do not specify the maximum number of buffers to be queued, the default value of 20 is assumed. Command Modes Line configuration Command History Usage Guidelines When synchronous logging of unsolicited messages and debug output is turned on, unsolicited Cisco IOS software output is displayed on the console or printed after solicited Cisco IOS software output is displayed or printed. This keeps unsolicited messages and debug output from being interspersed with solicited software output and prompts. Tip This command is useful for keeping system messages from interrupting your typing. By default, messages will appear immediately when they are processed by the system, and the CLI cursor will appear at the end of the displayed message. For example, the line “Configured by console from console” level severity-level (Optional) Specifies the message severity level. Messages with a severity level equal to or higher than this value are printed asynchronously. Low numbers indicate greater severity and high numbers indicate lesser severity. The default value is 2. all (Optional) Specifies that all messages are printed asynchronously, regardless of the severity level. limit number-of-lines (Optional) Specifies the number of buffer lines to be queued for the terminal, after which new messages are dropped. The default value is 20. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware. logging synchronous CF-302 Cisco IOS Configuration Fundamentals Command Reference April 2010 may be printed to the screen, interrupting whatever command you are currently typing. The logging synchronous command allows you to avoid these potentially annoying interruptions without have to turn off logging to the console entirely. When this command is enabled, unsolicited messages and debug output are displayed on a separate line than user input. After the unsolicited messages are displayed, the CLI returns to the user prompt. Note This command is also useful for allowing you to continue typing when debugging is enabled. When specifying a severity level number, consider that for the logging system, low numbers indicate greater severity and high numbers indicate lesser severity. When a message queue limit of a terminal line is reached, new messages are dropped from the line, although these messages might be displayed on other lines. If messages are dropped, the notice “%SYS-3-MSGLOST number-of-messages due to overflow” follows any messages that are displayed. This notice is displayed only on the terminal that lost the messages. It is not sent to any other lines, any logging servers, or the logging buffer. Caution By configuring abnormally large message queue limits and setting the terminal to “terminal monitor” on a terminal that is accessible to intruders, you expose yourself to “denial of service” attacks. An intruder could carry out the attack by putting the terminal in synchronous output mode, making a Telnet connection to a remote host, and leaving the connection idle. This could cause large numbers of messages to be generated and queued, and these messages could consume all available RAM. You should guard against this type of attack through proper configuration. Examples In the following example, a system message appears in the middle of typing the show running-config command: Router(config-line)# end Router# show ru 2w1d: %SYS-5-CONFIG_I: Configured from console by consolenning-config . . . The user then enables synchronous logging for the current line (indicated by the * symbol in the show line command), after which the system displays the system message on a separate line, and returns the user to the prompt to allow the user to finish typing the command on a single line: Router# show line Tty Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns Int * 0 CTY - - - - - 0 3 0/0 - . . . Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)# line 0 Router(config-line)# logging syn Router(config-line)# logging synchronous Router(config-line)# end Router# show ru 2w1d: %SYS-5-CONFIG_I: Configured from console by console Router# show running-config logging synchronous CF-303 Cisco IOS Configuration Fundamentals Command Reference April 2010 In the following example, synchronous logging for line 4 is enabled with a severity level of 6. Then synchronous logging for line 2 is enabled with a severity level of 7 and is specified with a maximum number of buffer lines of 1,000. Router(config)# line 4 Router(config-line)# logging synchronous level 6 Router(config-line)# exit Router(config)# line 2 Router(config-line)# logging synchronous level 7 limit 1000 Router(config-line)# end Router# Related Commands Command Description line Identifies a specific line for configuration and starts the line configuration command collection mode. logging on Controls logging of error messages and sends debug or error messages to a logging process, which logs messages to designated locations asynchronously to the processes that generated the messages. logging system CF-304 Cisco IOS Configuration Fundamentals Command Reference April 2010 logging system To enable System Event Archive (SEA) logging, use the logging system command in global configuration mode. To disable SEA logging, use the no form of this command. logging system [disk name] no logging system Syntax Description Command Default By default, SEA logging feature is enabled, and the events are logged to a file on a persistent storage device (bootflash: or disk:). Command Modes Global configuration (config) Command History Usage Guidelines Cisco Universal Broadband Router 100112 The SEA feature is used to address the deficiencies of the debug trace and system console. Support for SEA feature was introduced on Cisco uBR10012 Router in the Cisco IOS Release 12.2(33)SCC. Use the logging system disk command to change the location of the disk used to store the sea_log.dat file. Note To store the system event logs, the SEA requires either PCMCIA ATA disk or Compact Flash disk in compact flash adapter for PRE2. Examples The following example shows how to specify that the SEA log file should be written to the disk “disk1:”: Router(config)# logging system disk disk1: Router(config)# end Related Commands disk name (Optional) Stores the system event archive (system event log file) in the specified disk. The specified disk must be already have been configured to allow for the storage of the system event archive. Release Modification 12.2(33)SXH This command was introduced. 12.2(33)SCC The command was introduced for the Cisco uBR10012 router in the Cisco IOS Software Release 12.2(33)SCC. clear logging system Clears the event records stored in the SEA. copy logging system Copies the archived system event log to another location. show logging system Displays the SEA logging system disk. logout CF-305 Cisco IOS Configuration Fundamentals Command Reference April 2010 logout To close an active terminal session by logging off the router, use the logout command in user EXEC mode. logout Syntax Description This command has no arguments or keywords. Defaults No default behavior or values. Command Modes User EXEC Command History Examples In the following example, the exit (global) command is used to move from global configuration mode to privileged EXEC mode, the disable command is used to move from privileged EXEC mode to user EXEC mode, and the logout command is used to log off (exit from the active session): Router(config)# exit Router# disable Router> logout Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. logout-warning CF-306 Cisco IOS Configuration Fundamentals Command Reference April 2010 logout-warning To warn users of an impending forced timeout, use the logout-warning command in line configuration mode. To restore the default, use the no form of this command. logout-warning [seconds] logout-warning Syntax Description Defaults No warning is sent to the user. Command Modes Line configuration Command History Usage Guidelines This command notifies the user of an impending forced timeout (set using the absolute-timeout command). Examples In the following example, a logout warning is configured on line 5 with a countdown value of 30 seconds: Router(config)# line 5 Router(config-line)# logout-warning 30 Related Commands seconds (Optional) Number of seconds that are counted down before session termination. If no number is specified, the default of 20 seconds is used. Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description absolute-timeout Sets the interval for closing user connections on a specific line or port. session-timeout Sets the interval for closing the connection when there is no input or output traffic. macro (global configuration) CF-307 Cisco IOS Configuration Fundamentals Command Reference April 2010 macro (global configuration) To create a global command macro, use the macro command in global configuration mode. To remove the macro, use the no form of this command. macro {global {apply macro-name | description text | trace macro-name [keyword-to-value] value-first-keyword [keyword-to-value] value-second-keyword [keyword-to-value] value-third-keyword [keyword-to-value]} | name macro-name} no macro {global {apply macro-name | description text | trace macro-name [keyword-to-value] value-first-keyword [keyword-to-value] value-second-keyword [keyword-to-value] value-third-keyword [keyword-to-value]} | name macro-name} Syntax Description Defaults This command has no default setting. Command Modes Global configuration (config) Command History Usage Guidelines You can enter up to three keyword pairs using the macro global trace command. You can enter the macro global description command on the switch stack or on a standalone switch. Use the description text keyword and argument to associate comment text, or the macro name, with a switch. When multiple macros are applied on a switch, the description text will be from the last applied macro. You can verify the global description settings by entering the show parser macro description command. To find any syntax or configuration errors, enter the macro global trace macro-name command to apply and debug the macro. To display a list of any keyword-value pairs defined in the macro, enter the macro global apply macro-name ? command. You can delete a global macro-applied configuration on a switch only by entering the no version of each command that is in the macro. global Applies the macro globally. apply macro-name Applies a specified macro. description text Specifies a description about the macros that are applied to the switch. trace macro-name Applies a specified macro with trace enabled. keyword-to-value (Optional) Keyword to replace with a value. value-first-keyword Value of the keyword to replace. name macro-name Specifies the name of a macro. Release Modification 12.2(33)SXH This command was introduced. macro (global configuration) CF-308 Cisco IOS Configuration Fundamentals Command Reference April 2010 Keyword matching is case sensitive. In the commands that the macro applies, all matching occurrences of keywords are replaced with the corresponding values. The no form of the macro name global configuration command only deletes the macro definition. It does not affect the configuration of those interfaces on which the macro is already applied. Examples This example shows how to apply the user-created macro called snmp, to set the host name address to test-server and to set the IP precedence value to 7: Router(config)# macro global apply snmp ADDRESS test-server VALUE 7 This example shows how to debug the user-created macro called snmp by using the macro global trace global configuration command to find any syntax or configuration errors in the macro when it is applied to the switch. Router(config)# macro global trace snmp VALUE 7 Applying command...`snmp-server enable traps port-security' Applying command...`snmp-server enable traps linkup' Applying command...`snmp-server enable traps linkdown' Applying command...`snmp-server host' %Error Unknown error. Applying command...`snmp-server ip precedence 7' Router(config)# Related Commands Command Description macro (interface configuration) Creates an interface-specific command macro. show parser macro Displays the smart port macros. macro (interface configuration) CF-309 Cisco IOS Configuration Fundamentals Command Reference April 2010 macro (interface configuration) To create an interface-specific command macro, use the macro command in interface configuration mode. To remove the macro, use the no form of this command. macro {apply macro-name | description text | trace macro-name [keyword-to-value] value-first-keyword [keyword-to-value] value-second-keyword [keyword-to-value] value-third-keyword [keyword-to-value]} no macro {apply macro-name | description text | trace macro-name [keyword-to-value] value-first-keyword [keyword-to-value] value-second-keyword [keyword-to-value] value-third-keyword [keyword-to-value]} Syntax Description Defaults This command has no default setting. Command Modes Interface configuration (config-if) Command History Usage Guidelines You can enter up to three keyword changes using the macro trace command. You can enter the macro description command on the switch stack or on a standalone switch. Use the description text keyword and argument to associate comment text, or the macro name, with a switch. When multiple macros are applied on a switch, the description text will be from the last applied macro. You can verify the description settings by entering the show parser macro description command. To find any syntax or configuration errors, enter the macro trace macro-name command to apply and debug the macro. To display a list of any keyword-value pairs defined in the macro, enter the macro apply macro-name ? command. To successfully apply the macro, you must enter any required keyword-value pairs. Keyword matching is case sensitive. In the commands that the macro applies, all matching occurrences of keywords are replaced with the corresponding values. apply macro-name Applies a specified macro. description text Specifies a description about the macros that are applied to the interface. trace macro-name Applies a specified macro with trace enabled. keyword-to-value (Optional) Keyword to replace with a value. value-first-keyword Value of the keyword to replace. Release Modification 12.2(33)SXH This command was introduced. macro (interface configuration) CF-310 Cisco IOS Configuration Fundamentals Command Reference April 2010 You can delete all configuration on an interface by entering the default interface interface interface configuration command. Examples The following example shows how to apply the user-created macro called desktop-config and to verify the configuration: Router(config)# interface fastethernet1/2 Router(config-if)# macro apply desktop-config The following example shows how to apply the user-created macro called desktop-config and to replace all occurrences of vlan with VLAN ID 25: Router(config-if)# macro apply desktop-config vlan 25 Related Commands Command Description macro (global configuration) Creates a command macro. show parser macro Displays the smart port macros. maximum CF-311 Cisco IOS Configuration Fundamentals Command Reference April 2010 maximum To set the maximum number of archive files of the running configuration to be saved in the Cisco IOS configuration archive, use the maximum command in archive configuration mode. To reset this command to its default, use the no form of this command. maximum number no maximum number Syntax Description Command Default By default, a maximum of 10 archive files of the running configuration are saved in the Cisco IOS configuration archive. Command Modes Archive configuration Command History Usage Guidelines Note Before using this command, you must configure the path command to specify the location and filename prefix for the files in the Cisco IOS configuration archive. After the maximum number of files are saved in the Cisco IOS configuration archive, the oldest file is automatically deleted when the next, most recent file is saved. Note This command should only be used when a local writable file system is specified in the url argument of the path command. Network file systems may not support deletion of previously saved files. number Maximum number of archive files of the running configuration to be saved in the Cisco IOS configuration archive. You can archive from 1 to 14 configuration files. The default is 10. Release Modification 12.3(7)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(31)SB2 This command was implemented on the Cisco 10000 series. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. maximum CF-312 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, a value of 5 is set as the maximum number of archive files of the running configuration to be saved in the Cisco IOS configuration archive: configure terminal ! archive path disk0:myconfig maximum 5 end Related Commands Command Description archive config Saves a copy of the current running configuration to the Cisco IOS configuration archive. configure confirm Confirms replacement of the current running configuration with a saved Cisco IOS configuration file. configure replace Replaces the current running configuration with a saved Cisco IOS configuration file. path Specifies the location and filename prefix for the files in the Cisco IOS configuration archive. show archive Displays information about the files saved in the Cisco IOS configuration archive. time-period Sets the time increment for automatically saving an archive file of the current running configuration in the Cisco IOS configuration archive. memory free low-watermark CF-313 Cisco IOS Configuration Fundamentals Command Reference April 2010 memory free low-watermark To configure a router to issue system logging message notifications when available memory falls below a specified threshold, use the memory free low-watermark command in global configuration mode. To disable memory threshold notifications, use the no form of this command. memory free low-watermark {processor threshold | io threshold} no memory free low-watermark Syntax Description Defaults Memory threshold notifications are disabled. Command Modes Global configuration Command History Usage Guidelines Using this command, you can configure a router to issue a system logging message each time available free memory falls below a specified threshold (“low-watermark”). Once available free memory rises to 5 percent above the threshold, another notification message is generated. Examples The following example specifies a free processor memory notification threshold of 20000 KB: Router(config)# memory free low-watermark processor 200000 If available free processor memory falls below this threshold, the router sends a notification message like this one: 000029: *Aug 12 22:31:19.559: %SYS-4-FREEMEMLOW: Free Memory has dropped below 20000k Pool: Processor Free: 66814056 freemem_lwm: 204800000 Once available free processor memory rises to a point 5 percent above the threshold, another notification message like this is sent: processor threshold Sets the processor memory threshold in kilobytes. When available processor memory falls below this threshold, a notification message is triggered. Valid values are 1 to 4294967295. io threshold Sets the input/output (I/O) memory threshold in kilobytes. When available I/O memory falls below this threshold, a notification message is triggered. Valid values are 1 to 4294967295. Release Modification 12.2(18)S This command was introduced. 12.0(26)S This command was integrated into Cisco IOS Release 12.0(26)S. 12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T. 12.2(27)SBC This command was integrated into Cisco IOS Release 12.2(27)SBC. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. memory free low-watermark CF-314 Cisco IOS Configuration Fundamentals Command Reference April 2010 000032: *Aug 12 22:33:29.411: %SYS-5-FREEMEMRECOVER: Free Memory has recovered 20000k Pool: Processor Free: 66813960 freemem_lwm: 0 Related Commands Command Description memory reserve critical Reserves memory for use by critical processes. memory lite CF-315 Cisco IOS Configuration Fundamentals Command Reference April 2010 memory lite To enable the memory allocation lite (malloc_lite) feature, use the memory lite command in global configuration mode. To disable this feature, use the no form of this command. memory lite no memory lite Syntax Description This command has no arguments or keywords. Defaults This command is enabled by default. Command Modes Global configuration Command History Usage Guidelines The malloc_lite feature was implemented to avoid excessive memory allocation overhead for situations where less than 128 bytes were required. This feature is supported for processor memory pools only. The malloc_lite feature is enabled by default. If the malloc_lite feature is disabled using the no memory lite command, you can re-enable the feature by entering the memory lite command. Examples The following example shows how to disable the malloc_lite feature: no memory lite Related Commands Release Modification 12.3(11)T This command was introduced. Command Description scheduler heapcheck process Performs a “sanity check” for corruption in memory blocks when a process switch occurs. memory reserve critical CF-316 Cisco IOS Configuration Fundamentals Command Reference April 2010 memory reserve critical Note Effective with Cisco IOS Release 12.4(15)T1, the memory reserve critical command is replaced by the memory reserve command. See the memory reserve command for more information. To configure the size of the memory region to be used for critical notifications (system logging messages), use the memory reserve critical command in global configuration mode. To disable the reservation of memory for critical notifications, use the no form of this command. memory reserve critical kilobytes no memory reserve critical Syntax Description Defaults 100 kilobytes of memory is reserved for the logging process. Command Modes Global configuration (config) Command History Usage Guidelines This command reserves a region of memory on the router so that, when system resources are overloaded, the router retains enough memory to issue critical system logging messages. Note Once the size of the reserved memory region is specified, any change to the specified value takes effect only after the current configuration is saved and the system has been reloaded. Examples The following example shows how to reserve 1,000 KB of system memory for logging messages at the next system restart: Router(config)# memory reserve critical 1000 kilobytes Specifies the amount of memory to be reserved in kilobytes. Valid values are 1 to 4294967295, but the value you specify cannot exceed 25 percent of total memory. The default is 100 kilobytes. Release Modification 12.2(18)S This command was introduced. 12.0(26)S This command was integrated into Cisco IOS Release 12.0(26)S. 12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T. 12.2(27)SBC This command was integrated into Cisco IOS Release 12.2(27)SBC. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.4(15)T1 This command was replaced by the memory reserve command. memory reserve critical CF-317 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description memory free low-watermark Configures a router to issue syslog notifications when available memory falls below a specified threshold. memory sanity CF-318 Cisco IOS Configuration Fundamentals Command Reference April 2010 memory sanity To perform a “sanity check” for corruption in buffers and queues, use the memory sanity command in global configuration mode. To disable this feature, use the no form of this command. memory sanity [buffer | queue | all] no memory sanity Syntax Description Defaults This command is not enabled by default. If the buffer or queue keyword is not specified, a sanity check will be performed on all buffers and queues. Command Modes Global configuration Command History Usage Guidelines When the memory sanity buffer command is enabled, a sanity check is performed on buffers when a packet buffer is allocated or when a packet buffer is returned to the buffer pool. This command also time-stamps the buffer, which may be useful when tracking the age of a buffer. The memory sanity command can be saved in the startup configuration file and, therefore, it is not necessary to reconfigure this command each time the router is reloaded. Like the scheduler heapcheck process memory command, the memory sanity command can check for corruption in the I/O memory block. Enabling the memory sanity command may result in slight router performance degradation. Examples The following example shows how to perform a sanity check for corruption in all buffers and queues: memory sanity all Related Commands buffer (Optional) Specifies checking all buffers. queue (Optional) Specifies checking all queues. all (Optional) Specifies checking all buffers and queues. Release Modification 12.2(15)T This command was introduced. Command Description scheduler heapcheck process memory Performs a “sanity check” for corruption in memory blocks when a process switch occurs. memory scan CF-319 Cisco IOS Configuration Fundamentals Command Reference April 2010 memory scan To enable the Memory Scan feature, use the memory scan command in global configuration mode. To restore the router configuration to the default, use the no form of this command. memory scan no memory scan Syntax Description This command has no arguments or keywords. Defaults This command is disabled by default. Command Modes Global configuration Command History Usage Guidelines The Memory Scan feature adds a low-priority background process that searches all installed dynamic random-access memory (DRAM) for possible parity errors. If errors are found in memory areas that are not in use, this feature attempts to scrub (remove) the errors. The time to complete one memory scan and scrub cycle can range from 10 minutes to several hours, depending on the amount of installed memory. The impact of the Memory Scan feature on the central processing unit (CPU) is minimal. To view the status of the memory scan feature on your router, use the show memory scan command in EXEC mode. Examples The following example enables the Memory Scan feature on a Cisco 7500 series router: Router(config)# memory scan Related Commands Release Modification 12.0(4)XE This command was introduced. 12.0(7)T This command was integrated in Cisco IOS Release 12.0 T for the Cisco 7500 series only. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show memory scan Displays the number and type of parity errors on your system. memory-size iomem CF-320 Cisco IOS Configuration Fundamentals Command Reference April 2010 memory-size iomem To reallocate the percentage of DRAM to use for I/O memory and processor memory on Cisco 3600 series routers, use the memory-size iomem command in global configuration mode. To revert to the default memory allocation, use the no form of this command. memory-size iomem i/o-memory-percentage no memory-size iomem i/o-memory-percentage Syntax Description Defaults The default memory allocation is 25 percent I/O memory and 75 percent processor memory. Note If the smartinit process has been enabled, the default memory allocation of 25 percent to I/O does not apply. Instead, smartinit examines the network modules and then calculates the I/O memory required. Command Modes Global configuration Command History Usage Guidelines When you specify the percentage of I/O memory in the command line, processor memory automatically acquires the remaining percentage of DRAM memory. Examples The following example allocates 40 percent of the DRAM memory to I/O memory and the remaining 60 percent to processor memory: Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)# memory-size iomem 40 Router(config)# exit Router# copy system:running-config nvram:startup-config Building configuration... [OK] Router# reload rommon 1 > boot program load complete, entry point: 0x80008000, size: 0x32ea24 i/o-memory-percentage The percentage of DRAM allocated to I/O memory. The values permitted are 10, 15, 20, 25, 30, 40, and 50. A minimum of 4 MB of memory is required for I/O memory. Release Modification 11.2 P This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. memory-size iomem CF-321 Cisco IOS Configuration Fundamentals Command Reference April 2010 Self decompressing the image : ########################################################################################## ########################################################################################## ################################################################## [OK] menu (EXEC) CF-322 Cisco IOS Configuration Fundamentals Command Reference April 2010 menu (EXEC) To display a preconfigured user menu, use the menu command in user EXEC or privileged EXEC mode. menu menu-name Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines A user menu is a type of user interface where text descriptions of actions to be performed are displayed to the user. The user can use the menu to select services and functions without having to know the details of command-line interface (CLI) commands. Menus can be created for users in global configuration mode, using the commands listed in the “Related Commands” section. A menu can be invoked at either the user or privileged EXEC level, but if an item in the menu contains a privileged EXEC command, the user must be logged in at the privileged level for the command to succeed. Examples The following example invokes a menu named OnRamp: Router> menu OnRamp Welcome to OnRamp Internet Services Type a number to select an option; Type 9 to exit the menu. 1 Read email 2 UNIX Internet access 3 Resume UNIX connection 6 Resume next connection 9 Exit menu system menu-name The name of the menu. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. menu (EXEC) CF-323 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description menu clear-screen Clears the terminal screen before displaying a menu. menu command Specifies underlying commands for user interface menus. menu default Specifies the menu item to use as the default. menu line-mode Requires the user to press Enter after specifying an option number. menu options Sets options for items in user interface menus. menu prompt Specifies the prompt for a user interface menu. menu single-space Displays menu items single-spaced rather than double-spaced. menu status-line Displays a line of status information about the current user at the top of a menu. menu text Specifies the text of a menu item in a user interface menu. menu title Creates a title, or banner, for a user menu. no menu Deletes a specified menu from a menu configuration. menu single-space CF-324 Cisco IOS Configuration Fundamentals Command Reference April 2010 menu single-space To display menu items single-spaced rather than double-spaced, use the menu single-space command in global configuration mode. menu menu-name single-space Syntax Description Defaults Enabled for menus with more than nine items; disabled for menus with nine or fewer items. Command Modes Global configuration Command History Usage Guidelines When more than nine menu items are defined, the menu is displayed single-spaced. To configure the menus with nine or fewer items to display single-spaced, use this command. Examples In the following example, single-spaced menu items are displayed for the menu named Access1: menu Access1 single-space Related Commands menu-name Name of the menu this command should be applied to. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description menu (EXEC) Invokes a user menu. menu clear-screen Clears the terminal screen before displaying a menu. menu command Specifies underlying commands for user menus. menu default Specifies the menu item to use as the default. menu line-mode Requires the user to press Enter after specifying an item. menu options Sets options for items in user menus. menu prompt Specifies the prompt for a user menu. menu status-line Displays a line of status information about the current user at the top of a menu. menu text Specifies the text of a menu item in a user menu. menu title Creates a title, or banner, for a user menu. menu clear-screen CF-325 Cisco IOS Configuration Fundamentals Command Reference April 2010 menu clear-screen To clear the terminal screen before displaying a menu, use the menu clear-screen command in global configuration mode. menu menu-name clear-screen Syntax Description Defaults Disabled Command Modes Global configuration Command History Usage Guidelines This command uses a terminal-independent mechanism based on termcap entries defined in the router and the configured terminal type for the user. This command allows the same menu to be used on multiple types of terminals instead of having terminal-specific strings embedded within menu titles. If the termcap entry does not contain a clear string, the menu system enters 24 new lines, causing all existing text to scroll off the top of the terminal screen. Examples In the following example, the terminal screen is cleared before displaying the menu named Access1: Router(config)# menu Access1 clear-screen Related Commands menu-name Name of the menu this command should be applied to. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description menu (EXEC) Invokes a user menu. menu command Specifies underlying commands for user menus. menu default Specifies the menu item to use as the default. menu line-mode Requires the user to press Enter after specifying an item. menu options Sets options for items in user menus. menu prompt Specifies the prompt for a user menu. menu single-space Displays menu items single-spaced rather than double-spaced. menu status-line Displays a line of status information about the current user at the top of a menu menu text Specifies the text of a menu item in a user menu. menu clear-screen CF-326 Cisco IOS Configuration Fundamentals Command Reference April 2010 menu title Creates a title, or banner, for a user menu. no menu Deletes a specified menu from a menu configuration. Command Description menu command CF-327 Cisco IOS Configuration Fundamentals Command Reference April 2010 menu command To specify underlying commands for user menus, use the menu command command in global configuration mode. menu menu-name command menu-item {command | menu-exit} Syntax Description Defaults Disabled Command Modes Global configuration Command History Usage Guidelines Use this command to assign actions to items in a menu. Use the menu text global configuration command to assign text to items. These commands must use the same menu name and menu selection key. The menu command command has a special keyword for the command argument, menu-exit, that is available only within menus. It is used to exit a submenu and return to the previous menu level, or to exit the menu altogether and return to the EXEC command prompt. You can create submenus that are opened by selecting entries in another menu. Use the menu EXEC command as the command for the submenu item. Note If you nest too many levels of menus, the system prints an error message on the terminal and returns to the previous menu level. When a menu allows connections (their normal use), the command for an entry activating the connection should contain a resume command, or the line should be configured to prevent users from escaping their sessions with the escape-char none command. Otherwise, when they escape from a connection and return to the menu, there will be no way to resume the session and it will sit idle until the user logs out. menu-name Name of the menu. You can specify a maximum of 20 characters. menu-item Number, character, or string used as the key for the item. The key is displayed to the left of the menu item text. You can specify a maximum of 18 menu entries. When the tenth item is added to the menu, the line-mode and single-space options are activated automatically. command Command to issue when the user selects an item. menu-exit Provides a way for menu users to return to a higher-level menu or exit the menu system. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. menu command CF-328 Cisco IOS Configuration Fundamentals Command Reference April 2010 Specifying the resume command as the action that is performed for a selected menu entry permits a user to resume a named connection or connect using the specified name, if there is no active connection by that name. As an option, you can also supply the connect string needed to connect initially. When you do not supply this connect string, the command uses the specified connection name. You can also use the resume/next command, which resumes the next connection in the user’s list of connections. This function allows you to create a single menu entry that steps through all of the user’s connections. Note A menu should not contain any exit paths that leave users in an unfamiliar interface environment. When a particular line should always display a menu, that line can be configured with an autocommand line configuration command. Menus can be run on a per-user basis by defining a similar autocommand command for that local username. For more information about the autocommand command, refer to the Cisco IOS Dial Technologies Configuration Guide. Examples In the following example, the commands to be issued when the menu user selects option 1, 2, or 3 are specified for the menu named Access1: menu Access1 command 1 tn3270 vms.cisco.com menu Access1 command 2 rlogin unix.cisco.com menu Access1 command 3 menu-exit The following example allows a menu user to exit a menu by entering Exit at the menu prompt: menu Access1 text Exit Exit menu Access1 command Exit menu-exit Related Commands Command Description autocommand Configures the Cisco IOS software to automatically execute a command when a user connects to a particular line. menu (EXEC) Invokes a user menu. menu clear-screen Clears the terminal screen before displaying a menu. menu default Specifies the menu item to use as the default. menu line-mode Requires the user to press Enter after specifying an item. menu options Sets options for items in user menus. menu prompt Specifies the prompt for a user menu. menu single-space Displays menu items single-spaced rather than double-spaced. menu status-line Displays a line of status information about the current user at the top of a menu menu text Specifies the text of a menu item in a user menu. menu title Creates a title, or banner, for a user menu. menu default CF-329 Cisco IOS Configuration Fundamentals Command Reference April 2010 menu default To specify the menu item to use as the default, use the menu default command in global configuration mode. menu menu-name default menu-item Syntax Description Defaults Disabled Command Modes Global configuration Command History Usage Guidelines Use this command to specify which menu entry is used when the user presses Enter without specifying an item. The menu entries are defined by the menu command and menu text global configuration commands. Examples In the following example, the menu user exits the menu when pressing Enter without selecting an item: menu Access1 9 text Exit the menu menu Access1 9 command menu-exit menu Access1 default 9 Related Commands menu-name Name of the menu. You can specify a maximum of 20 characters. menu-item Number, character, or string key of the item to use as the default. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description menu (EXEC) Invokes a preconfigured user menu. menu command Specifies underlying commands for user menus. menu prompt Specifies the prompt for a user menu. menu text Specifies the text of a menu item in a user menu. menu title Creates a title, or banner, for a user menu. menu line-mode CF-330 Cisco IOS Configuration Fundamentals Command Reference April 2010 menu line-mode To require the user to press Enter after specifying an item, use the menu line-mode command in global configuration mode. menu menu-name line-mode Syntax Description Defaults Enabled for menus with more than nine items. Disabled for menus with nine or fewer items. Command Modes Global configuration Command History Usage Guidelines In a menu of nine or fewer items, you ordinarily select a menu item by entering the item number. In line mode, you select a menu entry by entering the item number and pressing Enter. Line mode allows you to backspace over the selected number and enter another number before pressing Enter to issue the command. This option is activated automatically when more than nine menu items are defined but also can be configured explicitly for menus of nine or fewer items. In order to use strings as keys for items, the menu line-mode command must be configured. Examples In the following example, the line-mode option is enabled for the menu named Access1: menu Access1 line-mode Related Commands menu-name Name of the menu this command should be applied to. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description menu (EXEC) Invokes a preconfigured user menu. menu clear-screen Clears the terminal screen before displaying a menu. menu command Specifies underlying commands for a user menu. menu default Specifies the menu item to use as the default. menu options Sets options for items in user menus. menu prompt Specifies the prompt for a user menu. menu single-space Displays menu items single-spaced rather than double-spaced. menu line-mode CF-331 Cisco IOS Configuration Fundamentals Command Reference April 2010 menu status-line Displays a line of status information about the current user at the top of a menu. menu text Specifies the text of a menu item in a user menu. Command Description menu options CF-332 Cisco IOS Configuration Fundamentals Command Reference April 2010 menu options To set options for items in user menus, use the menu options command in global configuration mode. menu menu-name options menu-item {login | pause} Syntax Description Defaults Disabled Command Modes Global configuration Command History Usage Guidelines Use the menu command and menu text global configuration commands to define a menu entry. Examples In the following example, a login is required before issuing the command specified by menu entry 3 of the menu named Access1: menu Access1 options 3 login Related Commands menu-name The name of the menu. You can specify a maximum of 20 characters. menu-item Number, character, or string key of the item affected by the option. login Requires a login before issuing the command. pause Pauses after the command is entered before redrawing the menu. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description menu (EXEC) Invokes a user menu. menu clear-screen Clears the terminal screen before displaying a menu. menu command Specifies underlying commands for user menus. menu default Specifies the menu item to use as the default. menu line-mode Requires the user to press Enter after specifying an item. menu prompt Specifies the prompt for a user menu. menu single-space Displays menu items single-spaced rather than double-spaced. menu status-line Displays a line of status information about the current user at the top of a menu. menu text Specifies the text of a menu item in a user menu. menu title Creates a title, or banner, for a user menu. menu prompt CF-333 Cisco IOS Configuration Fundamentals Command Reference April 2010 menu prompt To specify the prompt for a user menu, use the menu prompt command in global configuration mode. menu menu-name prompt d prompt d Syntax Description Defaults Disabled Command Modes Global configuration Command History Usage Guidelines Press Enter after entering the first delimiter. The router will prompt you for the text of the prompt. Enter the text followed by the delimiter, and press Enter. Use the menu command and menu text commands to define the menu selections. Examples In the following example, the prompt for the menu named Access1 is configured as “Select an item.”: Router(config)# menu Access1 prompt / Enter TEXT message. End with the character '/'. Select an item. / Router(config)# Related Commands menu-name Name of the menu. You can specify a maximum of 20 characters. d A delimiting character that marks the beginning and end of a title. Text delimiters are characters that do not ordinarily appear within the text of a title, such as slash ( / ), double quote ("), and tilde (~). ^C is reserved for special use and should not be used in the text of the title. prompt Prompt string for the menu. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description menu (EXEC) Invokes a user menu. menu command Specifies underlying commands for user menus. menu default Specifies the menu item to use as the default. menu text Specifies the text of a menu item in a user menu. menu title Creates a title, or banner, for a user menu. menu status-line CF-334 Cisco IOS Configuration Fundamentals Command Reference April 2010 menu status-line To display a line of status information about the current user at the top of a menu, use the menu status-line command in global configuration mode. menu menu-name status-line Syntax Description Defaults Disabled Command Modes Global configuration Command History Usage Guidelines This command displays the status information at the top of the screen before the menu title is displayed. This status line includes the router’s host name, the user’s line number, and the current terminal type and keymap type (if any). Examples In the following example, status information is enabled for the menu named Access1: menu Access1 status-line Related Commands menu-name Name of the menu this command should be applied to. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description menu (EXEC) Invokes a user menu. menu clear-screen Clears the terminal screen before displaying a menu. menu command Specifies underlying commands for user menus. menu default Specifies the menu item to use as the default. menu line-mode Requires the user to press Enter after specifying an item in a menu. menu options Sets options for items in user menus. menu prompt Specifies the prompt for a user menu. menu single-space Displays menu items single-spaced rather than double-spaced. menu text Specifies the text of a menu item in a user menu. menu title Creates a title, or banner, for a user menu. menu text CF-335 Cisco IOS Configuration Fundamentals Command Reference April 2010 menu text To specify the text of a menu item in a user menu, use the menu text command in global configuration mode. menu menu-name text menu-item menu-text Syntax Description Defaults No text appears for the menu item. Command Modes Global configuration Command History Usage Guidelines Use this command to assign text to items in a menu. Use the menu command command to assign actions to items. These commands must use the same menu name and menu selection key. You can specify a maximum of 18 items in a menu. Examples In the following example, the descriptive text for the three entries is specified for options 1, 2, and 3 in the menu named Access1: menu Access1 text 1 IBM Information Systems menu Access1 text 2 UNIX Internet Access menu Access1 text 3 Exit menu system Related Commands menu-name Name of the menu. You can specify a maximum of 20 characters. menu-item Number, character, or string used as the key for the item. The key is displayed to the left of the menu item text. You can specify a maximum of 18 menu items. When the tenth item is added to the menu, the menu line-mode and menu single-space commands are activated automatically. menu-text Text of the menu item. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description menu (EXEC) Invokes a user menu. menu clear-screen Clears the terminal screen before displaying a menu. menu command Specifies underlying commands for user menus. menu default Specifies the menu item to use as the default. menu line-mode Requires the user to press Enter after specifying an item. menu text CF-336 Cisco IOS Configuration Fundamentals Command Reference April 2010 menu options Sets options for items in user menus. menu prompt Specifies the prompt for a user menu. menu single-space Displays menu items single-spaced rather than double-spaced. menu status-line Displays a line of status information about the current user at the top of a menu. menu title Creates a title, or banner, for a user menu. Command Description menu title CF-337 Cisco IOS Configuration Fundamentals Command Reference April 2010 menu title To create a title (banner) for a user menu, use the menu title command in global configuration mode. menu menu-name title d menu-title d Syntax Description Defaults The menu does not have a title. Command Modes Global configuration Command History Usage Guidelines The menu title command must use the same menu name used with the menu text and menu command commands used to create a menu. You can position the title of the menu horizontally by preceding the title text with blank characters. You can also add lines of space above and below the title by pressing Enter. Follow the title keyword with one or more blank characters and a delimiting character of your choice. Then enter one or more lines of text, ending the title with the same delimiting character. You cannot use the delimiting character within the text of the message. When you are configuring from a terminal and are attempting to include special control characters, such as a screen-clearing string, you must use Ctrl-V before the special control characters so that they are accepted as part of the title string. The string ^[[H^[[J is an escape string used by many VT100-compatible terminals to clear the screen. To use a special string, you must enter Ctrl-V before each escape character. You also can use the menu clear-screen global configuration command to clear the screen before displaying menus and submenus, instead of embedding a terminal-specific string in the menu title. The menu clear-screen command allows the same menu to be used on different types of terminals. menu-name Name of the menu. You can specify a maximum of 20 characters. d A delimiting character that marks the beginning and end of a title. Text delimiters are characters that do not ordinarily appear within the text of a title, such as slash ( / ), double quote ("), and tilde (~). ^C is reserved for special use and should not be used in the text of the title. menu-title Lines of text to appear at the top of the menu. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. menu title CF-338 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, the title that will be displayed is specified when the menu named Access1 is invoked. Press Enter after the second slash (/) to display the prompt. Router(config)# menu Access1 title /^[[H^[[J Enter TEXT message. End with the character '/'. Welcome to Access1 Internet Services Type a number to select an option; Type 9 to exit the menu. / Router(config)# Related Commands Command Description menu (EXEC) Invokes a user menu. menu clear-screen Clears the terminal screen before displaying a menu. menu command Specifies underlying commands for user menus. menu default Specifies the menu item to use as the default. menu line-mode Requires the user to press Enter after specifying an item. menu options Sets options for items in user menus. menu prompt Specifies the prompt for a user menu. menu single-space Displays menu items single-spaced rather than double-spaced. menu status-line Displays a line of status information about the current user at the top of a menu. menu text Specifies the text of a menu item in a user menu. microcode (12000) CF-339 Cisco IOS Configuration Fundamentals Command Reference April 2010 microcode (12000) To load a Cisco IOS software image on a line card from Flash memory or the GRP card on a Cisco 12000 series Gigabit Switch Router (GSR), use the microcode command in global configuration mode. To load the microcode bundled with the GRP system image, use the no form of this command. microcode {oc12-atm | oc12-pos | oc3-pos4} {flash file-id [slot] | system [slot]} no microcode {oc12-atm | oc12-pos | oc3-pos4} [flash file-id [slot] | system [slot]] Syntax Description Defaults The default is to load the image from the GRP card (system). Command Modes Global configuration Command History Usage Guidelines In addition to the Cisco IOS image that resides on the GRP card, each line card on a Cisco 12000 series has a Cisco IOS image. When the router is reloaded, the specified image is loaded onto the GRP card and then automatically downloaded to all the line cards. Normally, you want the same Cisco IOS image on the GRP card and all line cards. However, if you want to upgrade a line card with a new version of microcode for testing or to fix a defect, you might need to load a Cisco IOS image that is different from the one on the line card. Additionally, you might need to load a new image on the line card to work around a problem that is affecting only one of the line cards. oc12-atm | oc12-pos | oc3-pos4 Interface name. flash Loads the image from the Flash file system. file-id Specifies the device and filename of the image file to download from Flash memory. A colon (:) must separate the device and filename (for example, slot0:gsr-p-mz). Valid devices include: • bootflash:—Internal Flash memory. • slot0:—First PCMCIA slot. • slot1:—Second PCMCIA slot. slot (Optional) Slot number of the line card that you want to copy the software image to. Slot numbers range from 0 to 11 for the Cisco 12012 router and 0 to 7 for the Cisco 12008 router. If you do not specify a slot number, the Cisco IOS software image is downloaded on all line cards. system Loads the image from the software image on the GRP card. Release Modification 11.2 GS This command was introduced for Cisco 12000 series GSRs. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. microcode (12000) CF-340 Cisco IOS Configuration Fundamentals Command Reference April 2010 To load a Cisco IOS image on a line card, first use the copy tftp command to download the Cisco IOS image to a slot on one of the PCMCIA Flash memory cards. Then use the microcode command to download the image to the line card, followed by the microcode reload command to start the image. Immediately after you enter the microcode reload command and press Return, the system reloads all microcode. Global configuration mode remains enabled. After the reloading is complete, enter the exit command to return to the EXEC system prompt. To verify that the correct image is running on the line card, use the execute-on slot slot show version command. For additional information on GSR configuration, refer to the documentation specific to your Cisco IOS software release. Examples In the following example, the Cisco IOS software image in slot 0 is downloaded to the line card in slot 10. This software image is used when the system is booted, a line card is inserted or removed, or the microcode reload global configuration command is issued. Router(config)# microcode oc3-POS-4 flash slot0:fip.v141-7 10 Router(config)# microcode reload 10 In this example, the user would issue the execute-on slot 10 show version command to verify that the correct version is loaded. Related Commands Command Description microcode reload (12000) Reloads microcode on Cisco 12000 series GSRs. microcode (7000/7500) CF-341 Cisco IOS Configuration Fundamentals Command Reference April 2010 microcode (7000/7500) To specify the location of the microcode that you want to download from Flash memory into the writable control store (WCS) on Cisco 7000 series (including RSP based routers) or Cisco 7500 series routers, use the microcode command in global configuration mode. To load the microcode bundled with the system image, use the no form of this command. microcode interface-type {flash-filesystem:filename [slot] | rom | system [slot]]} no microcode interface-type {flash-filesystem:filename [slot] | rom | system [slot]} Syntax Description Defaults The default is to load from the microcode bundled in the system image. Command Modes Global configuration Command History Usage Guidelines If you do not use the microcode reload command after using the microcode command, the microcode reload command will be written to the configuration file automatically. When using Dual RSPs for simple hardware backup, ensure that the master and slave RSP card contain the same microcode image in the same location when the router is to load the interface processor microcode from a Flash file system. Thus, if the slave RSP becomes the master, it will be able to find the microcode image and download it to the interface processor. interface-type One of the following interface processor names: aip, cip, eip, feip, fip, fsip, hip, mip, sip, sp, ssp, trip, vip, or vip2. flash-filesystem: Flash file system, followed by a colon. Valid file systems are bootflash, slot0, and slot1. Slave devices such as slaveslot0 are invalid. The slave’s file system is not available during microcode reloads. filename Name of the microcode file. slot (Optional) Number of the slot. Range is from 0 to 15. rom If ROM is specified, the router loads from the onboard ROM microcode. system If the system keyword is specified, the router loads the microcode from the microcode bundled into the system image you are running for that interface type. Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. microcode (7000/7500) CF-342 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, all FIP cards will be loaded with the microcode found in Flash memory file fip.v141-7 when the system is booted, when a card is inserted or removed, or when the microcode reload global configuration command is issued. The configuration is then written to the startup configuration file. Router(config)# microcode fip slot0:fip.v141-7 Router(config)# end Router# copy system:running-config nvram:startup-config Related Commands Command Description more flh:logfile Displays the system console output generated during the Flash load helper operation. microcode (7200) CF-343 Cisco IOS Configuration Fundamentals Command Reference April 2010 microcode (7200) To configure a default override for the microcode that is downloaded to the hardware on a Cisco 7200 series router, use the microcode command in global configuration mode. To revert to the default microcode for the current running version of the Cisco IOS software, use the no form of this command. microcode {ecpa | pcpa} location no microcode {ecpa | pcpa} Syntax Description Defaults If the default or no form of the command is specified, the driver uses the default microcode for the current running version of the Cisco IOS software. Command Modes Global configuration Command History Usage Guidelines If there are any default overrides when the configuration is written, then the microcode reload command will be written to the configuration automatically. This action enables the configured microcode to be downloaded at system startup. The CPA microcode image is preloaded on Flash memory cards for Cisco 7200-series routers for Cisco IOS Release 11.3(3)T and later releases. You may be required to copy a new image to Flash memory when a new microcode image becomes available. For more information on the CPA configuration and maintenance, refer to the “Configuring Cisco Mainframe Channel Connection Adapters” chapter in the Release 12.2 Cisco IOS Bridging and IBM Networking Configuration Guide. Examples The following example instructs the Cisco IOS software to load the microcode from an individual microcode image that is stored as a file on the Flash card inserted in Flash card slot 0: microcode ecpa slot0:xcpa26-1 ecpa ESCON Channel Port Adapter (CPA) interface. pcpa Parallel CPA interface. location Location of microcode, including the device and filename. Release Modification 11.3(3)T This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. microcode (7200) CF-344 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description microcode reload (7200) Resets and reloads the specified hardware in a Cisco 7200 series router. show microcode Displays microcode information. microcode reload (12000) CF-345 Cisco IOS Configuration Fundamentals Command Reference April 2010 microcode reload (12000) To reload the Cisco IOS image from a line card on Cisco 12000 series routers, use the microcode reload command in global configuration mode. microcode reload [slot-number] Syntax Description Command Modes Global configuration Command History Usage Guidelines In addition to the Cisco IOS image that resides on the GRP card, each line card on Cisco 12000 series routers has a Cisco IOS image. When the router is reloaded, the specified Cisco IOS image is loaded onto the GRP card and automatically downloaded to all the line cards. Normally, you want the same Cisco IOS image on the GRP card and all line cards. However, if you want to upgrade a line card with a new version of microcode for testing or to fix a defect, you might need to load a different Cisco IOS image. Additionally, you might need to load a new image on the line card to work around a problem affecting only one of the line cards. To load a Cisco IOS image on a line card, first use the copy tftp command to download the Cisco IOS image to a slot on one of the PCMCIA Flash memory cards. Then use the microcode command to download the image to the line card, followed by the microcode reload command to start the image. To verify that the correct image is running on the line card, use the execute-on slot slot show version command. For additional information on GSR configuration, refer to the “Observing System Startup and Performing a Basic Configuration” chapter in the Cisco 12000 series installation and configuration guides. The microcode reload (12000) command allows you to issue another command immediately. Note Issuing a microcode reload command on any of the line cards in a Cisco 12000 GSR immediately returns the console command prompt. This allows you to issue a subsequent command immediately to the reloading line card. However, any commands entered at this time will not execute, and often no indication will be given that such a command failed to run. Verify that the microcode has reloaded before issuing new commands. slot-number (Optional) Slot number of the line card that you want to reload the Cisco IOS software image on. Slot numbers range from 0 to 11 for the Cisco 12012 and from 0 to 7 for the Cisco 12008 router. If you do not specify a slot number, the Cisco IOS software image is reloaded on all line cards. Release Modification 11.2 GS This command was introduced for Cisco 12000 series GSRs. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. microcode reload (12000) CF-346 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, the mirocode firmware is reloaded on the line card in slot 10: Router(config)# microcode reload 10 Related Commands Command Description microcode (12000) Loads a Cisco IOS software image on a line card from Flash memory or the GRP card on a Cisco 12000 series GSR. microcode reload (7000/7500) CF-347 Cisco IOS Configuration Fundamentals Command Reference April 2010 microcode reload (7000/7500) To reload the processor card on the Cisco 7000 series with RSP7000 or Cisco 7500 series routers, use the microcode reload command in global configuration mode. microcode reload [slot-number] Syntax Description Defaults No default behaviors or values. Command Modes Global configuration Command History Usage Guidelines This command reloads the microcode without rebooting the router. Immediately after you enter the microcode reload command, the system reloads all microcode. Global configuration mode remains enabled. Note If you modify the system configuration to load a microcode image, the microcode reload command will be written to the configuration file automatically following the use of a microcode command. This action enables the configured microcode to be downloaded at system startup. Examples In the following example, all controllers are reset, and the microcode specified in the current configuration is loaded: Router(config)# microcode reload Related Commands slot-number (Optional) Reloads the specified processor card slot on a Cisco 7500 series router. Release Modification 10.3 This command was introduced for Cisco 7500 series routers. 12.3(8)T The slot-number argument was added for Cisco 7500 series routers. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description microcode (7000/7500) Specifies the location from where microcode should be loaded when the microcode reload command is processed on RSP-based routers. microcode reload (7200) CF-348 Cisco IOS Configuration Fundamentals Command Reference April 2010 microcode reload (7200) To reload the Cisco IOS microcode image on an ESCON CPA card in the Cisco 7200 series router, use the microcode reload command in privileged EXEC mode. microcode reload {all | ecpa [slot slot-number] | pcpa [slot slot-number]} Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Hardware types that do not support downloadable microcode are unaffected by the microcode reload all command. You will be prompted for confirmation before the microcode reload command is executed. Examples The following example reloads the ESCON CPA microcode in slot 5 with the currently configured microcode: Router# microcode reload ecpa slot 5 Related Commands all Resets and reloads all hardware types that support downloadable microcode. ecpa Resets and reloads only those slots that contain hardware type ecpa. pcpa Resets and reloads only those slots that contain hardware type pcpa. slot slot-number (Optional) Resets and reloads only the slot specified, and only if it contains the hardware specified. Release Modification 11.3(3)T This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description microcode (7200) Configures a default override for the microcode that is downloaded to the hardware on a Cisco 7200 series router. show microcode Displays the microcode bundled into a Cisco 7000 series with RSP7000, Cisco 7200 series, or Cisco 7500 series router. mkdir CF-349 Cisco IOS Configuration Fundamentals Command Reference April 2010 mkdir To create a new directory in a Class C Flash file system, use the mkdir command in EXEC, privileged EXEC, or diagnostic mode. mkdir directory Syntax Description Command Modes EXEC (>) Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines This command is only valid on Class C Flash file systems. If you do not specify the directory name in the command line, the router prompts you for it. Examples The following example creates a directory named newdir: Router# mkdir newdir Mkdir file name [newdir]? Created dir flash:newdir Router# dir Directory of flash: 2 drwx 0 Mar 13 1993 13:16:21 newdir 8128000 bytes total (8126976 bytes free) directory The name of the directory to create. Release Modification 11.3 AA This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Routers and the following enhancements were introduced: • This command was introduced in diagnostic mode for the first time. The command can be entered in both privileged EXEC and diagnostic mode on the Cisco ASR 1000 Series Routers. • The harddisk:, obfl:, stby-harddisk:, stby-nvram:, stby-obfl:, stby-usb[0-1]:,and usb[0-1]: directory options were introduced. mkdir CF-350 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description dir Displays a list of files on a file system. rmdir Removes an existing directory in a Class C Flash file system. mkdir disk0: CF-351 Cisco IOS Configuration Fundamentals Command Reference April 2010 mkdir disk0: To create a new directory in a Flash file system, use the mkdir disk0: command. mkdir disk0: Syntax Description This command has no arguments or keywords. Defaults This command has no default settings. Command Modes EXEC Command History Usage Guidelines This command is valid only on Flash file systems. After you enter the mkdir disk0: command, you are prompted to enter the new directory filename. To check your entry, enter the dir command. To remove a directory, enter the rmdir command. Examples This example shows how to create a directory named newdir: Router# mkdir disk0: Create directory filename [ ]? newdir Created dir disk0: newdir Router# Related Commands Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to the 12.2 SX release. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description cd Changes the default directory or file system. dir Displays a list of files on a file system. rmdir Removes an existing directory in a Class C Flash file system. mode CF-352 Cisco IOS Configuration Fundamentals Command Reference April 2010 mode To set the redundancy mode, use the mode command in redundancy configuration mode. Syntax for 12.2S Release mode {rpr | rpr-plus | sso} Syntax for Cisco IOS XE Release 2.5 and Later Releases mode {rpr | sso} Syntax for 12.2XNE Release mode sso Syntax Description Command Default Cisco 7600 series routers That Are Configured with a Supervisor Engine 720 • The default is SSO mode if the system is not configured for redundancy and the active and standby supervisor engines have the same image. • The default is RPR mode if different versions are installed. • If redundancy is enabled, the default is the mode that you have configured. Cisco 7600 series routers That Are Configured with a Supervisor Engine 2 • The default is RPR+ mode if the system is not configured for redundancy and the active and standby supervisor engines have the same image. • The default is RPR mode if different versions are installed. • If redundancy is enabled, the default is the mode that you have configured. Cisco ASR 1000 Series Aggregation Services Routers That Are Configured with a Supervisor Engine • The default is SSO mode if the system is not configured for redundancy and the active and standby supervisor engines have the same image. • The default is RPR mode if different versions are installed. Cisco 10000 Router That Is Configured with a Supervisor Engine • The default is SSO mode if the system is not configured for redundancy and the active and standby supervisor engines have the same image. • The default is RPR mode if different versions are installed. Command Modes Redundancy configuration (config-red) rpr Specifies Route Processor Redundancy (RPR) mode. rpr-plus Specifies Route Processor Redundancy Plus (RPR+) mode. sso Specifies stateful switchover (SSO) mode. mode CF-353 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command History Usage Guidelines Cisco IOS Release 12.2S and 7600 Series Routers SSO is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2. On releases prior to Release 12.2(17d)SXB, single router mode (SRM) with SSO redundancy does not support stateful switchover for multicast traffic. When a switchover occurs, all multicast hardware switching entries are removed and are then re-created and reinstalled in the hardware by the newly active multilayer switch feature card (MSFC). SRM/SSO is supported in the following releases only: • Release 12.2(17b)SXA and subsequent rebuilds. • Release 12.2(17d)SXB and subsequent rebuilds. Nonstop forwarding (NSF) with SSO redundancy mode supports IPv4. NSF with SSO redundancy mode does not support IPv6, Internetwork Packet Exchange (IPX), and Multiprotocol Label Switching (MPLS). If you have configured MPLS on the Cisco 7600 series routers with redundant supervisor engines, you must configure the Cisco 7600 series router in RPR mode. The switch should not be running in the default mode of SSO. Enter the redundancy command in global configuration mode to enter redundancy configuration mode. You can enter the mode command within redundancy configuration mode. Follow these guidelines when configuring your system for RPR+ mode: • You must install compatible images on the active and standby supervisor engines to support RPR+ mode and SSO mode. • Both supervisor engines must run the same Cisco IOS software version. • Any modules that are not online at the time of a switchover are reset and reloaded on a switchover. • The Forwarding Information Base (FIB) tables are cleared on a switchover. As a result, routed traffic is interrupted until route tables reconverge. The standby supervisor engine reloads on any change of mode and begins to work in the current mode. When you use this command to force the standby supervisor engine to run as a Distributed Forwarding Card (DFC) card, the uplink ports in the standby engine continue to be in use and are not disabled. Release Modification 12.2(14)SX This command was introduced on the Supervisor Engine 720. 12.2(17b)SXA This command was modified. Support was added for SSO mode and the default mode change. 12.2(17d)SXB This command was modified. Support was added for multicast and unicast traffic. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)XNE This command was modified. This command was implemented on the Cisco 10000 router. Cisco IOS XE Release 2.5 This command was modified. This command was implemented on the Cisco ASR 1000 Series Routers. mode CF-354 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco IOS Release XE Release 2.5 and ASR 1000 Series Routers For Cisco ASR 1002 and 1004 routers, RRP and stateful switchover can be used to switch between Cisco IOS processes. RPR and SSO need to be configured by the user, however, because a second Cisco IOS process is not available by default on Cisco ASR 1002 and 1004 routers. Enter the redundancy command in global configuration mode to enter redundancy configuration mode. You can enter the mode command within redundancy configuration mode. The Cisco ASR 1006 Router supports a second Route Processor. The second Cisco IOS process can run only on the standby Route Processor. This means that hardware redundancy is available and RPR and SSO do not need to be configured by the user because a second Cisco IOS process is available by default on the Cisco ASR 1006 router. RPR+ mode is not supported on the Cisco ASR 1000 Series Routers. Cisco IOS Release 12.2XNE and 1000 Series Routers Enter the redundancy command in global configuration mode to enter redundancy configuration mode. You can enter the mode command within redundancy configuration mode. RPR mode is not supported on the Cisco 10000 router. Examples This example shows how to set the redundancy mode to RPR+: Router(config)# redundancy Router(config-red)# mode rpr-plus This example shows how to set the redundancy mode to SSO: Router(config)# redundancy Router(config-red)# mode sso Related Commands Command Description redundancy Enters redundancy configuration mode. redundancy force-switchover Forces a switchover from the active to the standby supervisor engine. route-converge-interval Configures the time interval after which the old FIB entries are purged. show redundancy Displays RF information. show running-config Displays the status and configuration of the module or Layer 2 VLAN. CF-355 Cisco IOS Configuration Fundamentals Command Reference April 2010 monitor event-trace (EXEC) CF-356 Cisco IOS Configuration Fundamentals Command Reference April 2010 monitor event-trace (EXEC) To monitor and control the event trace function for a specified Cisco IOS software subsystem component, use the monitor event-trace command in privileged EXEC mode. monitor event-trace component {clear | continuous | disable | dump [pretty] | enable | one-shot} Cisco 10000 Series Routers monitor event-trace component {disable | dump | enable | size | stacktrace} Catalyst 6500 Series Switches and Cisco 7600 Series Routers monitor event-trace all-traces {continuous [cancel] | dump [merged] [pretty]} monitor event-trace l3 {clear | continuous [cancel] | disable | dump [pretty] | enable | interface type mod/port | one-shot} monitor event-trace spa {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot} monitor event-trace subsys {clear | continuous [cancel] | disable | dump [pretty] | enable | one-shot} Syntax Description component Name of the Cisco IOS software subsystem component that is the subject of the event trace. To get a list of components that support event tracing, use the monitor event-trace ? command. clear Clears existing trace messages for the specified component from memory on the networking device. continuous Continuously displays the latest event trace entries. disable Turns off event tracing for the specified component. dump Writes the event trace results to the file configured using the monitor event-trace command in global configuration mode. The trace messages are saved in binary format. pretty (Optional) Saves the event trace message in ASCII format. enable Turns on event tracing for the specified component. one-shot Clears any existing trace information from memory, starts event tracing again, and disables the trace when the trace reaches the size specified using the monitor event-trace command in global configuration mode. size Sets the number of messages that can be written to memory for a single instance of a trace. Note Some Cisco IOS software subsystem components set the size by default. To display the size parameter, use the show monitor event-trace component parameters command. When the number of event trace messages in memory exceeds the size, new messages will begin to overwrite the older messages in the file. stacktrace Enables the stack trace at tracepoints. all-traces Displays the configured merged-event traces. monitor event-trace (EXEC) CF-357 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Default The event trace function is disabled by default. Command Modes Privileged EXEC (#) Command History Usage Guidelines Use the monitor event-trace command to control what, when, and how event trace data is collected. Use this command after you have configured the event trace functionality on the networking device using the monitor event-trace command in global configuration mode. Note The amount of data collected from the trace depends on the trace message size configured using the monitor event-trace command in global configuration mode for each instance of a trace. The Cisco IOS software allows for the subsystem components to define whether support for event tracing is enabled or disabled at boot time. You can enable or disable event tracing in two ways: using the monitor event-trace command in privileged EXEC mode or using the monitor event-trace command in global configuration mode. To disable event tracing, you would enter either of these commands with the disable keyword. To enable event tracing again, you would enter either of these commands with the enable keyword. To determine whether you can enable event tracing on a subsystem, use the monitor event-trace ? command to get a list of software components that support event tracing. To determine whether event tracing is enabled by default for the subsystem, use the show monitor event-trace command to display trace messages. merged (Optional) Dumps the entries in all event traces sorted by time. l3 Displays information about the Layer 3 trace. spa Displays information about the Shared Port Adapter (SPA) trace. interface type mod/port Specifies the interface to be logged. cancel (Optional) Cancels the continuous display of latest trace entries. subsys Displays information about the subsystem’s initial trace. Release Modification 12.0(18)S This command was introduced. 12.2(8)T This command was integrated into Cisco IOS Release 12.2(8)T. 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. The monitor event-trace cef ipv4 clear command replaces the clear ip cef event-log command. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB and implemented on the Cisco 10000 series routers. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.4(20)T This command was integrated into Cisco IOS Release 12.4(20)T. monitor event-trace (EXEC) CF-358 Cisco IOS Configuration Fundamentals Command Reference April 2010 Use the show monitor event-trace command to display trace messages. Use the monitor event-trace component dump command to save trace message information for a single event. By default, trace information is saved in binary format. If you want to save trace messages in ASCII format, possibly for additional application processing, use the monitor event-trace component dump pretty command. To write the trace messages for all events currently enabled on a networking device to a file, enter the monitor event-trace dump command. To configure the file where you want to save trace information, use the monitor event-trace command in global configuration mode. The trace messages are saved in a binary format. Examples The following example shows the privileged EXEC commands to stop event tracing, clear the current contents of memory, and reenable the trace function for the interprocess communication (IPC) component. This example assumes that the tracing function is configured and enabled on the networking device. Router# monitor event-trace ipc disable Router# monitor event-trace ipc clear Router# monitor event-trace ipc enable The following example shows how the monitor event-trace one-shot command accomplishes the same function as the previous example except in one command. In this example, once the size of the trace message file has been exceeded, the trace is terminated. Router# monitor event-trace ipc one-shot The following example shows the command for writing trace messages for an event in binary format. In this example, the trace messages for the IPC component are written to a file. Router# monitor event-trace ipc dump The following example shows the command for writing trace messages for an event in ASCII format. In this example, the trace messages for the MBUS component are written to a file. Router# monitor event-trace mbus dump pretty Catalyst 6500 Series Switches and Cisco 7600 Series Routers Examples Only This example shows how to stop event tracing, clear the current contents of memory, and reenable the trace function for the SPA component. This example assumes that the tracing function is configured and enabled on the networking device. Router# monitor event-trace spa disable Router# monitor event-trace spa clear Router# monitor event-trace spa enable Related Commands Command Description monitor event-trace (global) Configures event tracing for a specified Cisco IOS software subsystem component. monitor event-trace dump-traces Saves trace messages for all event traces currently enabled on the networking device. show monitor event-trace Displays event trace messages for Cisco IOS software subsystem components. monitor event-trace (global) CF-359 Cisco IOS Configuration Fundamentals Command Reference April 2010 monitor event-trace (global) To configure event tracing for a specified Cisco IOS software subsystem component, use the monitor event-trace command in global configuration mode. monitor event-trace component {disable | dump-file filename | enable | size number | stacktrace number} monitor event-trace timestamps [datetime [localtime] [msec] [show-timezone] | uptime] Cisco 10000 Series Routers monitor event-trace component {disable | dump-file filename | enable | clear | continuous | one-shot} Syntax Description component Name of the Cisco IOS software subsystem component that is the object of the event trace. To get a list of components that support event tracing, use the monitor event-trace ? command. disable Turns off event tracing for the specified component. dump-file filename Specifies the file where event trace messages are written from memory on the networking device. The maximum length of the filename (path and filename) is 100 characters, and the path can point to flash memory on the networking device or to a TFTP or FTP server. enable Turns on event tracing for the specified component provided that the component has been configured using the monitor event-trace command. size number Sets the number of messages that can be written to memory for a single instance of a trace. Valid values are from1 to 65536. Note Some Cisco IOS software subsystem components set the size by default. To display the size parameter, use the show monitor event-trace component parameters command. When the number of event trace messages in memory exceeds the configured size, new messages will begin to overwrite the older messages in the file. stacktrace number Enables the stack trace at tracepoints and specifies the depth of the stack trace stored. Valid values are from 1 to 16. timestamps Includes time stamp information with the event trace messages for the specified component. datetime (Optional) Specifies that the time stamp information included with event trace messages will consist of the date and time of the event trace. localtime (Optional) Specifies that the time given in the time stamp will be local time. msec (Optional) Includes milliseconds in the time stamp. show-timezone (Optional) Includes time zone information in the time stamp. uptime (Optional) Displays time stamped information about the system uptime. clear Clears existing trace messages for the specified component from memory on the networking device. monitor event-trace (global) CF-360 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Default Event tracing is enabled or disabled depending on the software component. Command Modes Global configuration (config) Command History Usage Guidelines Use the monitor event-trace command to enable or disable event tracing and to configure event trace parameters for Cisco IOS software subsystem components. Note Event tracing is intended for use as a software diagnostic tool and should be configured only under the direction of a Technical Assistance Center (TAC) representative. In Cisco IOS software images that do not provide subsystem support for the event trace function, the monitor event-trace command is not available. The Cisco IOS software allows the subsystem components to define whether support for event tracing is enabled or disabled by default. The command interface for event tracing allows you to change the default two ways: using the monitor event-trace command in privileged EXEC mode or using the monitor event-trace command in global configuration mode. Additionally, default settings do not show up in the configuration file. If the subsystem software enables event tracing by default, the monitor event-trace component enable command will not show up in the configuration file of the networking device; however, disabling event tracing that has been enabled by default by the subsystem will create a command entry in the configuration file. Note The amount of data collected from the trace depends on the trace message size configured using the monitor event-trace command for each instance of a trace. To determine whether you can enable event tracing on a subsystem, use the monitor event-trace ? command to get a list of software components that support event tracing. continuous Continuously displays the latest event trace entries. one-shot Clears any existing trace information from memory, starts event tracing again, and disables the trace when the trace reaches the size specified using the monitor event-trace command. Release Modification 12.0(18)S This command was introduced. 12.2(8)T This command was integrated into Cisco IOS Release 12.2(8)T. 12.2(14)SX This command was integrated into Cisco IOS Release 12.2(14)SX and implemented on the Supervisor Engine 720. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB and implemented on the Cisco 10000 series routers. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.4(20)T This command was integrated into Cisco IOS Release 12.4(20)T. monitor event-trace (global) CF-361 Cisco IOS Configuration Fundamentals Command Reference April 2010 To determine whether event tracing is enabled by default for the subsystem, use the show monitor event-trace command to display trace messages. To specify the trace call stack at tracepoints, you must first clear the trace buffer. Examples The following example shows how to enable event tracing for the interprocess communication (IPC) subsystem component in Cisco IOS software and configure the size to 4096 messages. The trace messages file is set to ipc-dump in slot0 (flash memory). configure terminal ! monitor event-trace ipc enable monitor event-trace ipc dump-file slot0:ipc-dump monitor event-trace ipc size 4096 When you select Cisco Express Forwarding as the component for which to enable event tracing, you can use the following additional arguments and keywords: monitor event-trace cef [events | interface | ipv6 | ipv4][all]. The following example shows how to enable event tracing for IPv4 or IPv6 events of the Cisco Express Forwarding component in Cisco IOS software: configure terminal ! monitor event-trace cef ipv4 enable configure terminal ! monitor event-trace cef ipv6 enable exit The following example shows what happens when you try to enable event tracing for a component (in this case, adjacency events) when it is already enabled: configure terminal ! monitor event-trace adjacency enable %EVENT_TRACE-6-ENABLE: Trace already enabled. Related Commands Command Description monitor event-trace (EXEC) Controls the event trace function for a specified Cisco IOS software subsystem component. monitor event-trace dump-traces Saves trace messages for all event traces currently enabled on the networking device. show monitor event-trace Displays event trace messages for Cisco IOS software subsystem components. monitor event-trace dump-traces CF-362 Cisco IOS Configuration Fundamentals Command Reference April 2010 monitor event-trace dump-traces To save trace messages for all event traces currently enabled on the networking device, use the monitor event-trace dump-traces command in privileged EXEC mode. monitor event-trace dump-traces [pretty] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Use the monitor event-trace dump-traces command to save trace message information for all event traces currently enabled on a networking device. By default, trace information is saved in binary format. If you want to save trace messages in ASCII format, possibly for additional application processing, use the monitor event-trace dump-traces pretty command. To write the trace messages for an individual trace event to a file, enter the monitor event-trace (EXEC) command. To configure the file where you want to save messages, use the monitor event-trace (global) command. Examples The following example shows how to save the trace messages in binary format for all event traces enabled on the networking device. monitor event-trace dump-traces The following example shows how to save the trace messages in ASCII format for all event traces enabled on the networking device. monitor event-trace dump-traces pretty Related Commands pretty (Optional) Saves the event trace message in ASCII format. Release Modification 12.0(18)S This command was introduced. 12.2(8)T This command was integrated into Cisco IOS Release 12.2(8)T. Command Description monitor event-trace (EXEC) Controls event trace function for a specified Cisco IOS software subsystem component. monitor event-trace (global) Configures event tracing for a specified Cisco IOS software subsystem component. show monitor event-trace Displays event trace messages for Cisco IOS software subsystem components. monitor permit-list CF-363 Cisco IOS Configuration Fundamentals Command Reference April 2010 monitor permit-list To configure a destination port permit list or add to an existing destination port permit list, use the monitor permit-list command in global configuration mode. To delete from or clear an existing destination port permit list, use the no form of this command. Activate monitoring monitor permit-list no monitor permit-list Activate monitoring on one port monitor permit-list destination interface interface-type slot/port no monitor permit-list destination interface interface-type slot/port Activate monitoring on one range of ports monitor permit-list destination interface interface-type slot/port-last-port no monitor permit-list destination interface interface-type slot/port-last-port Activate monitoring on two or more ranges of ports monitor permit-list destination interface interface-type slot/port-last-port , [port-last-port ] no monitor permit-list destination interface interface-type slot/port-last-port , [port-last-port ] Syntax Description Defaults Disabled Command Modes Global configuration destination Specifies a destination port. interface interface-type Specifies the interface type; valid values are ethernet, fastethernet, gigabitethernet, or tengigabitethernet. slot The slot that the interface module is installed in. port Specifies a single port on an interface module, or the first port on an interface module used in a range of ports. last-port (Optional) Specifies the port on an interface module used as the last port in a range of ports. , (Optional) Separates each instance of a port, or range of ports, that are monitored. See the Usage Guidelines and the Examples for more information. monitor permit-list CF-364 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command History Usage Guidelines To prevent accidental configuration of ports as destinations, you can create a permit list of the ports that are valid for use as destinations. With a destination port permit list configured, you can only configure the ports in the permit list as destinations. When you enter multiple instances of interface interface-type slot/port-last-port, you must enter a space before and after the comma. For example, interface interface-type slot/port-last-port , interface-type slot/port-last-port , interface-type slot/port-last-port. Examples This example shows how to configure a destination port permit list that includes Gigabit Ethernet ports 5/1 through 5/4, and activate monitoring: Router# configure terminal Router(config)# monitor permit-list destination interface gigabitethernet 5/1-4 Router(config)# monitor permit-list This example shows how to configure a destination port permit list that includes Fast Ethernet ports 1/1-48, 2/1-48, and Gigabit Ethernet ports 3/1 through 3/4, and activate monitoring: Router# configure terminal Router(config)# monitor permit-list destination interface fastEthernet 1/1-48 , fastEthernet 2/1-48 , gigabitEthernet 3/1-4 Router(config)# monitor permit-list Related Commands Release Modification 12.2(18)SXE Support for this command was introduced on the Supervisor Engine 720. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show monitor permit-list Displays the permit-list state and interfaces configured. monitor session egress replication-mode CF-365 Cisco IOS Configuration Fundamentals Command Reference April 2010 monitor session egress replication-mode To switch the egress-span mode from the default mode (either centralized or distributed depending on your Cisco IOS software release), use the monitor session egress replication-mode command in global configuration mode. To return to the default mode, use the no form of the command. Cisco IOS Release 12.2(33)SXH2a and Later Releases monitor session egress replication-mode centralized no monitor session egress replication-mode centralized Cisco IOS Release 12.2(33)SXH, SXH1, and SXH2 monitor session egress replication-mode distributed no monitor session egress replication-mode distributed Syntax Description Command Default Cisco IOS Releases 12.2(33)SXH2a and later releases: Centralized mode Cisco IOS Releases 12.2(33)SXH, SXH1, and SXH2: Distributed mode Command Modes Global configuration (config) Command History Usage Guidelines Note Prior to Cisco IOS Release 12.2(33)SXH and the introduction of this feature, the operating mode was centralized and could not be changed. Centralized egress span monitoring redirects traffic to the supervisor engine for egress monitoring. centralized In Cisco IOS Release 12.2(33)SXH2a and later releases: Specifies centralized egress span monitoring as the default mode. distributed In Cisco IOS Release 12.2(33)SXH, SXH1, and SXH2: Specifies distributed egress span monitoring as the default mode. Release Modification 12.2(33)SXH This command was introduced. 12.2(33)SXH2a The command was changed as follows: • The default mode was changed from distributed mode to centralized mode. • The centralized keyword was removed and the distributed keyword was added. monitor session egress replication-mode CF-366 Cisco IOS Configuration Fundamentals Command Reference April 2010 Distributed egress span monitoring is performed in the ingress module. Distributed replication for Switched Port Analyzer (SPAN), Remote SPAN (RSPAN), and Encapsulated RSPAN (ERSPAN) increases the total throughput at the span destination. Note Distributed egress span (DES) mode is applied to ASIC-based sessions only. Examples Cisco IOS Release 12.2(33)SXH, SXH1, and SXH2 The following example shows how to switch the egress-span mode from the distributed default to centralized mode: Router(config)# monitor session egress replication-mode centralized The following example shows how to switch the egress-span mode from centralized back to distributed mode: Router(config)# no monitor session egress replication-mode centralized Cisco IOS Release 12.2(33)SXH2a and Later Releases The following example shows how to switch the egress-span mode from the centralized default to distributed mode: Router(config)# monitor session egress replication-mode distributed The following example shows how to switch the egress-span mode from distributed back to centralized mode: Router(config)# no monitor session egress replication-mode distributed Related Commands Command Description show monitor session Displays the operational mode and configured mode of the session and module session capabilities. monitor session type CF-367 Cisco IOS Configuration Fundamentals Command Reference April 2010 monitor session type To configure a local Switched Port Analyzer (SPAN), RSPAN, or ERSPAN, use the monitor session type command in global configuration mode. To remove one or more source or destination interfaces from the SPAN session, use the no form of this command. monitor session span-session-number type {erspan-destination | erspan-source | local | local-tx | rspan-destination | rspan-source} no monitor session span-session-number type {erspan-destination | erspan-source | local | local-tx | rspan-destination | rspan-source} Syntax Description Defaults This command has no default settings. Command Modes Global configuration (config) Command History Usage Guidelines Release 12.2(18)SXE and later releases support ERSPAN with the Supervisor Engine 720, hardware revision 3.2 or higher. Enter the show module version | include WS-SUP720-BASE command to display the hardware revision. span-session-number Number of the local SPAN or ERSPAN session; valid values are from 1 to 66. erspan-destination Specifies the ERSPAN destination-session configuration mode. erspan-source Specifies the ERSPAN source-session configuration mode. local Specifies the local SPAN session configuration mode. local-tx Specifies the local egress-only SPAN session configuration mode. rspan-destination Specifies the RSPAN destination-session configuration mode. rspan-source Specifies the RSPAN source-session configuration mode. Release Modification 12.2(18)SXE Support for this command was introduced on the Supervisor Engine 720. 12.2(18)SXF This command was changed as follows: • Support for this command was introduced on the Supervisor Engine 32. • ERSPAN is supported in any switch fabric module functionality switching mode. 12.2(33)SXH This command was changed to include the following keywords: • local • local-tx • rspan-destination • rspan-source monitor session type CF-368 Cisco IOS Configuration Fundamentals Command Reference April 2010 ERSPAN traffic is GRE-encapsulated SPAN traffic that can only be processed by an ERSPAN destination session. This command is not supported on Catalyst 6500 series switches that are configured with a Supervisor Engine 2. All ERSPAN source sessions on a switch must use the same source IP address. You enter the origin ip address command to configure the IP address for the ERSPAN source sessions. All ERSPAN destination sessions on a switch must use the same IP address. You enter the ip address command to configure the IP address for the ERSPAN destination sessions. If the ERSPAN destination IP address is not a Supervisor Engine 720 (for example, it is a network sniffer), the traffic arrives with the GRE and RSPAN headers/encapsulation intact. The ERSPAN source session destination IP address, which must be configured on an interface on the destination switch, is the source of traffic that an ERSPAN destination session sends to the destination ports. You configure the same address in both the source and destination sessions with the ip address command. The ERSPAN ID differentiates the ERSPAN traffic arriving at the same destination IP address from different ERSPAN source sessions. The local ERSPAN session limits are as follows: • Total sessions—66 • Source sessions—2 (ingress or egress or both) • Destination sessions—23 The monitor session type command creates a new ERSPAN session or allows you to enter the ERSPAN session configuration mode. ERSPAN uses separate source and destination sessions. You configure the source and destination sessions on different switches. The ERSPAN session configuration mode prompts are as follows: • Router(config-mon-erspan-src)—Indicates the ERSPAN source session configuration mode. • Router(config-mon-erspan-src-dst)—Indicates the ERSPAN source session destination configuration mode. • Router(config-mon-erspan-dst)—Indicates the ERSPAN destination session configuration mode. • Router(config-mon-erspan-dst-src)—Indicates the ERSPAN destination session source configuration mode Table 35 lists the ERSPAN destination session configuration mode syntaxes. Table 35 ERSPAN Destination Session Configuration Mode Syntaxes Syntax Description Global Configuration Mode monitor session erspan-destination-session-number | rspan-destination-session-number type erspan-destination | erspan-destination Enters ERSPAN or RSPAN destination session configuration mode and changes the prompt to the following: Router(config-mon-erspan-dst)# Router(config-mon-rspan-dst)# Destination Session Configuration Mode description session-description (Optional) Describes the ERSPAN or RSPAN destination session. monitor session type CF-369 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 36 lists the ERSPAN source session configuration mode syntaxes. shutdown (Optional) (Default) Inactivates the ERSPAN destination session. no shutdown Activates the ERSPAN destination session. destination {single-interface | interface-list | interface-range | mixed-interface-list} Associates the ERSPAN destination session number with the destination ports. source Enters ERSPAN destination session source configuration mode and changes the prompt to the following: Router(config-mon-erspan-dst-src)# Destination Session Source Configuration Mode ip address ip-address [force] Configures the ERSPAN flow destination IP address, which must also be configured on an interface on the destination switch and be entered in the ERSPAN destination session configuration. erspan-id erspan-flow-id Configures the ID number used by the destination and destination sessions to identify the ERSPAN traffic. vrf vrf-name (Optional) Configures the VRF name of the packets in the ERSPAN traffic. Table 35 ERSPAN Destination Session Configuration Mode Syntaxes Syntax Description Table 36 ERSPAN or RSPAN Source Session Configuration Mode Syntaxes Syntax Description Global Configuration Mode monitor session erspan-source-session-number type erspan-source | rspan-source Enters ERSPAN or RSPAN source session configuration mode and changes the prompt as appropriate to the following: Router(config-mon-erspan-src)# Router(config-mon-rspan-src)# Source Session Configuration Mode description session-description (Optional) Describes the ERSPAN or RSPAN source session. shutdown (Optional) (Default) Inactivates the ERSPAN or RSPAN source session. no shutdown Activates the ERSPAN or RSPAN source session. source {{single-interface | interface-list | interface-range | mixed-interface-list | single-vlan | vlan-list | vlan-range | mixed-vlan-list} [rx | tx | both]} Associates the ERSPAN or RSPAN source session number with the source ports or VLANs, and selects the traffic direction to be monitored. filter {single-vlan | vlan-list | vlan-range | mixed-vlan-list} (Optional) Configures source VLAN filtering when the ERSPAN or RSPAN source is a trunk port. description session-description (Optional) Describes the ERSPAN or RSPAN source session. monitor session type CF-370 Cisco IOS Configuration Fundamentals Command Reference April 2010 When you configure the monitor sessions, follow these syntax guidelines: • erspan-destination-span-session-number can range from 1 to 66. • single-interface is interface type slot/port; type is fastethernet, gigabitethernet, or tengigabitethernet. • interface-list is single-interface , single-interface , single-interface ... Note In lists, you must enter a space before and after the comma. In ranges, you must enter a space before and after the dash. • interface-range is interface type slot/first-port - last-port . • mixed-interface-list is, in any order, single-interface , interface-range , ... • erspan-flow-id can range from 1 to 1023. When you clear the monitor sessions, follow these syntax guidelines: • The no monitor session session-number command entered with no other parameters clears the session session-number. • session-range is first-session-number-last-session-number. Note When you enter the no monitor session range command, do not enter spaces before or after the dash. If you enter multiple ranges, do not enter spaces before or after the commas. Use the monitor session type local command to configure ingress, egress, or both ingress and egress SPAN sessions. Source Session Destination Configuration Mode ip address ip-address Configures the ERSPAN or RSPAN flow destination IP address, which must also be configured on an interface on the destination switch and be entered in the ERSPAN or RSPAN destination session configuration. erspan-id erspan-flow-id Configures the ID number used by the source and destination sessions to identify the ERSPAN or RSPAN traffic. origin ip address ip-address Configures the IP address used as the source of the ERSPAN or RSPAN traffic. ip {{ttl ttl-value} | {prec ipp-value} | {dscp dscp-value}} (Optional) Configures the following packet values in the ERSPAN or RSPAN traffic: • ttl ttl-value—IP time-to-live (TTL) value • prec ipp-value—IP-precedence value • dscp dscp-value—IP-precedence value vrf vrf-name (Optional) Configures the VRF name of the packets in the ERSPAN or RSPAN traffic. Table 36 ERSPAN or RSPAN Source Session Configuration Mode Syntaxes Syntax Description monitor session type CF-371 Cisco IOS Configuration Fundamentals Command Reference April 2010 Use the monitor session type local-tx command to configure egress-only SPAN sessions. When you enter the local or the local egress-only SPAN session configuration mode, the prompt changes accordingly to Router(config-mon-local)# or Router(config-mon-local-tx)#, and the following commands are available: • description—Describes the properties for this session using this syntax: description description The description can be up to 240 characters and cannot contain special characters or spaces. • destination—Specifies the destination and the destination properties using this syntax: destination {analysis-module num | anomaly-detector-module num | interface type number | intrusion-detection-module num} • exit—Exits from configuration session mode. • filter vlan vlan-id—Limits the SPAN source traffic to specific VLANs; valid values are from 1 to 4096. • no—Negates a command or sets its defaults. • shutdown—Shuts down this session • source—Specifies the SPAN source interface or VLAN using the following syntax: source {cpu {rp | sp} | {interface type number} | {intrusion-detection-module num} | {vlan vlan-id}} [, | - | rx | tx | both] analysis-module num Specifies the SPAN destination analysis-module. anomaly-detector-module num Specifies the SPAN destination anomaly-detector-module. interface type number Specifies the interface type and number as follows: • GigabitEthernet mod/port • port-channel num—Ethernet Channel of interfaces; valid values are from 1 to 496. ingress (Optional) Configures destinations to receive traffic from attached devices. learning (Optional) Enables MAC address learning from the destinations, which allows the switch to transmit traffic that is addressed to devices attached to the destinations. intrusion-detection-module num Specifies the SPAN destination intrusion-detection-module. cpu rp Associates the local SPAN session number with the CPU on the route processor. cpu sp Associates the local SPAN session number with the CPU on the switch processor. monitor session type CF-372 Cisco IOS Configuration Fundamentals Command Reference April 2010 The local SPAN session limits are as follows: • Total sessions—80 • Source sessions—2 (ingress or egress or both) • Egress only—14 If you enter the filter keyword on a monitored trunk interface, only traffic on the set of specified VLANs is monitored. Only one destination per SPAN session is supported. If you attempt to add another destination interface to a session that already has a destination interface configured, you get an error. You must first remove a SPAN destination interface before changing the SPAN destination to a different interface. You can configure up to 64 SPAN destination interfaces, but you can have one egress SPAN source interface and up to 128 ingress source interfaces only. A SPAN session can either monitor VLANs or monitor individual interfaces, but it cannot monitor both specific interfaces and specific VLANs. Configuring a SPAN session with a source interface and then trying to add a source VLAN to the same SPAN session causes an error. Configuring a SPAN session with a source VLAN and then trying to add a source interface to that session also causes an error. You must first clear any sources for a SPAN session before switching to another type of source. Port channel interfaces display in the list of interface options if you have them configured. VLAN interfaces are not supported. However, you can span a particular VLAN by entering the monitor session session source vlan vlan-id command. When you configure the destination, use these guidelines: • A single-interface is as follows: – interface type slot/port; type is fastethernet, gigabitethernet, or tengigabitethernet. – interface port-channel number Note Destination port channel interfaces must be configured with the channel-group group-num mode on command and the no channel-protocol command. • An interface-list is single-interface , single-interface , single-interface ... interface type number Specifies the interface type and number as follows: • FastEthernet mod/port • GigabitEthernet mod/port • Port-channel num—Ethernet Channel of interfaces; valid values are from 1 to 496. vlan vlan-id Specifies the VLAN; valid values are from 1 to 4094. , (Optional) Specifies another range of interfaces. - (Optional) Specifies a range of interfaces. both (Optional) Monitors the received and the transmitted traffic. rx (Optional) Monitors the received traffic only. tx1 (Optional) Monitors the transmitted traffic only. 1. When you enter the local-tx keyword, the rx and both keywords are not available and the tx keyword is required. monitor session type CF-373 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note In lists, you must enter a space before and after the comma. In ranges, you must enter a space before and after the dash. • An interface-range is interface type slot/first-port - last-port. • A mixed-interface-list is, in any order, single-interface , interface-range , ... • A single-vlan is the ID number of a single VLAN. • A single-list is single-vlan , single-vlan , single-vlan ... • A vlan-range is first-vlan-ID - last-vlan-ID. • A mixed-vlan-list is, in any order, single-vlan , vlan-range , ... When you clear the monitor sessions, follow these syntax guidelines: • The no monitor session session-number command entered with no other parameters clears the session session-number. • session-range is first-session-number-last-session-number. Note When you enter the no monitor session range command, do not enter spaces before or after the dash. If you enter multiple ranges, do not enter spaces before or after the commas. Examples This example shows how to configure an ERSPAN source session number and enter the ERSPAN source session configuration mode for the session: Router(config)# monitor session 55 type erspan-source Router(config-mon-erspan-src)# This example shows how to configure an ERSPAN destination session number and enter the ERSPAN destination session configuration mode for the session: Router(config)# monitor session 55 type erspan-destination Router(config-mon-erspan-dst)# This example shows how to associate the ERSPAN destination session number with the destination ports: Router(config-mon-erspan-dst) destination interface fastethernet 1/2 , 2/3 This example shows how to enter the ERSPAN destination session source configuration: Router(config-mon-erspan-dst)# source Router(config-mon-erspan-dst-src)# This example shows how to enter the ERSPAN destination session source configuration mode: Router(config-mon-erspan-dst)# source Router(config-mon-erspan-dst-src)# This example shows how to configure multiple sources for a session: Router(config-mon-erspan-src)# source interface fastethernet 5/15 , 7/3 rx Router(config-mon-erspan-src)# source interface gigabitethernet 1/2 tx Router(config-mon-erspan-src)# source interface port-channel 102 Router(config-mon-erspan-src)# source filter vlan 2 - 3 Router(config-mon-erspan-src)# monitor session type CF-374 Cisco IOS Configuration Fundamentals Command Reference April 2010 This example shows how to enter the ERSPAN source session destination configuration mode: Router(config-mon-erspan-src)# destination Router(config-mon-erspan-src-dst)# This example shows how to configure the ID number that is used by the source and destination sessions to identify the ERSPAN traffic: Router(config-mon-erspan-src-dst)# erspan-id 1005 Router(config-mon-erspan-src-dst)# This example shows how to configure session 1 to monitor ingress traffic from Gigabit Ethernet port 1/1 and configure Gigabit Ethernet port 1/2 as the destination: Router(config)# monitor session 1 type local Router(config-mon-local)# source interface gigabitethernet 1/1 rx Router(config-mon-local)# destination interface gigabitethernet 1/2 This example shows how to configure session 1 to monitor egress-only traffic from Gigabit Ethernet port 5/1 and configure Gigabit Ethernet port 5/2 as the destination: Router(config)# monitor session 1 type local-tx Router(config-mon-local)# source interface gigabitethernet 5/1 rx Router(config-mon-local)# destination interface gigabitethernet 5/2 This example shows how to remove an interface from a session: Router(config)# no monitor session 1 type local-tx Related Commands Command Description monitor session type Creates an ERSPAN source session number or enters the ERSPAN session configuration mode for the session. show monitor session Displays information about the ERSPAN, SPAN, and RSPAN sessions. mop device-code CF-375 Cisco IOS Configuration Fundamentals Command Reference April 2010 mop device-code To identify the type of device sending Maintenance Operation Protocol (MOP) System Identification (sysid) messages and request program messages, use the mop device-code command in global configuration mode. To set the identity to the default value, use the no form of this command. mop device-code {cisco | ds200} no mop device-code {cisco | ds200} Syntax Description Defaults Cisco device code Command Modes Global configuration Command History Usage Guidelines The sysid messages and request program messages use the identity information indicated by this command. Examples The following example identifies a DECserver 200 device as sending MOP sysid and request program messages: mop device-code ds200 Related Commands cisco Denotes a Cisco device code. This is the default. ds200 Denotes a DECserver 200 device code. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description mop sysid Enables an interface to send out periodic MOP system identification messages. mop retransmit-timer CF-376 Cisco IOS Configuration Fundamentals Command Reference April 2010 mop retransmit-timer To configure the length of time that the Cisco IOS software waits before resending boot requests to a Maintenance Operation Protocol (MOP) server, use the mop retransmit-timer command in global configuration mode. To reinstate the default value, use the no form of this command. mop retransmit-timer seconds no mop retransmit-timer Syntax Description Defaults 4 seconds Command Modes Global configuration Command History Usage Guidelines By default, when the software sends a request that requires a response from a MOP boot server and the server does not respond, the message is re-sent after 4 seconds. If the MOP boot server and router are separated by a slow serial link, it might take longer than 4 seconds for the software to receive a response to its message. Therefore, you might want to configure the software to wait longer than 4 seconds before resending the message if you are using such a link. Examples In the following example, if the MOP boot server does not respond within 10 seconds after the router sends a message, the server will resend the message: mop retransmit-timer 10 Related Commands seconds Sets the length of time (in seconds) that the software waits before resending a message. The value is a number from 1 to 20. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description mop device-code Identifies the type of device sending MOP sysid messages and requests program messages. mop enabled Enables an interface to support the MOP. mop retries CF-377 Cisco IOS Configuration Fundamentals Command Reference April 2010 mop retries To configure the number of times the Cisco IOS software will resend boot requests to a Maintenance Operation Protocol (MOP) server, use the mop retries command in global configuration mode. To reinstate the default value, use the no form of this command. mop retries count no mop retries Syntax Description Defaults 8 times Command Modes Global configuration Command History Examples In the following example, the software will attempt to resend a message to an unresponsive host 11 times before declaring a failure: Router(config)# mop retries 11 Related Commands count Indicates the number of times the software will resend a MOP boot request. The value is a number from 3 to 24. The default is 8. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description mop device-code Identifies the type of device sending MOP sysid messages and requests program messages. mop enabled Enables an interface to support the MOP server. mop retransmit-timer Configures the length of time that the Cisco IOS software waits before resending boot requests to a MOP server. more CF-378 Cisco IOS Configuration Fundamentals Command Reference April 2010 more To display the contents of a file, use the more command in EXEC mode. more [/ascii | /binary | /ebcdic] url Syntax Description Defaults The command displays the conent of a file in its native format. Optional formats include ascii, binary, and ebcdic. Command Modes EXEC Command History Usage Guidelines The more system:running-config command displays the same output as the show running-config command. The more nvram:startup-config command is recommended as a replacement for the show startup-config command and the show configuration command. You can use this command to display configuration files, as follows: • The more nvram:startup-config command displays the startup configuration file contained in NVRAM or specified by the CONFIG_FILE environment variable. The Cisco IOS software informs you whether the displayed configuration is a complete configuration or a distilled version. A distilled configuration is one that does not contain access lists. • The more system:running-config command displays the running configuration. These commands show the version number of the software used when you last changed the configuration file. You can also display the contents of files on remote systems using the more command. For example, you could display a saved running configuration file on an FTP server using more ftp://username:password@ftp-host1/mydirectory/7200-basic-running-config. See the description of the copy command for more information on file-system prefixes available in the Cisco IOS CLI. Options for filtering and redirecting the output of this command are available by appending a pipe character (|). See the Related Commands table for a list of more command extensions. /ascii (Optional) Displays a binary file in ASCII format. /binary (Optional) Displays a file in hex/text format. /ebcdic (Optional) Displays a binary file in EBCDIC format. url The URL of the file to display. A URL in the CLI consists of a file-system prefix (such as system: or nvram:), an optional path (such as a folder name), and the name of a file. Release Modification 11.3 AA This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. more CF-379 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following partial sample output displays the configuration file named startup-config in NVRAM: Router# more nvram:startup-config ! ! No configuration change since last restart ! NVRAM config last updated at 02:03:26 PDT Thu Oct 2 1997 ! version 12.1 service timestamps debug uptime service timestamps log uptime service password-encryption service udp-small-servers service tcp-small-servers . . . end The following is partial sample output from the more nvram:startup-config command when the configuration file has been compressed: Router# more nvram:startup-config Using 21542 out of 65536 bytes, uncompressed size = 142085 bytes ! version 12.1 service compress-config ! hostname rose ! . . . The following partial sample output displays the running configuration: Router2# more system:running-config Building configuration... Current configuration: ! version 12.1 no service udp-small-servers no service tcp-small-servers ! hostname Router2 ! . . . ! end Related Commands Command Description boot config Specifies the device and filename of the configuration file from which the router configures itself during initialization (startup). more begin Begins the output of any more command from a matched string. more CF-380 Cisco IOS Configuration Fundamentals Command Reference April 2010 more exclude Filters the output of any more command to exclude a matched string. more include Filters the output of any more command to display only the lines that match the specified string. service compress-config Compresses startup configuration files. show bootvar Displays the contents of the BOOT environment variable, the name of the configuration file pointed to by the CONFIG_FILE environment variable, the contents of the BOOTLDR environment variable, and the configuration register setting. Command Description more begin CF-381 Cisco IOS Configuration Fundamentals Command Reference April 2010 more begin To search the output of any more command, use the more url | begin command in EXEC mode. This command begins unfiltered output of the more command with the first line that contains the regular expression you specify. more url | begin regular-expression Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines The regular-expression argument is case sensitive and allows for complex matching requirements. You can specify a new search at every --More-- prompt. To search the remaining output of the more command, use the following command at the --More-- prompt: /regular-expression To filter the remaining output of the more command, use one of the following commands at the --More-- prompt: -regular-expression +regular-expression When output volume is large, the search can produce long lists of output. To interrupt the output, press Ctrl-^ (Ctrl-Shift-6) or Ctrl-Z. url The Universal Resource Locator (RLl) of the file to display. More commands are advanced show commands; for details, see the command reference page in this book for the more command. | A vertical bar (the “pipe” symbol) indicates that an output processing specification follows. regular-expression Any regular expression found in more command output. / Specifies a search at a --More-- prompt that begins unfiltered output with the first line that contains the regular expression. - Specifies a filter at a --More-- prompt that only displays output lines that do not contain the regular expression. + Specifies a filter at a --More-- prompt that only displays output lines that contain the regular expression. Release Modification 11.3 AA The more command was introduced. 12.0(1)T This extension of the more command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. more begin CF-382 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note Once you specify a filter for a more command, you cannot specify another filter at a --More-- prompt. The first specified filter remains until the more command output finishes or until you interrupt the output. The use of the keyword begin does not constitute a filter. Because prior output is not saved, you cannot search or filter backward through prior output. Examples The following is partial sample output of the more nvram:startup-config | begin command that begins unfiltered output with the first line that contain the regular expression “ip.” At the --More-- prompt, the user specifies a filter to exclude output lines that contain the regular expression “ip.” router# more nvram:startup-config | begin ip ip subnet-zero ip domain-name cisco.com ip name-server 198.92.30.32 ip name-server 171.69.2.132 ! isdn switch-type primary-5ess . . . interface Ethernet1 ip address 5.5.5.99 255.255.255.0 --More-- -ip filtering... media-type 10BaseT ! interface Serial0:23 encapsulation frame-relay no keepalive dialer string 4001 dialer-group 1 isdn switch-type primary-5ess no fair-queue Related Commands Command Description more exclude Filters more command output so that it excludes lines that contain a particular regular expression. more include Filters more command output so that it displays only lines that contain a particular regular expression. show begin Searches the output of any show command and displays the output from the first instance of a specified string. show exclude Filters show command output so that it excludes lines that contain a particular regular expression. show include Filters show command output so that it displays only lines that contain a particular regular expression. more exclude CF-383 Cisco IOS Configuration Fundamentals Command Reference April 2010 more exclude To filter more command output so that it excludes lines that contain a particular regular expression, use the more exclude command in EXEC mode. more url | exclude regular-expression Syntax Description Command Modes EXEC Command History Usage Guidelines The regular-expression argument is case sensitive and allows for complex matching requirements. You can specify a new search at any --More-- prompt. To search the remaining output of the more command, use the following command at the --More-- prompt: /regular-expression When output volume is large, the search can produce long lists of output. To interrupt the output, press Ctrl-^ (Ctrl-Shift-6) or Ctrl-Z. Because prior output is not saved, you cannot search or filter backward through prior output. url The Universal Resource Locator (URL) of the file to display. More commands are advanced show commands; for details, see the command reference page in this book for the more command. The Cisco IOS File System (IFS) uses URLs to specify the location of a file system, directory, and file. Typical URL elements include: prefix:[directory/]filename Prefixes can be local file systems or file locations, such as nvram: or system:. Alternatively, you can specify network locations using the following syntax: ftp:[[//[username[:password]@]location]/directory]/filename tftp:[[//location]/directory]/filename rcp:[[//[username@]location]/directory]/filename | A vertical bar (the “pipe” symbol) indicates that an output processing specification follows. regular-expression Any regular expression found in more command output. / Specifies a search at a --More-- prompt that begins unfiltered output with the first line that contains the regular expression. Release Modification 11.3 AA The more command was introduced. 12.0(1)T This extension of the more command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. more exclude CF-384 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following is partial sample output of the more nvram:startup-config | exclude command. The use of | exclude service in the command specifies a filter that excludes lines that contain the regular expression “service.” At the --More-- prompt, the user searches for the regular expression “Dialer1,” which continues filtered output with the first line that contains “Dialer1.” router# more nvram:startup-config | exclude service ! version 12.0 ! hostname router ! boot system flash no logging buffered ! ip subnet-zero ip domain-name cisco.com . . . --More-- /Dialer1 filtering... interface Dialer1 no ip address no ip directed-broadcast dialer in-band no cdp enable Related Commands Command Description more begin Begins unfiltered output of the more command with the first line that contains the regular expression you specify. more include Filters more command output so that it displays only lines that contain a particular regular expression. show begin Searches the output of any show command and displays the output from the first instance of a specified string. show exclude Filters show command output so that it excludes lines that contain a particular regular expression. show include Filters show command output so that it displays only lines that contain a particular regular expression. more include CF-385 Cisco IOS Configuration Fundamentals Command Reference April 2010 more include To filter more command output so that it displays only lines that contain a particular regular expression, use the more include command in EXEC mode. more url | include regular-expression Syntax Description Command Modes EXEC Command History Usage Guidelines The regular-expression argument is case sensitive and allows for complex matching requirements. You can specify a new search at any --More-- prompt. To search the remaining output of the more command, use the following syntax at the --More-- prompt: /regular-expression When output volume is large, the search can produce long lists of output. To interrupt the output, press Ctrl-^ (Ctrl-Shift-6) or Ctrl-Z. Because prior output is not saved, you cannot search or filter backward through prior output. Examples The following is partial sample output of the more nvram:startup-config | include command. It only displays lines that contain the regular expression “ip.” router# more nvram:startup-config | include ip ip subnet-zero ip domain-name cisco.com ip name-server 198.92.30.32 ip name-server 171.69.2.132 description ip address 172.21.53.199 255.255.255.0 ip address 172.21.53.199 255.255.255.0 url The Universal Resource Locator (URL) of the file to display. More commands are advanced show commands; for details, see the command reference page in this book for the more command. | A vertical bar (the “pipe” symbol) indicates that an output processing specification follows. regular-expression Any regular expression found in more command output. / Specifies a search at a --More-- prompt that begins unfiltered output with the first line that contains the regular expression. Release Modification 11.3 AA The more command was introduced. 12.0(1)T This extension of the more command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. more include CF-386 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description more begin Begins unfiltered output of the more command with the first line that contains the regular expression you specify. more exclude Filters more command output so that it excludes lines that contain a particular regular expression. show begin Searches the output of any show command and displays the output from the first instance of a specified string. show exclude Filters show command output so that it excludes lines that contain a particular regular expression. show include Filters show command output so that it displays only lines that contain a particular regular expression. more flh:logfile CF-387 Cisco IOS Configuration Fundamentals Command Reference April 2010 more flh:logfile To view the system console output generated during the Flash load helper operation, use the more flh:logfile privileged EXEC command. more flh:logfile Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Usage Guidelines If you are a remote Telnet user performing the Flash upgrade without a console connection, this command allows you to retrieve console output when your Telnet connection has terminated due to the switch to the ROM image. The output indicates what happened during the download, and is particularly useful if the download fails. This command is a form of the more command. See the more command for more information. Examples The following is sample output from the more flh:logfile command: Router# more flh:logfile %FLH: abc/igs-kf.914 from 172.16.1.111 to flash... System flash directory: File Length Name/status 1 2251320 abc/igs-kf.914 [2251384 bytes used, 1942920 available, 4194304 total] Accessing file 'abc/igs-kf.914' on 172.16.1.111... Loading from 172.16.13.111: Erasing device...... erased Loading from 172.16.13.111: - [OK - 2251320/4194304 bytes] Verifying checksum... OK (0x97FA) Flash copy took 79292 msecs %FLH: Re-booting system after download Loading abc/igs-kf.914 at 0x3000040, size = 2251320 bytes [OK] F3: 2183364+67924+259584 at 0x3000060 Restricted Rights Legend Release Modification 11.3 AA This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. more flh:logfile CF-388 Cisco IOS Configuration Fundamentals Command Reference April 2010 Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS sec. 252.227-7013. cisco Systems, Inc. 170 West Tasman Drive San Jose, California 95134 Cisco Internetwork Operating System Software Cisco IOS (tm) GS Software (GS7), Version 11.0 Copyright (c) 1986-1995 by cisco Systems, Inc. Compiled Tue 06-Dec-94 14:01 by smith Image text-base: 0x00001000, data-base: 0x005A9C94 cisco 2500 (68030) processor (revision 0x00) with 4092K/2048K bytes of memory. Processor board serial number 00000000 DDN X.25 software, Version 2.0, NET2 and BFE compliant. ISDN software, Version 1.0. Bridging software. Enterprise software set supported. (0x0) 1 Ethernet/IEEE 802.3 interface. 2 Serial network interfaces. --More-- 1 ISDN Basic Rate interface. 32K bytes of non-volatile configuration memory. 4096K bytes of processor board System flash (Read ONLY) Related Commands Command Description more Displays a file. motd-banner CF-389 Cisco IOS Configuration Fundamentals Command Reference April 2010 motd-banner To enable the display of message-of-the-day (MOTD) banners on the specified line or lines, use the motd-banner command in line configuration mode. To suppress the MOTD banners on the specified line or lines, use the no form of this command. motd-banner no motd-banner Syntax Description This command has no arguments or keywords. Defaults Enabled on all lines. Command Modes Line configuration Command History Usage Guidelines This command determines whether the router will display the MOTD banner when an EXEC session is created on the specified line or lines. The MOTD banner is defined with the banner motd global configuration command. By default, the MOTD banner is enabled on all lines. Disable the MOTD banner on specific lines using the no motd-banner line configuration command. The MOTD banners can also be disabled by the no exec-banner line configuration command, which disables both MOTD banners and EXEC banners on a line. If the no exec-banner command is configured on a line, the MOTD banner will be disabled regardless of whether the motd-banner command is enabled or disabled. Table 37 summarizes the effects of the exec-banner command and the motd-banner command. For reverse Telnet connections, the EXEC banner is never displayed. Instead, the incoming banner is displayed. The MOTD banner is displayed by default, but it is disabled if either the no exec-banner command or no motd-banner command is configured. Table 38 summarizes the effects of the exec-banner command and the motd-banner command for reverse Telnet connections. Release Modification 11.1 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 37 Banners Displayed Based On exec-banner and motd-banner Combinations exec-banner (default) no exec-banner motd-banner (default) MOTD banner EXEC banner None no motd-banner EXEC banner None motd-banner CF-390 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example suppresses the MOTD banner on vty lines 0 through 4: line vty 0 4 no motd-banner Related Commands Table 38 Banners Displayed Based On exec-banner and motd-banner Combinations for Reverse Telnet Sessions to Async Lines exec-banner (default) no exec-banner motd-banner (default) MOTD banner Incoming banner Incoming banner no motd-banner Incoming banner Incoming banner Command Description banner exec Defines and enables a customized banner to be displayed whenever the EXEC process is initiated. banner incoming Defines and enables a customized message to be displayed when there is an incoming connection to a terminal line from a host on the network. banner motd Defines and enables a customized message-of-the-day banner. motd-banner Controls (enables or disables) the display of message-of-the-day banners on a specified line or lines. name-connection CF-391 Cisco IOS Configuration Fundamentals Command Reference April 2010 name-connection To assign a logical name to a connection, use the name-connection command in user EXEC mode. name-connection Syntax Description This command has no arguments or keywords. Defaults No logical name is defined. Command Modes User EXEC Command History Usage Guidelines This command can be useful for keeping track of multiple connections. You are prompted for the connection number and name to assign. The where command displays a list of the assigned logical connection names. Examples The following example assigns the logical name blue to the connection: Router> where Conn Host Address Byte Idle Conn Name * 1 doc-2509 172.30.162.131 0 0 doc-2509 Router> name-connection Connection number: 1 Enter logical name: blue Connection 1 to doc-2509 will be named "BLUE" [confirm] Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description where Lists open sessions associated with the current terminal line. no menu CF-392 Cisco IOS Configuration Fundamentals Command Reference April 2010 no menu To delete a user menu from the configuration file, use the no menu command in global configuration mode. no menu menu-name Syntax Description Defaults No default behavior or values. Command Modes Global configuration Command History Usage Guidelines Use this command to remove any menu commands for a particular menu from the configuration file. As with all global configuration commands, this command will only effect the startup configuration file when you save the running configuration using the copy running-config startup-config EXEC command. Examples The following example deletes the menu named Access1: no menu Access1 Related Commands menu-name Name of the menu to delete from the configuration file. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description menu (EXEC) Invokes a user menu. menu command Specifies underlying commands for user menus. menu prompt Specifies the prompt for a user menu. menu text Specifies the text of a menu item in a user menu. menu title Creates a title, or banner, for a user menu. notify CF-393 Cisco IOS Configuration Fundamentals Command Reference April 2010 notify To enable terminal notification about pending output from other Telnet connections, use the notify command in line configuration mode. To disable notifications, use the no form of this command. notify no notify Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes Line configuration Command History Usage Guidelines This command sets a line to inform a user that has multiple, concurrent Telnet connections when output is pending on a connection other than the current one. Examples In the following example, notification of pending output from connections is enabled on virtual terminal lines 0 to 4: Router(config)# line vty 0 4 Router(config-line)# notify Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description terminal notify Configures a line to inform a user that has multiple, concurrent Telnet connections when output is pending on a connection other than the current one. notify syslog CF-394 Cisco IOS Configuration Fundamentals Command Reference April 2010 notify syslog To enable the sending of notifications of configuration changes to a remote system message logging (syslog), use the notify syslog command in configuration change logger configuration mode. To disable the sending of notifications of configuration changes to the syslog, use the no form of this command. notify syslog [contenttype {plaintext | xml}] no notify syslog [contenttype {plaintext | xml}] Syntax Description Command Default Notifications are not sent to the syslog. Command Modes Configuration change logger configuration (config-archive-log-config) Command History Usage Guidelines Enable the notify syslog command if you use the syslog to monitor your router. Syslog monitoring prevents the need to gather configuration log information manually. Examples The following example shows how to enable the router to send notifications (in XML format) to the syslog: Router# configure terminal ! Router(config)# archive Router(config-archive)# log config Router(config-archive-log-config)# notify syslog contenttype xml Router(config-archive-log-config)# end contenttype (Optional) Allows you to choose a format for the configuration change messages that are sent via syslog. plaintext (Optional) Specifies that the configuration change messages are sent as plain text. xml (Optional) Specifies that the configuration change messages are sent in XML format. Release Modification 12.3(4)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(27)SBC This command was integrated into Cisco IOS Release 12.2(27)SBC. 12.2(33)SRA The contenttype, plaintext, and xml keywords were added. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. notify syslog CF-395 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description archive Enters archive configuration mode. hidekeys Suppresses the display of password information in configuration log files. log config Enters configuration change logger configuration mode. logging enable Enables the logging of configuration changes. logging size Specifies the maximum number of entries retained in the configuration log. show archive log config Displays entries from the configuration log. padding CF-396 Cisco IOS Configuration Fundamentals Command Reference April 2010 padding To set the padding on a specific output character, use the padding command in line configuration mode. To remove padding for the specified output character, use the no form of this command. padding ascii-number count no padding ascii-number Syntax Description Defaults No padding Command Modes Line configuration Command History Usage Guidelines Use this command when the attached device is an old terminal that requires padding after certain characters (such as ones that scrolled or moved the carriage). See the “ASCII Character Set and Hex Values” appendix for a list of ASCII characters. Examples In the following example, the Return (decimal character 13) is padded with 25 NULL bytes on the console line: Router(config)# line console Router(config-line)# padding 13 25 Related Commands ascii-number ACII decimal representation of the character. count Number of NULL bytes sent after the specified character, up to 255 padding characters in length. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description terminal padding Changes the character padding on a specific output character for the current session. parity CF-397 Cisco IOS Configuration Fundamentals Command Reference April 2010 parity To define generation of a parity bit, use the parity command in line configuration mode. To specify no parity, use the no form of this command. parity {none | even | odd | space | mark} no parity Syntax Description Defaults No parity. Command Modes Line configuration Command History Usage Guidelines Communication protocols provided by devices such as terminals and modems sometimes require a specific parity bit setting. Refer to the documentation for your device to determine required parity settings. If you use this command to set parity on Cisco AS5350 and Cisco AS5400 NextPort lines, do not also set parity by means of S-register settings in a modemcap. (A modemcap is a series of parameter settings that are sent to your modem to configure it to interact with a Cisco device in a specified way. Cisco IOS software defines modemcaps that have been found to properly initialize most modems so that they function properly with Cisco routers and access servers.) Examples In the following example, even parity is configured for line 34: Router(config)# line 34 Router(config-line)# parity even none No parity. This is the default. even Even parity. odd Odd parity. space Space parity. mark Mark parity. Release Modification 10.0 This command was introduced. 12.4 This command was modified to enable parity setting on Cisco AS5350 and Cisco AS5400 NextPort lines. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. parity CF-398 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description terminal parity Defines the generation of the parity bit for the current for the current session and line. parser cache CF-399 Cisco IOS Configuration Fundamentals Command Reference April 2010 parser cache To reenable the Cisco IOS software parser cache after disabling it, use the parser cache command in global configuration mode. To disable the parser cache, use the no form of this command. parser cache no parser cache Syntax Description This command has no arguments or keywords. Defaults Parser cache is enabled by default. Command Modes Global configuration Command History Usage Guidelines The Parser Cache feature optimizes the parsing (translation and execution) of Cisco IOS software configuration command lines by remembering how to parse recently encountered command lines, decreasing the time required to process large configuration files. The parser cache is enabled by default. However, if you wish to disable the parser cache, you may do so using the no parser cache command in global configuration mode. To reenable the parser cache after it has been disabled, use the parser cache command. When the no parser cache is issued, the command line appears in the running configuration file. However, if the parser cache is reenabled, no command line appears in the running configuration file. Examples In the following example, the Cisco IOS software Parser Cache feature is disabled: Router(config)# no parser cache Related Commands Release Modification 12.1(5)T This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description clear parser cache Clears the parse cache entries and hit/miss statistics stored for the Parser Cache feature. show parser statistics Displays statistics about the last configuration file parsed and the status of the Parser Cache feature. parser command serializer CF-400 Cisco IOS Configuration Fundamentals Command Reference April 2010 parser command serializer To enable configuration access only to the users holding a configuration lock and to prevent other clients from accessing the running configuration, use the parser command serializer command in global configuration mode. To disable this configuration, use the no form of this command. parser command serializer no parser command serializer Syntax Description This command has no arguments or keywords. Command Default Access is granted only to the user holding the lock. Command Modes Global configuration (config) Command History Usage Guidelines The Parser Concurrency and Locking Improvements feature ensures that exclusive access is granted only to a requested process and prevents other users from concurrently accessing the Cisco IOS configuration. That is, it prevents simultaneous execution of two or more commands. Use the parser command serializer command to configure the Parser Concurrency and Locking Improvements feature. Examples The following example shows how to configure the Parser Concurrency and Locking Improvements feature: Router# configure terminal Router(config)# parser command serializer Related Commands Release Modification 12.2(33)SRE This command was introduced. Command Description configuration mode exclusive Enables single-user (exclusive) access functionality for the Cisco IOS CLI. configure terminal lock Locks the running configuration into exclusive configuration mode for the duration of your configuration session. test parser session-lock Tests the behavior of the Parser Concurrency and Locking Improvements feature. parser config cache interface CF-401 Cisco IOS Configuration Fundamentals Command Reference April 2010 parser config cache interface To reduce the time required for the command-line interpreter to execute commands that manage the running system configuration files, use the parser config cache interface command in global configuration mode. To disable the reduced command execution time functionality, use the no form of this command. parser config cache interface no parser config cache interface Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes Global configuration (config) Command History Usage Guidelines Enable the parser config cache interface command to reduce the execution time required for running configuration management commands such as the show running-configuration, write terminal, and copy system:running-configuration commands. Information for these configuration management commands is supplied by nonvolatile generation (NVGEN) processes that query the system for configuration details. The parser config cache interface command is especially useful for managing large system configurations that contain numerous interface configurations. Once enabled, the command provides faster execution of the NVGEN commands that process the running system configuration by caching interface configurations in system memory, and by retrieving only configuration information that has changed. For this reason, the device on which this command is enabled must have enough memory available to store the interface configuration. For example, if the interface configurations take up 15 KB of memory, using this command would require having an additional 15 KB of memory space available. The first time you display the configuration file, you will not see much evidence of improvement in performance because the interface cache will be filled up. However, you will notice performance improvements when you enter subsequent NVGEN-type commands such as the show running-configuration EXEC command. Release Modification 12.3(7)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(27)SBC This command was integrated into Cisco IOS Release 12.2(27)SBC. 12.2(33)SRC This command was integrated into Cisco IOS Release 12.2(33)SRC. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. 12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI. parser config cache interface CF-402 Cisco IOS Configuration Fundamentals Command Reference April 2010 Each time the interface configuration is changed, the interface cache is flushed. Entering an NVGEN-type command after modifying the interface configuration will once again not show any performance improvement until the next NVGEN-type command is entered. Examples The following example shows how to enable the functionality for reducing the time required for the command-line interpreter to execute commands that manage the running system configuration files: Router(config)# parser config cache interface Related Commands Command Description copy system:running-configuration Copies the running configuration to another destination. show running-configuration Displays the configuration currently running on the terminal. write terminal Displays the configuration currently running on the terminal. parser config partition CF-403 Cisco IOS Configuration Fundamentals Command Reference April 2010 parser config partition To enable configuration partitioning, use the parser config partition command. To disable the partitioning of the running configuration, use the no form of this command. parser config partition no parser config partition Syntax Description No arguments or keywords. Command Default This command is enabled by default. Command Modes Global configuration (config) Command History Usage Guidelines This command controls (enables or disables) the Configuration Partitioning feature. Note This command is not related to disk partitions or disk partitioning. To display the list of commands that make up the current running configuration for a specific part (“partition”) of the system’s global running configuration, use the show running-config partition command in privileged Exec mode. The Configuration Partitioning feature uses a small amount of system resources. The no parser config partition command allows you to disable this feature if the feature is not needed on your system. Note Only the no form of this command will appear in configuration files. To determine if config partitioning is supported on your system and whether it is enabled, use the show running-config parser ? command. Examples The following example shows how to disable partitioning of the system running configuration: Router> enable Router# config t Enter configuration commands, one per line. End with CNTL/Z. Release Modification 12.2(33)SRB This command was introduced as part of the Configuration Partitioning feature. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. 12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI. parser config partition CF-404 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router(config)# no parser config partition System configured Related Commands Command Description show running-config partition Displays the list of commands that make up the current running configuration for a specific part of the system’s global running configuration. When used with the ? CLI help keyword, can also be used to determine the availability and status of the Configuration Partitioning feature. partition CF-405 Cisco IOS Configuration Fundamentals Command Reference April 2010 partition To separate Flash memory into partitions on Class B file system platforms, use the partition command in global configuration mode. To undo partitioning and to restore Flash memory to one partition, use the no form of this command. Cisco 1600 Series and Cisco 3600 Series Routers partition flash-filesystem: [number-of-partitions][partition-size] no partition flash-filesystem: All Other Class B Platforms partition flash partitions [size1 size2] no partition flash Syntax Description Defaults Flash memory consists of one partition. If the partition size is not specified, partitions of equal size are created. Command Modes Global configuration Command History flash-filesystem: One of the following Flash file systems, which must be followed by a colon (:). The Cisco 1600 series can only use the flash: keyword. • flash:—Internal Flash memory • slot0:—Flash memory card in PCMCIA slot 0 • slot1:—Flash memory card in PCMCIA slot 1 number-of-partitions (Optional) Number of partitions in Flash memory. partition-size (Optional) Size of each partition. The number of partition size entries must be equal to the number of specified partitions. partitions Number of partitions in Flash memory. Can be 1 or 2. size1 (Optional) Size of the first partition (in megabytes). size2 (Optional) Size of the second partition (in megabytes). Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. partition CF-406 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines For the Cisco 1600 series and Cisco 3600 series routers, to undo partitioning, use the partition flash-filesystem:1 or no partition flash-filesystem: command. For other Class B platforms, use either the partition flash 1 or no partition flash command. If there are files in a partition other than the first, you must use the erase flash-filesystem:partition-number command to erase the partition before reverting to a single partition. When creating two partitions, you must not truncate a file or cause a file to spill over into the second partition. Examples The following example creates two partitions of 4 MB each in Flash memory: Router(config)# partition flash 2 4 4 The following example divides the Flash memory card in slot 0 into two partitions, each 8 MB in size on a Cisco 3600 series router: Router(config)# partition slot0: 2 8 8 The following example creates four partitions of equal size in the card on a Cisco 1600 series router: Router(config)# partition flash: 4 path (archive configuration) CF-407 Cisco IOS Configuration Fundamentals Command Reference April 2010 path (archive configuration) To specify the location and filename prefix for the files in the Cisco IOS configuration archive, use the path command in archive configuration mode. To disable this function, use the no form of this command. path url no path url Syntax Description Command Default If this command is not configured, no location or filename prefix is specified for files in the Cisco IOS configuration archive. Command Modes Archive configuration (config-archive) Command History Usage Guidelines When this command is entered, an archive file of the running configuration is saved when the archive config, write-memory, or copy running-config startup-config command is entered. URLs are commonly used to specify files or location on the World Wide Web. On Cisco routers, URLs can be used to specify the location of a file or directory on a router or a remote file server. The path command uses a URL to specify the location and filename prefix for the Cisco IOS configuration archive. The locations or file systems that you can specify in the url argument are as follows: • If your platform has disk0—disk0:, disk1:, ftp:, pram:, rcp:, slavedisk0:, slavedisk1:, or tftp: • If your platform does not have disk0—ftp:, http:, pram:, rcp:, or tftp: The colon is required in the location format. The filename of the first archive file is the filename specified in the url argument followed by -1. The filename of the second archive file is the filename specified in the url argument followed by -2 and so on. url URL (accessible by the Cisco IOS file system) used for saving archive files of the running configuration file in the Cisco IOS configuration archive. Release Modification 12.3(7)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(31)SB2 This command was implemented on the Cisco 10000 series. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. path (archive configuration) CF-408 Cisco IOS Configuration Fundamentals Command Reference April 2010 Because some file systems are incapable of storing the date and time that a file was written, the filename of the archive file can contain the date, time, and router hostname. To include the router hostname in the archive file filename, enter the characters $h (for example, disk0:$h). To include the date and time in the archive file filename, enter the characters $t. When a configuration archive operation is attempted on a local file system, the file system is tested to determine if it is writable and if it has sufficient space to save an archive file. If the file system is read-only or if there is not enough space to save an archive file, an error message is displayed. If you specify the tftp: file server as the location with the path command, you need to create the configuration file on the TFTP file server and change the file’s privileges before the archive config command works properly. Examples The following example of the path command shows how to specify the hostname, date, and time as the filename prefix for which to save archive files of the running configuration. In this example, the time-period command is also configured to automatically save an archive file of the running configuration every 20 minutes. configure terminal ! archive path disk0:$h$t time-period 20 end The following is sample output from the show archive command illustrating the format of the resulting configuration archive filenames. Router# show archive There are currently 3 archive configurations saved. The next archive file will be named routerJan-16-01:12:23.019-4 Archive # Name 0 1 disk0:routerJan-16-00:12:23.019-1 2 disk0:routerJan-16-00:32:23.019-2 3 disk0:routerJan-16-00:52:23.019-3 <- Most Recent 4 5 6 7 8 9 10 11 12 13 14 Cisco IOS Configuration Archive on the TFTP File Server The following example shows how to use the path command to specify the TFTP file server, address 10.48.71.226, as the archive configuration location and router-cfg as the configuration filename. First you create the configuration file on the TFTP server and change the file’s privileges, then you can save the configuration file to the configuration archive. The following example shows the commands to use to create the file and change the file’s privileges on the TFTP server (UNIX commands): > touch router-cfg-1 path (archive configuration) CF-409 Cisco IOS Configuration Fundamentals Command Reference April 2010 > chmod 777 router-cfg-1 The following example show how to create the configuration archive, save the running configuration to the archive, and display the files in the archive: configure terminal ! archive path tftp://10.48.71.226/router-cfg exit exit ! archive config Router# show archive The next archive file will be named tftp://10.48.71.226/router-cfg-2 Archive # Name 0 1 tftp://10.48.71.226/router-cfg-1 <- Most Recent 2 3 4 5 6 7 8 9 10 11 12 13 14 The following is sample output from the show archive command if you did not create the configuration file on the TFTP server before attempting to archive the current running configuration file: configure terminal ! archive path tftp://10.48.71.226/router-cfg exit exit archive config Router# show archive The next archive file will be named tftp://10.48.71.226/router-cfg-1 Archive # Name 0 1 2 3 4 5 6 7 8 9 10 11 12 path (archive configuration) CF-410 Cisco IOS Configuration Fundamentals Command Reference April 2010 13 14 Related Commands Command Description archive Enters archive configuration mode. archive config Saves a copy of the current running configuration to the Cisco IOS configuration archive. configure confirm Confirms replacement of the current running configuration with a saved Cisco IOS configuration file. configure replace Replaces the current running configuration with a saved Cisco IOS configuration file. maximum Sets the maximum number of archive files of the running configuration to be saved in the Cisco IOS configuration archive. show archive Displays information about the files saved in the Cisco IOS configuration archive. time-period Sets the time increment for automatically saving an archive file of the current running configuration in the Cisco IOS configuration archive. periodic CF-411 Cisco IOS Configuration Fundamentals Command Reference April 2010 periodic To specify a recurring (weekly) time range for functions that support the time-range feature, use the periodic command in time-range configuration mode. To remove the time limitation, use the no form of this command. periodic days-of-the-week hh:mm to [days-of-the-week] hh:mm no periodic days-of-the-week hh:mm to [days-of-the-week] hh:mm Syntax Description Defaults No recurring time range is defined. Command Modes Time-range configuration (config-time-range) Command History Usage Guidelines For Cisco IOS Release 12.2(11)T, IP and Internetwork Packet Exchange (IPX) extended access lists are the only functions that can use time ranges. For further information on using these functions, refer to the Cisco IOS IP Configuration Guide and the Cisco IOS AppleTalk and Novell IPX Configuration Guide. days-of-the-week The first occurrence of this argument is the starting day or day of the week that the associated time range is in effect. The second occurrence is the ending day or day of the week the associated statement is in effect. This argument can be any single day or combinations of days: Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, and Sunday. Other possible values are: • daily—Monday through Sunday • weekdays—Monday through Friday • weekend—Saturday and Sunday If the ending days of the week are the same as the starting days of the week, they can be omitted. hh:mm The first occurrence of this argument is the starting hours:minutes that the associated time range is in effect. The second occurrence is the ending hours:minutes the associated statement is in effect. The hours:minutes are expressed in a 24-hour clock. For example, 8:00 is 8:00 a.m. and 20:00 is 8:00 p.m. to Entry of the to keyword is required to complete the range “from start-time to end-time.” Release Modification 12.0(1)T This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. periodic CF-412 Cisco IOS Configuration Fundamentals Command Reference April 2010 The periodic command is one way to specify when a time range is in effect. Another way is to specify an absolute time period with the absolute command. Use either of these commands after the time-range global configuration command, which specifies the name of the time range. Multiple periodic entries are allowed per time-range command. If the end days-of-the-week value is the same as the start value, they can be omitted. If a time-range command has both absolute and periodic values specified, then the periodic items are evaluated only after the absolute start time is reached, and are not further evaluated after the absolute end time is reached. Note All time specifications are taken as local time. To ensure that the time range entries take effect at the desired times, you should synchronize the system software clock using Network Time Protocol (NTP). Table 39 lists some typical settings for your convenience: Examples The following example configuration denies HTTP traffic on Monday through Friday from 8:00 a.m. to 6:00 p.m.: Router# show startup-config . . . time-range no-http periodic weekdays 8:00 to 18:00 ! ip access-list extended strict deny tcp any any eq http time-range no-http ! interface ethernet 0 ip access-group strict in . . . The following example configuration permits Telnet traffic on Mondays, Tuesdays, and Fridays from 9:00 a.m. to 5:00 p.m.: Router# show startup-config . . . Table 39 Typical Examples of periodic Command Syntax If you want: Configure this: Monday through Friday, 8:00 a.m. to 6:00 p.m. only periodic weekday 8:00 to 18:00 Every day of the week, from 8:00 a.m. to 6:00 p.m. only periodic daily 8:00 to 18:00 Every minute from Monday 8:00 a.m. to Friday 8:00 p.m. periodic monday 8:00 to friday 20:00 All weekend, from Saturday morning through Sunday night periodic weekend 00:00 to 23:59 Saturdays and Sundays, from noon to midnight periodic weekend 12:00 to 23:59 periodic CF-413 Cisco IOS Configuration Fundamentals Command Reference April 2010 time-range testing periodic Monday Tuesday Friday 9:00 to 17:00 ! ip access-list extended legal permit tcp any any eq telnet time-range testing ! interface ethernet 0 ip access-group legal in . . . Related Commands Command Description absolute Specifies an absolute start and end time for a time range. access-list (extended) Defines an extended IP access list. deny (IP) Sets conditions under which a packet does not pass a named IP access list. permit (IP) Sets conditions under which a packet passes a named IP access list. time-range Enables time-range configuration mode and names a time range definition. ping CF-414 Cisco IOS Configuration Fundamentals Command Reference April 2010 ping To diagnose basic network connectivity on AppleTalk, ATM, Connectionless Network Service (CLNS), DECnet, IP, Novell IPX, or source-route bridging (SRB) networks, use the ping command in user EXEC or privileged EXEC mode. ping [[protocol [tag] {host-name | system-address}] Syntax Description Command Default This command has no default values. Command Modes User EXEC (>) Privileged EXEC (#) Command History protocol (Optional) Protocol keyword, either appletalk, atm, clns, decnet, ipx, or srb. If a protocol is not specified, a basic ping will be sent using IP (IPv4). For extended options for ping over IP, see the documentation for the ping ip command. The ping atm interface atm, ping ip, ping ipv6, ping sna, and ping vrf commands are documented separately. tag (Optional) Specifies a tag encapsulated IP (tagIP) ping. host-name Hostname of the system to ping. If a host-name or system-address is not specified at the command line, it will be required in the ping system dialog. system-address Address of the system to ping. If a host-name or system-address is not specified at the command line, it will be required in the ping system dialog. Release Modification 10.0 This command was introduced. 12.0(7)T The ping sna command was introduced. 12.1(12c)E The ping vrf command was introduced. 12.2(2)T Support for the IPv6 protocol was added. 12.2(13)T The atm protocol keyword was added. The following keywords were removed because the Apollo Domain, Banyan VINES, and XNS protocols are no longer supported in Cisco IOS software: • apollo • vines • xns 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(25)SG This command was integrated into Cisco IOS Release 12.2(25)SG. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. ping CF-415 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines The ping command sends an echo request packet to an address then waits for a reply. Ping output can help you evaluate path-to-host reliability, delays over the path, and whether the host can be reached or is functioning. For example, the ping clns command sends International Organization for Standardization (ISO) CLNS echo packets to test the reachability of a remote router over a connectionless Open System Interconnection (OSI) network. If you enter the ping command without any keywords or argument values, an interactive system dialog prompts you for the additional syntax appropriate to the protocol you specify. (See the “Examples” section.) To exit the interactive ping dialog before responding to all the prompts, type the escape sequence. The default escape sequence is Ctrl-^, X (Simultaneously press and release the Ctrl, Shift, and 6 keys and then press the X key). The escape sequence will vary depending on your line configuration. For example, another commonly used escape sequence is Ctrl-c. Table 40 describes the test characters sent by the ping facility. Note Not all protocols require hosts to support pings. For some protocols, the pings are Cisco defined and can be answered only by another Cisco router. The availability of protocol keywords depends on what protocols are enabled on your system. Issuing the ping command in user EXEC mode will generally offer fewer syntax options than issuing the ping command in privileged EXEC mode. Examples After you enter the ping command in privileged EXEC mode, the system prompts you for a protocol keyword. The default protocol is IP. If you enter a hostname or address on the same line as the ping command, the default action is taken as appropriate for the protocol type of that name or address. The following example is sample dialog from the ping command using default values. The specific dialog varies somewhat from protocol to protocol. Router# ping Protocol [ip]: Table 40 ping Test Characters Character Description ! Each exclamation point indicates receipt of a reply. . Each period indicates that the network server timed out while waiting for a reply. U A destination unreachable error protocol data unit (PDU) was received. C A congestion experienced packet was received. I User interrupted test. M A destination unreachable error protocol data unit (PDU) was received (Type 3) MTU required but DF bit set (code 4) with the “Next-Hop MTU” set to a non-zero value. If the “Next-hop MTU“ is zero then ‘U’ is printed. ? Unknown packet type. & Packet lifetime exceeded. ping CF-416 Cisco IOS Configuration Fundamentals Command Reference April 2010 Target IP address: 192.168.7.27 Repeat count [5]: Datagram size [100]: Timeout in seconds [2]: Extended commands [n]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.7.27, timeout is 2 seconds: !!!!! Success rate is 100 percent, round-trip min/avg/max = 1/2/4 ms Table 41 describes the significant fields shown in the display. The following example verifies connectivity to the neighboring ATM device for the ATM permanent virtual circuit (PVC) with the virtual path identifier (VPI)/virtual channel identifier (VCI) value 0/16: Router# ping Protocol [ip]:atm Table 41 ping Field Descriptions for IP Field Description Protocol [ip]: Prompt for a supported protocol. Default: ip. Target IP address: Prompt for the IP address or hostname of the destination node you plan to ping. If you have specified a supported protocol other than IP, enter an appropriate address for that protocol here. Default: none. Repeat count [5]: Number of ping packets that will be sent to the destination address. Default: 5. Datagram size [100]: Size of the ping packet (in bytes). Default: 100 bytes. Timeout in seconds [2]: Timeout interval. Default: 2 (seconds). Extended commands [n]: Specifies whether a series of additional commands appears. Sweep range of sizes [n]: Allows you to vary the sizes of the echo packets being sent. This capability is useful for determining the minimum sizes of the maximum transmission units (MTUs) configured on the nodes along the path to the destination address. Packet fragmentation contributing to performance problems can then be reduced. !!!!! Each exclamation point (!) indicates receipt of a reply. A period (.) indicates that the network server timed out while waiting for a reply. Other characters may appear in the ping output display, depending on the protocol type. Success rate is 100 percent Percentage of packets successfully echoed back to the router. Anything less than 80 percent is usually considered problematic. round-trip min/avg/max = 1/2/4 ms Round-trip travel time intervals for the protocol echo packets, including minimum/average/maximum (in milliseconds). ping CF-417 Cisco IOS Configuration Fundamentals Command Reference April 2010 ATM Interface:atm1/0 VPI value [0]: VCI value [1]:16 Loopback - End(0), Segment(1) [0]:1 Repeat Count [5]: Timeout [2]: Type escape sequence to abort. Sending 5, 53-byte segment OAM echoes, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms Table 42 describes the default ping fields shown in the display. Related Commands Table 42 ping Field Descriptions for ATM Field Description Protocol [ip]: Prompt for a supported protocol. Default: ip. ATM Interface: Prompt for the ATM interface. VPI value [0]: Prompt for the virtual path identifier. Default: 0. VCI value [1]: Prompt for the virtual channel identifier. Default:1. Loopback - End(0), Segment(1) [0]: Prompt to specify end loopback, which verifies end-to-end PVC integrity, or segment loopback, which verifies PVC integrity to the neighboring ATM device. Default: segment loopback. Repeat Count [5]: Number of ping packets that will be sent to the destination address. Default: 5. Timeout [2]: Timeout interval. Default: 2 (seconds). !!!!! Each exclamation point (!) indicates receipt of a reply. A period (.) indicates that the network server timed out while waiting for a reply. Other characters may appear in the ping output display, depending on the protocol type. Success rate is 100 percent Percentage of packets successfully echoed back to the router. Anything less than 80 percent is usually considered problematic. round-trip min/avg/max = 1/1/1 ms Round-trip travel time intervals for the protocol echo packets, including minimum/average/maximum (in milliseconds). Command Description ping atm interface atm Tests the connectivity of a specific PVC. ping ip Tests network connectivity on IP networks. ping ipv6 Tests the connection to a remote host on the network using IPv6. ping sna Tests network integrity and timing characteristics over an SNA Switching network. ping vrf Tests the connection in the context of a specific VPN (VRF). ping (privileged) CF-418 Cisco IOS Configuration Fundamentals Command Reference April 2010 ping (privileged) To diagnose basic network connectivity on Apollo, AppleTalk, Connectionless Network Service (CLNS), DECnet, IP, Novell IPX, VINES, or XNS networks, use the ping command in privileged EXEC command mode. ping [hostname | system-address | [protocol | tag] {hostname | system-address}] [data [hex-data-pattern] | df-bit | repeat [repeat-count] | size [datagram-size] | source [source-address | async | bvi | ctunnel | dialer | ethernet | fastethernet | lex | loopback | multilink | null | port-channel | tunnel | vif | virtual-template | virtual-tokenring | xtagatm] | timeout [seconds] | validate] Syntax Description hostname (Optional) Hostname of the system to ping. system-address (Optional) Address of the system to ping. protocol (Optional) Protocol to use for the ping. Valid values are: apollo, appletalk, clns, decnet, ethernet, ip, ipv6, ipx, srb, vines, xns. tag (Optional) Specifies a tag encapsulated IP ping. data (Optional) Specifies the data pattern. hex-data-pattern (Optional) Hexidecimal value of the data in the range of 0 to FFFF. df-bit (Optional) Enables the “do not fragment” bit in the IP header. repeat (Optional) Specifies the number of times the ping should be sent. repeat-count (Optional) Integer in the range of 1 to 2147483647. The default is 5. size (Optional) Size, in bytes, of the ping datagram. datagram-size (Optional) Integer in the range of 40 to 18024. source (Optional) Device sending the ping source-address (Optional) Address or name of the device sending the ping. async (Optional) Asynchronous interface. bvi (Optional) Bridge-Group Virtual interface. ctunnel (Optional) CTunnel interface. dialer (Optional) Dialer interface. ethernet (Optional) Ethernet IEEE 802.3 interface. fastethernet (Optional) FastEthernet IEEE 802.3 interface. lex (Optional) Lex interface. loopback (Optional) Loopback interface. multilink (Optional) Multilink-group interface. null (Optional) Null interface. port-channel (Optional) Ethernet channel of interfaces. tunnel (Optional) Tunnel interface vif (Optional) Pragmatic General Multicast (PGM) host interface virtual-template (Optional) Virtual Template interface. virtual-tokenring (Optional) Virtual TokenRing. xtagatm (Optional) Extended Tag ATM interface. timeout (Optional) Specifies the timeout interval in seconds. ping (privileged) CF-419 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Default A ping operation is not performed. Command Modes Privileged EXEC Command History Usage Guidelines The ping (packet internet groper) command tests the reachability of a remote router over a connectionless Open System Interconnection (OSI) network. The command sends ISO CLNS echo packets to an address and waits for a reply. Ping output can help you evaluate path-to-host reliability, delays over the path, and whether the host can be reached or is functioning. When you type the ping command, you are prompted to enter options before the ping command executes. The characters in brackets ([]) indicate default values. When you want to use a default value, press Enter on your keyboard. If you enter a hostname or system address when you enter the ping command, the default action is taken for the protocol type of that hostname or system address. The optional data, df-bit, repeat, size, source, timeout, and validate keywords can be used to prevent extended ping command output. You can use as many of these keywords as you need, and you can use them in any order after the hostname or system-address arguments. When you enter the ethernet protocol option, you will be prompted to enter MAC address and maintenance domain in addition to the information common across protocols. To terminate a ping session before it completes, type the escape sequence (Ctrl-^ X) by simultaneously pressing and releasing the Ctrl, Shift, and 6 keys and then pressing the X key. Note Not all protocols require hosts to support pings. For some protocols, the pings are defined by Cisco and answered only by a Cisco router. Table 43 describes the test characters that the ping operation uses. ng seconds (Optional) Integer in the range of 0 to 3600. The default is 2. validate (Optional) Validates the reply data. Release Modification 10.0 This command was introduced. 12.0 The following keywords were added in Cisco IOS Release 12.0: data, df-bit, repeat, size, source, timeout, validate. 12.2(33)SRA The ethernet option for protocol was added in Cisco IOS Release 12.2(33)SRA. Table 43 ping Command Response Characters and Their Meanings Character Description ! Receipt of a reply. . Network server timed out while waiting for a reply. ping (privileged) CF-420 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example shows a ping command and output. The precise dialog varies from protocol to protocol, but all are similar to the ping session shown here using default values. Router# ping Protocol [ip]: Target IP address: 192.168.7.27 Repeat count [5]: Datagram size [100]: Timeout in seconds [2]: Extended commands [n]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.7.27, timeout is 2 seconds: !!!! Success rate is 100 percent, round-trip min/avg/max = 1/2/4 ms The following example shows how to send a ping specifying the ethernet protocol option, MAC address, and maintenance domain and using the default values for the remaining parameters: Router# ping Protocol [ip]: ethernet Mac Address : aabb.cc00.0410 Maintenance Domain : DOMAIN_PROVIDER_L5_1 VLAN [0]: 2 Source MPID [1522]: Repeat Count [5]: Datagram Size [107]: Timeout in seconds [2]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5 Ethernet CFM loopback messages, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/8 ms. Related Commands U Destination unreachable error protocol data unit (PDU) was received. C Congestion experienced packet was received. I User interrupted test. ? Unknown packet type. & Packet lifetime exceeded. Table 43 ping Command Response Characters and Their Meanings (continued) Character Description Command Description ping ethernet Sends Ethernet CFM loopback messages to a destination MAC address. ping (user) Tests the connection to a remote host on the network. ping vrf Tests the connection to a remote device in a VPN. ping ip CF-421 Cisco IOS Configuration Fundamentals Command Reference April 2010 ping ip To test network connectivity on IP networks, use the ping ip command in privileged EXEC mode. ping ip {host-name | ip-address} [data [hex-data-pattern] | df-bit | repeat [repeat-count] | size [datagram-size] [source {source-address | source-interface} ] [timeout seconds] [validate] [verbose] Syntax Description host-name Host name of the system to ping. system-address Address of the system to ping. data hex-data-pattern (Optional) Specifies the data pattern. Range is from 0 to FFFF. df-bit (Optional) Enables the “do-not-fragment” bit in the IP header. repeat repeat-count (Optional) Specifies the number of pings sent. The range is from 1 to 2147483647. The default is 5. size (Optional) Specifies the datagram size. Datagram size is the number of bytes in each ping. datagram-size (Optional) Range is from 40 to 18024. source (Optional) Specifies the source address or source interface. source-address (Optional) IP address to use as the source in the ping packets. source-interface (Optional) Name of the interface from which the ping should be sent, and the Interface ID (slot/port/number). Interface name keywords include the following: • async (Asynchronous Interface) • bvi (Bridge-Group Virtual Interface) • ctunnel • dialer • ethernet • fastEthernet • lex • loopback • multilink (Multilink-group interface) • null • port-channel (Ethernet channel of interfaces) • tunnel • vif (PGM Multicast Host interface) • virtual-template • virtual-tokenring • xtagatm (Extended Tag ATM interface) The availability of these keywords depends on your system hardware. timeout seconds (Optional) Specifies the timeout interval in seconds. The default is 2 seconds. Range is from 0 to 3600. ping ip CF-422 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Modes Privileged Exec Command History Usage Guidelines The ping command sends an echo request packet to an address, then awaits a reply. Ping output can help you evaluate path-to-host reliability, delays over the path, and whether the host can be reached or is functioning. To abnormally terminate a ping session, type the escape sequence—by default, Ctrl-^ X. You type the default by simultaneously pressing and releasing the Ctrl, Shift, and 6 keys, and then pressing the X key. Table 44 describes the test characters that the ping facility sends. Note Not all protocols require hosts to support pings. For some protocols, the pings are Cisco-defined and are only answered by another Cisco router. Examples After you enter the ping command in privileged mode, the system prompts you for a protocol keyword. The default protocol is IP. If you enter a host name or address on the same line as the ping command, the default action is taken as appropriate for the protocol type of that name or address. validate (Optional) Validates the reply data. verbose (Optional) Enables verbose output, which lists individual ICMP packets, as well as Echo Responses. Release Modification 10.0 This command was introduced. 12.0 The data, df-bit, repeat, size, source, timeout, and validate keywords were added. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 44 ping Test Characters Character Description ! Each exclamation point indicates receipt of a reply. . Each period indicates that the network server timed out while waiting for a reply. U A destination unreachable error protocol data unit (PDU) was received. C A congestion experienced packet was received. I User interrupted test. ? Unknown packet type. & Packet lifetime exceeded. ping ip CF-423 Cisco IOS Configuration Fundamentals Command Reference April 2010 The optional data, df-bit, repeat, size, source, timeout, and validate keywords can be used to avoid extended ping command output. You can use as many of these keywords as you need, and you can use them in any order after the host-name or system-address arguments. Although the precise dialog varies somewhat from protocol to protocol, all are similar to the ping session using default values shown in the following output: Router# ping Protocol [ip]: Target IP address: 192.168.7.27 Repeat count [5]: Datagram size [100]: Timeout in seconds [2]: Extended commands [n]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.7.27, timeout is 2 seconds: !!!!! Success rate is 100 percent, round-trip min/avg/max = 1/2/4 ms Table 45 describes the default ping fields shown in the display. Table 45 ping Field Descriptions Field Description Protocol [ip]: Prompts for a supported protocol. The default is IP. Target IP address: Prompts for the IP address or host name of the destination node you plan to ping. If you have specified a supported protocol other than IP, enter an appropriate address for that protocol here. The default is none. Repeat count [5]: Prompts for the number of ping packets that will be sent to the destination address. The default is 5 packets. Datagram size [100]: Prompts for the size of the ping packet (in bytes). The default is 100 bytes. Timeout in seconds [2]: Prompts for the timeout interval. The default is 2 seconds. Extended commands [n]: Specifies whether a series of additional commands appears. Sweep range of sizes [n]: Allows you to vary the sizes of the echo packets being sent. This capability is useful for determining the minimum sizes of the MTUs configured on the nodes along the path to the destination address. Packet fragmentation contributing to performance problems can then be reduced. !!!!! Each exclamation point (!) indicates receipt of a reply. A period (.) indicates that the network server timed out while waiting for a reply. Other characters may appear in the ping output display, depending on the protocol type. Success rate is 100 percent Indicates the percentage of packets successfully echoed back to the router. Anything less than 80 percent is usually considered problematic. round-trip min/avg/max = 1/2/4 ms Indicates the round-trip travel time intervals for the protocol echo packets, including minimum/average/maximum (in milliseconds). ping ip CF-424 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description ping ipv6 Tests the connection to a remote host on the network using IPv6. ping vrf Tests the connection in the context of a specific VPN (VRF). ping vrf CF-425 Cisco IOS Configuration Fundamentals Command Reference April 2010 ping vrf To test a connection in the context of a specific VPN connection, use the ping vrf command in user EXEC or privileged EXEC mode. ping vrf vrf-name [tag] [connection] target-address [connection-options] Syntax Description Command Default The default connection type for ping is IPv4. Command Modes User EXEC Privileged EXEC Command History Usage Guidelines A VPN routing/forwarding (VRF) instance is used to identify a VPN. To check if a configured VRF is working, you can use the ping vrf command. When attempting to ping from a provider edge (PE) router to a customer edge (CE) router, or from a PE router to PE router, the standard ping command will not usually work. The ping vrf command allows you to ping the IP addresses of LAN interfaces on CE routers. If you are on a PE router, be sure to indicate the specific VRF (VPN) name, as shown in the “Examples” section. If all required information is not provided at the command line, the system will enter the interactive dialog (extended mode) for ping. vrf-name The name of the VPN (VRF context). tag (Optional) Specifies a tag encapsulated IP (tagIP) ping. connection (Optional) Connection options include atm, clns, decnet, ip, ipv6, ipx, sna, or srb. The default is ip. target-address The destination ID for the ping operation. Usually, this is the IPv4 address of the host. For example, the target for an IPv4 ping in a VRF context would be the IPv4 address or domain name of the target host. The target for an IPv6 ping in a VRF context would be the IPv6 prefix or domain name of the target host. • If the target address is not specified, the CLI will enter the interactive dialog for ping. connection-options (Optional) Each connection type may have its own set of connection options. For example, connection options for IPv4 include source, df-bit, and timeout. See the appropriate ping command documentation for details. Release Modification 12.1(12c)E, 12.2 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. ping vrf CF-426 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, the target host in the domain 209.165.201.1 is pinged (using IP/ICMP) in the context of the “Customer_A” VPN connection. Router# ping vrf Customer_A 209.165.201.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 209.165.201.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 176/264/576 ms Pressing the Enter key before providing all of the required options will begin the interactive dialog for ping. In the following example, the interactive dialog is started after the “ip” protocol is specified, but no address is given: Router# ping vrf Customer_B ip Target IP address: 209.165.200.225 Repeat count [5]: Datagram size [100]: Timeout in seconds [2]: Extended commands [n]: y Source address or interface: Type of service [0]: Set DF bit in IP header? [no]: Validate reply data? [no]: Data pattern [0xABCD]: Loose, Strict, Record, Timestamp, Verbose[none]: Record Number of hops [ 9 ]: Loose, Strict, Record, Timestamp, Verbose[RV]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 209.165.200.225, timeout is 2 seconds: Packet has IP options: Total option bytes= 39, padded length=40 Record route: <*> (0.0.0.0) (0.0.0.0) (0.0.0.0) (0.0.0.0) (0.0.0.0) (0.0.0.0) (0.0.0.0) (0.0.0.0) (0.0.0.0) . . . Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms The following example shows the various options for IP in the ping vrf command: Router# show parser dump exec | include ping vrf 1 ping vrf 1 ping vrf ip 1 ping vrf ip (interactive) 1 ping vrf ip 1 ping vrf ip source

1 ping vrf ip source 1 ping vrf ip repeat <1-2147483647> 1 ping vrf ip size Number 1 ping vrf ip df-bit 1 ping vrf ip validate 1 ping vrf ip data <0-65535> 1 ping vrf ip timeout <0-3600> ping vrf CF-427 Cisco IOS Configuration Fundamentals Command Reference April 2010 1 ping vrf ip verbose 1 ping vrf ip data <0-65535> 1 ping vrf ip timeout <0-3600> 1 ping vrf tag 1 ping vrf atm 1 ping vrf ipv6 1 ping vrf appletalk 1 ping vrf decnet 1 ping vrf clns 1 ping vrf ipx 1 ping vrf sna 1 ping vrf srb Related Commands Command Description ping Diagnoses basic network connectivity to a specific host. ping atm interface atm Tests the connectivity of a specific PVC. ping ip Tests the connection to a remote host on the network using IPv4. ping ipv6 Tests the connection to a remote host on the network using IPv6. ping sna Tests network integrity and timing characteristics over an SNA Switching network. platform shell CF-428 Cisco IOS Configuration Fundamentals Command Reference April 2010 platform shell To grant shell access and enter shell access grant configuration mode, use the platform shell command in global configuration mode. To disable this function, use the no form of this command. platform shell no platform shell Syntax Description This command has no arguments or keywords. Command Default This command is disabled. Command Modes Global configuration (config) Command History Usage Guidelines This command should be entered before using the request platform software system shell command. Examples The following example shows how to grant shell access: Router(config)# platform shell Router(config)# Related Commands Release Modification 12.2(33)XNC This command was introduced. Command Description request platform software system shell Requests platform shelll access. power enable CF-429 Cisco IOS Configuration Fundamentals Command Reference April 2010 power enable To turn on power for the modules, use the power enable command in global configuration mode. To power down a module, use the no form of this command. power enable module slot no power enable module slot Syntax Description Defaults Enabled Command Modes Global configuration Command History Usage Guidelines When you enter the no power enable module slot command to power down a module, the module’s configuration is not saved. When you enter the no power enable module slot command to power down an empty slot, the configuration is saved. The slot argument designates the module number. Valid values for slot depend on the chassis that is used. For example, if you have a 13-slot chassis, valid values for the module number are from 1 to 13. Examples This example shows how to turn on the power for a module that was previously powered down: Router(config)# power enable module 5 Router(config)# This example shows how to power down a module: Router(config)# no power enable module 5 Router(config)# Related Commands module slot Specifies a module slot number; see the “Usage Guidelines” section for valid values. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(18)SXD This command was changed to allow you to disable power to empty slots. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show power Displays information about the power status. power redundancy-mode CF-430 Cisco IOS Configuration Fundamentals Command Reference April 2010 power redundancy-mode To set the power-supply redundancy mode, use the power redundancy-mode command in global configuration mode. power redundancy-mode {combined | redundant} Syntax Description Defaults redundant Command Modes Global configuration Command History Examples This example shows how to set the power supplies to the no-redundancy mode: Router(config)# power redundancy-mode combined Router(config)# This example shows how to set the power supplies to the redundancy mode: Router(config)# power redundancy-mode redundant Router(config)# Related Commands combined Specifies no redundancy (combine power-supply outputs). redundant Specifies redundancy (either power supply can operate the system). Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show power Displays information about the power status. printer CF-431 Cisco IOS Configuration Fundamentals Command Reference April 2010 printer To configure a printer and assign a server tty line (or lines) to it, use the printer command in global configuration mode. To disable printing on a tty line, use the no form of this command. printer printer-name {line number | rotary number} [newline-convert | formfeed] no printer Syntax Description Defaults No printers are defined by default. Command Modes Global configuration Command History Usage Guidelines This command enables you to configure a printer for operations and assign either a single tty line or a group of tty lines to it. To make multiple printers available through the same printer name, specify the number of a rotary group. In addition to configuring the printer with the printer command, you must modify the file /etc/printcap on your UNIX system to include the definition of the remote printer in the Cisco IOS software. Refer to the Cisco IOS Configuration Fundamentals Configuration Guide for additional information. Use the optional newline-convert keyword in UNIX environments that cannot handle single-character line terminators. This converts newline characters to a carriage-return, linefeed sequence. Use the formfeed keyword when using the line printer daemon (lpd) protocol to print and your system is unable to separate individual output jobs with a form feed (page eject). You can enter the newline-convert and formfeed keywords together and in any order. Examples In the following example a printer named printer1 is configured and output is assigned to tty line 4: Router(config)# printer printer1 line 4 printer-name Printer name. line number Assigns a tty line to the printer. rotary number Assigns a rotary group of tty lines to the printer. newline-convert (Optional) Converts newline (linefeed) characters to a two-character sequence “carriage-return, linefeed” (CR+LF). formfeed (Optional) Causes the Cisco IOS software to send a form-feed character (ASCII 0x0C) to the printer tty line immediately following each print job received from the network. Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. printer CF-432 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description clear line Returns a terminal line to idle state. private CF-433 Cisco IOS Configuration Fundamentals Command Reference April 2010 private To save user EXEC command changes between terminal sessions, use the private command in line configuration mode. To restore the default condition, use the no form of this command. private no private Syntax Description This command has no arguments or keywords. Defaults User-set configuration options are cleared with the exit EXEC command or when the interval set with the exec-timeout line configuration command has passed. Command Modes Line configuration Command History Usage Guidelines This command ensures that the terminal parameters set by the user remain in effect between terminal sessions. This behavior is desirable for terminals in private offices. Examples In the following example, line 15 (in this example, vty 1) is configured to keep all user-supplied settings at system restarts: Router(config)# line 15 Router(config-line)# private Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description exec-timeout Sets the interval that the EXEC command interpreter waits until user input is detected. exit Exits any configuration mode, or closes an active terminal session and terminates the EXEC. privilege CF-434 Cisco IOS Configuration Fundamentals Command Reference April 2010 privilege To configure a new privilege level for users and associate commands with that privilege level, use the privilege command in global configuration mode. To reset the privilege level of the specified command or commands to the default and remove the privilege level configuration from the running configuration file, use the no form of this command. Note As of Cisco IOS Releases 12.3(6) and 12.3(6)T, the no form of the privilege command and the reset keyword perform the same functions. privilege mode [all] {level level | reset} command-string no privilege mode [all] {level level | reset} command-string Syntax Description Defaults User EXEC mode commands are privilege level 1. Privileged EXEC mode and configuration mode commands are privilege level 15. Command Modes Global configuration mode Configuration mode for the specified command. See Table 46 in the “Usage Guidelines” section for a list of options for this argument. all (Optional) Changes the privilege level for all the suboptions to the same level. level level Specifies the privilege level you are configuring for the specified command or commands. The level argument must be a number from 0 to 15. reset Resets the privilege level of the specified command or commands to the default and removes the privilege level configuration from the running configuration file. Note For Cisco IOS software releases earlier than Release 12.3(6) and Release 12.3(6)T, you use the no form of this command to reset the privilege level to the default. The default form of this command will still appear in the configuration file. To completely remove a privilege configuration, use the reset keyword. command-string Command associated with the specified privilege level. If the all keyword is used, specifies the command and subcommands associated with the privilege level. privilege CF-435 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command History Usage Guidelines The password for a privilege level defined using the privilege global configuration command is configured using the enable secret command. Level 0 can be used to specify a more-limited subset of commands for specific users or lines. For example, you can allow user “guest” to use only the show users and exit commands. Note There are five commands associated with privilege level 0: disable, enable, exit, help, and logout. If you configure AAA authorization for a privilege level greater than 0, these five commands will not be included. When you set the privilege level for a command with multiple words, note that the commands starting with the first word will also have the specified access level. For example, if you set the show ip route command to level 15, the show commands and show ip commands are automatically set to privilege level 15—unless you set them individually to different levels. This is necessary because you can’t execute, for example, the show ip command unless you have access to show commands. To change the privilege level of a group of commands, use the all keyword. When you set a group of commands to a privilege level using the all keyword, all commands which match the beginning string are enabled for that level, and all commands which are available in submodes of that command are enabled for that level. For example, if you set the show ip keywords to level 5, show and ip will be changed to level 5 and all the options that follow the show ip string (such as show ip accounting, show ip aliases, show ip bgp, and so on) will be available at privilege level 5. Table 46 shows some of the keyword options for the mode argument in the privilege command. The available mode keywords will vary depending on your hardware and software version. To see a list of available mode options on your system, use the privilege ? command. . Release Modification 10.3 This command was introduced. 12.0(22)S, 12.2(13)T The all keyword was added. 12.3(6), 12.3(6)T The no form of the command performs the same function as the reset keyword. 12.2(33)SRA This command was integrated into Cisco IOS release 12.(33)SRA. 12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware. 12.2(33)SRE This command was integrated into Cisco IOS release 12.(33)SRE. Table 46 mode Argument Options Command Description accept-dialin VPDN group accept dialin configuration mode accept-dialout VPDN group accept dialout configuration mode address-family Address Family configuration mode alps-ascu ALPS ASCU configuration mode alps-circuit ALPS circuit configuration mode atm-bm-config ATM bundle member configuration mode privilege CF-436 Cisco IOS Configuration Fundamentals Command Reference April 2010 atm-bundle-config ATM bundle configuration mode atm-vc-config ATM virtual circuit configuration mode atmsig_e164_table_mode ATMSIG E164 Table cascustom Channel-associated signalling (cas) custom configuration mode config-rtr-http RTR HTTP raw request Configuration configure Global configuration mode controller Controller configuration mode crypto-map Crypto map config mode crypto-transform Crypto transform config modeCrypto transform configuration mode dhcp DHCP pool configuration mode dspfarm DSP farm configuration mode exec Exec mode flow-cache Flow aggregation cache configuration mode gateway Gateway configuration mode interface Interface configuration mode interface-dlci Frame Relay DLCI configuration mode ipenacl IP named extended access-list configuration mode ipsnacl IP named simple access-list configuration mode ip-vrf Configure IP VRF parameters lane ATM Lan Emulation Lecs Configuration Table line Line configuration mode map-class Map class configuration mode map-list Map list configuration mode mpoa-client MPOA Client mpoa-server MPOA Server null-interface Null interface configuration mode preaut AAA Preauth definitions request-dialin VPDN group request dialin configuration mode request-dialout VPDN group request dialout configuration mode route-map Route map configuration mode router Router configuration mode rsvp_policy_local rtr RTR Entry Configuration sg-radius RADIUS server group definition sg-tacacs+ TACACS+ server group Table 46 mode Argument Options (continued) Command Description privilege CF-437 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example shows how to set the configure command to privilege level 14 and establish SecretPswd14 as the password users must enter to use level 14 commands: privilege exec level 14 configure enable secret level 14 SecretPswd14 The following example shows how to set the show and ip keywords to level 5. The suboptions coming under ip will also be allowed to users with privilege level 5 access: Router(config)# privilege exec all level 5 show ip The following two examples demonstate the difference in behavior between the no form of the command and the use of the reset keyword when using Cisco IOS software releases earlier than Releases 12.3(6) and Release 12.3(6)T. Note As of Cisco IOS Releases 12.3(6) and 12.3(6)T, the no form of the privilege command and the reset keyword perform the same functions. ! show currently configured privilege commands Router# show running-config | include priv privilege configure all level 3 interface privilege exec level 3 configure terminal privilege exec level 3 configure Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)# no privilege exec level 3 configure terminal Router(config)# end ! show currently configured privilege commands Router# show running-config | include priv privilege configure all level 3 interface privilege exec level 15 configure terminal privilege exec level 15 configure sip-ua SIP UA configuration mode subscriber-policy Subscriber policy configuration mode tcl Tcl mode tdm-conn TDM connection configuration mode template Template configuration mode translation-rule Translation Rule configuration mode vc-class VC class configuration mode voiceclass Voice Class configuration mode voiceport Voice configuration mode voipdialpeer Dial Peer configuration mode vpdn-group VPDN group configuration mode Table 46 mode Argument Options (continued) Command Description privilege CF-438 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note that in the show running-config output above, the privilege command for “configure terminal” still appears, but now has the default privilege level assigned. To remove a previously configured privilege command entirely from the configuration, use the reset keyword, as shown in the following example: ! show currently configured privilege commands Router# show running-config | include priv privilege configure all level 3 interface privilege exec level 3 configure terminal privilege exec level 3 configure Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)# privilege exec reset configure terminal Router(config)# Router# show running-config | include priv privilege configure all level 3 interface Router# Related Commands Command Description enable password Sets a local password to control access to various privilege levels. enable secret Specifies an additional layer of security over the enable password command. privilege level Sets the default privilege level for a line. process cpu statistics limit entry-percentage CF-439 Cisco IOS Configuration Fundamentals Command Reference April 2010 process cpu statistics limit entry-percentage To set the process entry limit and the size of the history table for CPU utilization statistics, use the process cpu statistics limit entry-percentage command in global configuration mode. To disable CPU utilization statistics, use the no form of this command. process cpu statistics limit entry-percentage number [size seconds] no process cpu statistics limit entry-percentage Syntax Description Command Default size seconds: 600 seconds Command Modes Global configuration Command History Usage Guidelines Use the process cpu statistics limit entry-percentage command to set the entry limit and size of CPU utilization statistics. Examples The following example shows how to set an entry limit at 40 percent and a size of 300 seconds: configure terminal ! process cpu statistics limit entry-percentage 40 size 300 end Related Commands number Integer from 1 to 100 that indicates the percentage of CPU utilization that a process must use to become part of the history table. size seconds (Optional) Changes the duration of time in seconds for which CPU statistics are stored in the history table. Valid values are 5 to 86400. The default is 600. Release Modification 12.0(26)S This command was introduced. 12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. Command Description process cpu threshold type Defines CPU usage thresholds that, when crossed, cause a CPU threshold notification. snmp-server enable traps cpu Enables CPU threshold violations traps. snmp-server host Specifies the recipient of SNMP notifications. process cpu threshold type CF-440 Cisco IOS Configuration Fundamentals Command Reference April 2010 process cpu threshold type To set CPU thresholding notification types and values, use the process cpu threshold type command in global configuration mode. To disable CPU thresholding notifications, use the no form of this command. process cpu threshold type {total | process | interrupt} rising percentage interval seconds [falling fall-percentage interval seconds] no process cpu threshold type {total | process | interrupt} Syntax Description Command Default CPU thresholding notifications are disabled. Command Modes Global configuration Command History Usage Guidelines This command defines CPU usage thresholds that, when crossed, cause a CPU thresholding notification. When this command is enabled, Cisco IOS software polls the system at the configured interval. Notification occurs in two situations: • When a configured CPU usage threshold is exceeded (rising percentage) • When CPU usage falls below the configured threshold (falling fall-percentage) total Sets the CPU threshold type to total CPU utilization. process Sets the CPU threshold type to CPU process utilization. interrupt Sets the CPU threshold type to CPU interrupt utilization. rising percentage The percentage (1 to 100) of CPU resources that, when exceeded for the configured interval, triggers a CPU thresholding notification. interval seconds The duration of the CPU threshold violation, in seconds (5 to 86400), that must be met to trigger a CPU thresholding notification. falling fall-percentage (Optional) The percentage (1 to 100) of CPU resources that, when usage falls below this level for the configured interval, triggers a CPU thresholding notification. • This value must be equal to or less than the rising percentage value. • If not specified, the falling fall-percentage value is set to the same value as the rising percentage value. Release Modification 12.0(26)S This command was introduced. 12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. process cpu threshold type CF-441 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example shows how to set the total CPU utilization notification threshold at 80 percent for a rising threshold notification and 20 percent for a falling threshold notification, with a 5-second polling interval: configure terminal ! process cpu threshold type total rising 80 interval 5 falling 20 interval 5 end Related Commands Command Description process cpu statistics limit entry Sets the entry limit and size of CPU utilization statistics. snmp-server enable traps cpu Enables CPU threshold violations traps. snmp-server host Specifies the recipient of SNMP notifications. process-max-time CF-442 Cisco IOS Configuration Fundamentals Command Reference April 2010 process-max-time To configure the amount of time after which a process should voluntarily yield to another process, use the process-max-time command in global configuration mode. To reset this value to the system default, use the no form of this command. process-max-time milliseconds no process-max-time milliseconds Syntax Description Defaults The default maximum process time is 200 milliseconds. Command Modes Global configuration Command History Usage Guidelines Lowering the maximum time a process can run is useful in some circumstances to ensure equitable division of CPU time among different tasks. Only use this command if recommended to do so by the Cisco Technical Assistance Center (TAC). Examples The following example limits the duration that a process will run to 100 milliseconds: Router(config)# process-max-time 100 milliseconds Maximum duration (in milliseconds) that a process can run before suspension. The range is from 20to 200 milliseconds. Release Modification 12.1 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. prompt CF-443 Cisco IOS Configuration Fundamentals Command Reference April 2010 prompt To customize the CLI prompt, use the prompt command in global configuration mode. To revert to the default prompt, use the no form of this command. prompt string no prompt [string] Syntax Description Defaults The default prompt is either Router or the name defined with the hostname global configuration command, followed by an angle bracket (>) for user EXEC mode or a pound sign (#) for privileged EXEC mode. Command Modes Global configuration Command History Usage Guidelines You can include customized variables when specifying the prompt. All prompt variables are preceded by a percent sign (%). Table 47 lists the available prompt variables. Issuing the prompt %h command has the same effect as issuing the no prompt command. string Text that will be displayed on screen as the CLI prompt, including any desired prompt variables. Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 47 Custom Prompt Variables Prompt Variable Interpretation %h Host name. This is either Router or the name defined with the hostname global configuration command. %n Physical terminal line (tty) number of the EXEC user. %p Prompt character itself. It is either an angle bracket (>) for user EXEC mode or a pound sign (#) for privileged EXEC mode. %s Space. %t Tab. %% Percent sign (%) prompt CF-444 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example changes the EXEC prompt to include the tty number, followed by the name and a space: Router(config)# prompt TTY%n@%h%s%p The following are examples of user and privileged EXEC prompts that result from the previous command: TTY17@Router1 > enable TTY17@Router1 # Related Commands Command Description hostname Specifies or modifies the host name for the network server. pwd CF-445 Cisco IOS Configuration Fundamentals Command Reference April 2010 pwd To show the current setting of the cd command, use the pwd command in EXEC mode. pwd Syntax Description This command has no arguments or keywords. Command Modes User EXEC Priviledged EXEC Command History Usage Guidelines Use the pwd command to show which directory or file system is specified as the default by the cd command. For all EXEC commands that have an optional filesystem argument, the system uses the file system specified by the cd command when you omit the optional filesystem argument. For example, the dir command contains an optional filesystem argument and displays a list of files on a particular file system. When you omit this filesystem argument, the system shows a list of the files on the file system specified by the cd command. Examples The following example shows that the present working file system specified by the cd command is slot 0: Router> pwd slot0:/ The following example uses the cd command to change the present file system to slot 1 and then uses the pwd command to display that present working file system: Router> cd slot1: Router> pwd slot1:/ Related Commands Release Modification 11.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description cd Changes the default directory or file system. dir Displays a list of files on a file system. refuse-message CF-446 Cisco IOS Configuration Fundamentals Command Reference April 2010 refuse-message To define and enable a line-in-use message, use the refuse-message command in line configuration mode. To disable the message, use the no form of this command. refuse-message d message d no refuse-message Syntax Description Defaults Disabled (no line-in-use message is displayed). Command Modes Line configuration Command History Usage Guidelines Follow this command with one or more blank spaces and a delimiting character of your choice. Then enter one or more lines of text, terminating the message with the second occurrence of the delimiting character. You cannot use the delimiting character within the text of the message. When you define a message using this command, the Cisco IOS software performs the following steps: 1. Accepts the connection. 2. Prints the custom message. 3. Clears the connection. Examples In the following example, line 5 is configured with a line-in-use message, and the user is instructed to try again later: line 5 refuse-message /The dial-out modem is currently in use. Please try again later./ d Delimiting character of your choice—a pound sign (#), for example. You cannot use the delimiting character in the message. message Message text. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. reload CF-447 Cisco IOS Configuration Fundamentals Command Reference April 2010 reload To reload the operating system, use the reload command in privileged EXEC or diagnostic mode. reload [/verify | /noverify] [line | in [hhh:mm | mmm [text]] | at hh:mm [text] | reason [reason string] | cancel] Syntax Description Command Modes Privileged EXEC (#) Diagnostic (diag) Command History /verify (Optional) Verifies the digital signature of the file that will be loaded onto the operating system. /noverify (Optional) Does not verify the digital signature of the file that will be loaded onto the operating system. Note This keyword is often issued if the file verify auto command is enabled, which automatically verifies the digital signature of all images that are copied. line (Optional) Reason for reloading; the string can be from 1 to 255 characters long. in hhh:mm | mmm (Optional) Schedules a reload of the software to take effect in the specified minutes or hours and minutes. The reload must take place within approximately 24 days. text (Optional) Reason for reloading; the string can be from 1 to 255 characters long. at hh:mm (Optional) Schedules a reload of the software to take place at the specified time (using a 24-hour clock). If you specify the month and day, the reload is scheduled to take place at the specified time and date. If you do not specify the month and day, the reload takes place at the specified time on the current day (if the specified time is later than the current time) or on the next day (if the specified time is earlier than the current time). Specifying 00:00 schedules the reload for midnight. The reload must take place within 24 days. day (Optional) Number of the day in the range from 1 to 31. reason reason string (Optional) Used to specify a reason for reloading. cancel (Optional) Cancels a scheduled reload. Release Modification 10.0 This command was introduced. 12.2(14)SX Support for this command was added for the Supervisor Engine 720. 12.3(2)T The warm keyword was added. 12.2(18)S This command was integrated into Cisco IOS Release 12.2(18)S. The /verify and /noverify keywords were added. 12.2(20)S Support was added for the Cisco 7304 router. The Cisco 7500 series router in not supported in Cisco IOS Release 12.2(20)S. 12.0(26)S The /verify and /noverify keywords were integrated into Cisco IOS Release 12.0(26)S. reload CF-448 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines The reload command halts the system. If the system is set to restart on error, it reboots itself. Use the reload command after configuration information is entered into a file and saved to the startup configuration. You cannot reload from a virtual terminal if the system is not set up for automatic booting. This restriction prevents the system from using an image stored in the ROM monitor and taking the system out of the remote user’s control. If you modify your configuration file, the system prompts you to save the configuration. During a save operation, the system prompts whether you want to proceed with the save if the CONFIG_FILE variable points to a startup configuration file that no longer exists. If you respond “yes” in this situation, the system enters setup mode upon reload. When you schedule a reload to occur at a later time (using the in keyword), it must take place within 24 days. The at keyword can be used only if the system clock has been set on the router (either through Network Time Protocol [NTP], the hardware calendar, or manually). The time is relative to the configured time zone on the router. To schedule reloads across several routers to occur simultaneously, synchronize the time on each router with NTP. When you specify the reload time using the at keyword, if you specify the month and day, the reload takes place at the specified time and date. If you do not specify the month and day, the reload takes place at the specified time on the current day (if the specified time is later than the current time), or on the next day (if the specified time is earlier than the current time). Specifying 00:00 schedules the reload for midnight. The reload must take place within 24 days. To display information about a scheduled reload, use the show reload command. The /verify and /noverify Keywords If the /verify keyword is specified, the integrity of the image will be verified before it is reloaded onto a router. If verification fails, the image reload will not occur. Image verification is important because it assures the user that the image is protected from accidental corruption, which can occur at any time during transit, starting from the moment the files are generated by Cisco until they reach the user. The /noverify keyword overrides any global automatic image verification that may be enabled via the file verify auto command. 12.3(4)T The /verify and /noverify keywords were integrated into Cisco IOS Release 12.3(4)T. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.3(11)T The file keyword and url argument were added. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 15.0(1)M The reason keyword and reason string argument were added. Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Router and was made available in diagnostic mode. Release Modification reload CF-449 Cisco IOS Configuration Fundamentals Command Reference April 2010 The warm Keyword If you issue the reload command after you have configured the warm-reboot global configuration command, a cold reboot will occur. Thus, if you want to reload your system, but do not want to override the warm reboot functionality, you should specify the warm keyword with the reload command. The warm reboot functionality allows a Cisco IOS image to reload without ROM monitor intervention. That is, read-write data is saved in RAM during a cold startup and restored during a warm reboot. Warm rebooting allows the router to reboot quicker than conventional rebooting (where control is transferred to ROM monitor and back to the image) because nothing is copied from flash to RAM. Examples The following example shows how to immediately reload the software on the router: Router# reload The following example shows how to reload the software on the router in 10 minutes: Router# reload in 10 Router# Reload scheduled for 11:57:08 PDT Fri Apr 21 1996 (in 10 minutes) Proceed with reload? [confirm] The following example shows how to reload the software on the router at 1:00 p.m. today: Router# reload at 13:00 Router# Reload scheduled for 13:00:00 PDT Fri Apr 21 1996 (in 1 hour and 2 minutes) Proceed with reload? [confirm] The following example shows how to reload the software on the router on April 21 at 2:00 a.m.: Router# reload at 02:00 apr 21 Router# Reload scheduled for 02:00:00 PDT Sat Apr 21 1996 (in 38 hours and 9 minutes) Proceed with reload? [confirm] The following example shows how to cancel a pending reload: Router# reload cancel %Reload cancelled. The following example shows how to perform a warm reboot at 4:00 today: Router# reload warm at 4:00 The following example shows how to specify a reason for the reload: Router# reload reason reason string The following example shows how to specify image verification via the /verify keyword before reloading an image onto the router: Router# reload /verify Verifying file integrity of bootflash:c7200-kboot-mz.121-8a.E %ERROR:Signature not found in file bootflash:c7200-kboot-mz.121-8a.E. Signature not present. Proceed with verify? [confirm] Verifying file disk0:c7200-js-mz .......................................................................... ............................................................Done! Embedded Hash MD5 :CFA258948C4ECE52085DCF428A426DCD reload CF-450 Cisco IOS Configuration Fundamentals Command Reference April 2010 Computed Hash MD5 :CFA258948C4ECE52085DCF428A426DCD CCO Hash MD5 :44A7B9BDDD9638128C35528466318183 Signature Verified Proceed with reload? [confirm]n Related Commands Command Description copy system:running-config nvram:startup-config Copies any file from a source to a destination. file verify auto Enables automatic image verification. show reload Displays the reload status on the router. warm-reboot Enables router reloading with reading images from storage. remote command CF-451 Cisco IOS Configuration Fundamentals Command Reference April 2010 remote command To execute a Cisco 7600 series router command directly on the switch console or a specified module without having to log into the Cisco 7600 series router first, use the remote command command in privileged EXEC mode. remote command {module num | standby-rp | switch} command Syntax Description Defaults This command has no default settings. Command Modes Privileged EXEC Command History Usage Guidelines The module num keyword and argument designate the module number. Valid values depend on the chassis that is used. For example, if you have a 13-slot chassis, valid values are from 1 to 13. The module num keyword and argument are supported on DFC-equipped modules and the standby supervisor engine only. When you execute the remote command switch command, the prompt changes to Switch-sp#. This command is supported on DFC-equipped modules and the supervisor engine only. This command does not support command completion, but you can use shortened forms of the command (for example, entering sh for show). Examples This example shows how to execute the show calendar command from the standby route processor: Router# remote command standby-rp show calendar Switch-sp# 09:52:50 UTC Mon Nov 12 2001 Router# module num Specifies the module to access; see the “Usage Guidelines” section for valid values. standby-rp Specifies the standby route processor. switch Specifies the active switch processor. command Command to be executed. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(18)SXD The standby-rp keyword was added. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. remote command CF-452 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description remote login Accesses the Cisco 7600 series router console or a specific module. remote login CF-453 Cisco IOS Configuration Fundamentals Command Reference April 2010 remote login To access the Cisco 7600 series router console or a specific module, use the remote login command in privileged EXEC mode. remote login {module num | standby-rp | switch} Syntax Description Defaults This command has no default settings. Command Modes Privileged EXEC Command History Usage Guidelines Caution When you enter the attach or remote login command to access another console from your switch, if you enter global or interface configuration mode commands, the switch might reset. The module num keyword and argument designate the module number. Valid values depend on the chassis that is used. For example, if you have a 13-slot chassis, valid values are from 1 to 13. The module num keyword and argument are supported on DFC-equipped modules and the standby supervisor engine only. When you execute the remote login module num command, the prompt changes to Router-dfcx# or Switch-sp#, depending on the type of module to which you are connecting. When you execute the remote login standby-rp command, the prompt changes to Router-sdby#. When you execute the remote login switch command, the prompt changes to Switch-sp#. The remote login module num command is identical to the attach command. There are two ways to end the session: • You can enter the exit command as follows: Switch-sp# exit module num Specifies the module to access; see the “Usage Guidelines” section for valid values. standby-rp Specifies the standby route processor. switch Specifies the active switch processor. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(18)SXD This command was changed to include the standby-rp keyword. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. remote login CF-454 Cisco IOS Configuration Fundamentals Command Reference April 2010 [Connection to Switch closed by foreign host] Router# • You can press Ctrl-C three times as follows: Switch-sp# ^C Switch-sp# ^C Switch-sp# ^C Terminate remote login session? [confirm] y [Connection to Switch closed by local host] Router# Examples This example shows how to perform a remote login to a specific module: Router# remote login module 1 Trying Switch ... Entering CONSOLE for Switch Type "^C^C^C" to end this session Switch-sp# This example shows how to perform a remote login to the Cisco 7600 series router processor: Router# remote login switch Trying Switch ... Entering CONSOLE for Switch Type "^C^C^C" to end this session Switch-sp# This example shows how to perform a remote login to the standby route processor: Router# remote login standby-rp Trying Switch ... Entering CONSOLE for Switch Type "^C^C^C" to end this session Router-sdby# Related Commands Command Description attach Connects to a specific module from a remote location. remote-span CF-455 Cisco IOS Configuration Fundamentals Command Reference April 2010 remote-span To configure a virtual local area network (VLAN) as a remote switched port analyzer (RSPAN) VLAN, use the remote-span command in config-VLAN mode. To remove the RSPAN designation, use the no form of this command. remote-span no remote-span Syntax Description This command has no arguments or keywords. Defaults This command has no default settings. Command Modes Config-VLAN mode Command History Usage Guidelines This command is not supported in the VLAN database mode. You can enter the show vlan remote-span command to display the RSPAN VLANs in the Cisco 7600 series router. Examples This example shows how to configure a VLAN as an RSPAN VLAN: Router(config-vlan)# remote-span Router(config-vlan) This example shows how to remove the RSPAN designation: Router(config-vlan)# no remote-span Router(config-vlan) Related Commands Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Connect Description show vlan remote-span Displays a list of RSPAN VLANs. rename CF-456 Cisco IOS Configuration Fundamentals Command Reference April 2010 rename To rename a file in a Class C Flash file system, use the rename command in EXEC, privileged EXEC, or diagnostic mode. rename url1 url2 Syntax Description Command Modes User EXEC (>) Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines This command is valid only on Class C Flash file systems. Examples In the following example, the file named Karen.1 is renamed test: Router# dir Directory of disk0:/Karen.dir/ 0 -rw- 0 Jan 21 1998 09:51:29 Karen.1 0 -rw- 0 Jan 21 1998 09:51:29 Karen.2 0 -rw- 0 Jan 21 1998 09:51:29 Karen.3 0 -rw- 0 Jan 21 1998 09:51:31 Karen.4 243 -rw- 165 Jan 21 1998 09:53:17 Karen.cur 340492288 bytes total (328400896 bytes free) Router# rename disk0:Karen.dir/Karen.1 disk0:Karen.dir/test Router# dir Directory of disk0:/Karen.dir/ 0 -rw- 0 Jan 21 1998 09:51:29 Karen.2 0 -rw- 0 Jan 21 1998 09:51:29 Karen.3 0 -rw- 0 Jan 21 1998 09:51:31 Karen.4 243 -rw- 165 Jan 21 1998 09:53:17 Karen.cur 0 -rw- 0 Apr 24 1998 09:49:19 test 340492288 bytes total (328384512 bytes free) url1 The original path and filename. url2 The new path and filename. Release Modification 11.3 AA This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Router and was made available in diagnostic mode. request platform software package describe file CF-457 Cisco IOS Configuration Fundamentals Command Reference April 2010 request platform software package describe file To gather descriptive information about an individual module or a Cisco IOS-XE image file, use the request platform software package describe file command in privileged EXEC or diagnostic mode. request platform software package describe file URL [detail] [verbose] Syntax Description Command Default No default behavior or values. Command Modes Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines This command can only be used to gather information on individual module and Cisco IOS-XE image files. Using this command to collect information on any other file will generate output, but the generated output is useless. The output of this command can be used for the following functions: • To confirm the individual module files that are part of a Cisco IOS-XE image. • To confirm whether or not a file is bootable. • To confirm the contexts in which a file must be reloaded or booted. • To confirm whether or not a file is corrupted. • To confirm file and header sizes, build dates, and various other general information. Examples In the following example, this command is entered to gather information about an individual SIP Base module file on the bootflash: file system. Router# request platform software package describe file bootflash:asr1000rp1-sipbase.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Package: asr1000rp1-sipbase.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Size: 36954316 Timestamp: 2007-12-05 15:36:27 UTC Canonical path: /bootflash/asr1000rp1-sipbase.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg URL Specifies the URL to the file. The URL contains the file system, directories, and the filename. detail Specifies detailed output. verbose Displays verbose information, meaning all information that can be displayed on the console about the file will be displayed. Release Modification IOS XE Release 2.1 This command was introduced. request platform software package describe file CF-458 Cisco IOS Configuration Fundamentals Command Reference April 2010 Raw disk-file SHA1sum: 3ee37cdbe276316968866b16df7d8a5733a1502e Computed SHA1sum: f2db80416a1245a5b1abf2988088860b38ce7898 Contained SHA1sum: f2db80416a1245a5b1abf2988088860b38ce7898 Hashes match. Package is valid. Header size: 204 bytes Package type: 10000 Package flags: 0 Header version: 0 Internal package information: Name: cc BuildTime: 2007-12-04_05.24 ReleaseDate: Tue 04-Dec-07 01:00 RouteProcessor: rp1 Platform: ASR1000 User: mcpre PackageName: sipbase Build: v122_33_xn_asr_rls0_throttle_20071204_051318 Package is bootable on SIP when specified by packages provisioning file. In the following example, this command is used to gather information about a Cisco IOS-XE image on the bootflash: file system. Router# request platform software package describe file bootflash:ASR1000rp1-advipservicesk9.01.00.00.12-33.XN.bin Package: ASR1000rp1-advipservicesk9.01.00.00.12-33.XN.bin Size: 218783948 Timestamp: 2007-12-04 17:14:09 UTC Canonical path: /bootflash/ASR1000rp1-advipservicesk9.01.00.00.12-33.XN.bin Raw disk-file SHA1sum: d2999fc7e27e01344903a42ffacd62c156eba4cc Computed SHA1sum: 5f8cda8518d01d8282d80ecd34f7715783f4a813 Contained SHA1sum: 5f8cda8518d01d8282d80ecd34f7715783f4a813 Hashes match. Package is valid. Header size: 204 bytes Package type: 30000 Package flags: 0 Header version: 0 Internal package information: Name: rp_super BuildTime: 2007-12-04_05.24 ReleaseDate: Tue 04-Dec-07 01:00 RouteProcessor: rp1 Platform: ASR1000 User: mcpre PackageName: advipservicesk9 Build: v122_33_xn_asr_rls0_throttle_20071204_051318 request platform software package describe file CF-459 Cisco IOS Configuration Fundamentals Command Reference April 2010 Package is bootable from media and tftp. Package contents: Package: asr1000rp1-espbase.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Size: 52072652 Timestamp: 2007-12-04 13:33:13 UTC Raw disk-file SHA1sum: f1aad6d687256aa327a4efa84deab949fbed12b8 Computed SHA1sum: 15502fd1b8f9ffd4af4014ad4d8026c837929fe6 Contained SHA1sum: 15502fd1b8f9ffd4af4014ad4d8026c837929fe6 Hashes match. Package is valid. Header size: 204 bytes Package type: 20000 Package flags: 0 Header version: 0 Internal package information: Name: fp BuildTime: 2007-12-04_05.24 ReleaseDate: Tue 04-Dec-07 01:00 RouteProcessor: rp1 Platform: ASR1000 User: mcpre PackageName: espbase Build: v122_33_xn_asr_rls0_throttle_20071204_051318 Package is bootable on ESP when specified by packages provisioning file. Package: asr1000rp1-rpaccess-k9.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Size: 21844172 Timestamp: 2007-12-04 13:33:01 UTC Raw disk-file SHA1sum: 025e6159dd91cef9d254ca9fff2602d8ce065939 Computed SHA1sum: ea1b358324ba5815b9ea623b453a98800eae1c78 Contained SHA1sum: ea1b358324ba5815b9ea623b453a98800eae1c78 Hashes match. Package is valid. Header size: 204 bytes Package type: 30004 Package flags: 0 Header version: 0 Internal package information: Name: rp_security BuildTime: 2007-12-04_05.24 ReleaseDate: Tue 04-Dec-07 01:00 RouteProcessor: rp1 Platform: ASR1000 User: mcpre PackageName: rpaccess-k9 Build: v122_33_xn_asr_rls0_throttle_20071204_051318 request platform software package describe file CF-460 Cisco IOS Configuration Fundamentals Command Reference April 2010 Package is not bootable. Package: asr1000rp1-rpbase.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Size: 21520588 Timestamp: 2007-12-04 13:33:06 UTC Raw disk-file SHA1sum: 432dfa61736d8a51baefbb2d70199d712618dcd2 Computed SHA1sum: 83c0335a3adcea574bff237a6c8640a110a045d4 Contained SHA1sum: 83c0335a3adcea574bff237a6c8640a110a045d4 Hashes match. Package is valid. Header size: 204 bytes Package type: 30001 Package flags: 0 Header version: 0 Internal package information: Name: rp_base BuildTime: 2007-12-04_05.24 ReleaseDate: Tue 04-Dec-07 01:00 RouteProcessor: rp1 Platform: ASR1000 User: mcpre PackageName: rpbase Build: v122_33_xn_asr_rls0_throttle_20071204_051318 Package is bootable on RP when specified by packages provisioning file. Package: asr1000rp1-rpcontrol.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Size: 24965324 Timestamp: 2007-12-04 13:33:08 UTC Raw disk-file SHA1sum: eb964b33d4959c21b605d0989e7151cd73488a8f Computed SHA1sum: 19b58886f97c79f885ab76c1695d1a6f4348674e Contained SHA1sum: 19b58886f97c79f885ab76c1695d1a6f4348674e Hashes match. Package is valid. Header size: 204 bytes Package type: 30002 Package flags: 0 Header version: 0 Internal package information: Name: rp_daemons BuildTime: 2007-12-04_05.24 ReleaseDate: Tue 04-Dec-07 01:00 RouteProcessor: rp1 Platform: ASR1000 User: mcpre PackageName: rpcontrol Build: v122_33_xn_asr_rls0_throttle_20071204_051318 request platform software package describe file CF-461 Cisco IOS Configuration Fundamentals Command Reference April 2010 Package is not bootable. Package: asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Size: 48515276 Timestamp: 2007-12-04 13:33:13 UTC Raw disk-file SHA1sum: bc13462d6a4af7a817a7346a44a0ef7270e3a81b Computed SHA1sum: f1235d703cc422e53bce850c032ff3363b587d70 Contained SHA1sum: f1235d703cc422e53bce850c032ff3363b587d70 Hashes match. Package is valid. Header size: 204 bytes Package type: 30003 Package flags: 0 Header version: 0 Internal package information: Name: rp_iosd BuildTime: 2007-12-04_05.24 ReleaseDate: Tue 04-Dec-07 01:00 RouteProcessor: rp1 Platform: ASR1000 User: mcpre PackageName: rpios-advipservicesk9 Build: v122_33_xn_asr_rls0_throttle_20071204_051318 Package is not bootable. Package: asr1000rp1-sipbase.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Size: 36954316 Timestamp: 2007-12-04 13:33:11 UTC Raw disk-file SHA1sum: 3ee37cdbe276316968866b16df7d8a5733a1502e Computed SHA1sum: f2db80416a1245a5b1abf2988088860b38ce7898 Contained SHA1sum: f2db80416a1245a5b1abf2988088860b38ce7898 Hashes match. Package is valid. Header size: 204 bytes Package type: 10000 Package flags: 0 Header version: 0 Internal package information: Name: cc BuildTime: 2007-12-04_05.24 ReleaseDate: Tue 04-Dec-07 01:00 RouteProcessor: rp1 Platform: ASR1000 User: mcpre PackageName: sipbase Build: v122_33_xn_asr_rls0_throttle_20071204_051318 Package is bootable on SIP when specified request platform software package describe file CF-462 Cisco IOS Configuration Fundamentals Command Reference April 2010 by packages provisioning file. Package: asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Size: 19933388 Timestamp: 2007-12-04 13:33:06 UTC Raw disk-file SHA1sum: 44b6d15cba31fb0e9b27464665ee8a24b92adfd2 Computed SHA1sum: b1d5faf093b183e196c7c8e1023fe1f7aafdd36d Contained SHA1sum: b1d5faf093b183e196c7c8e1023fe1f7aafdd36d Hashes match. Package is valid. Header size: 204 bytes Package type: 10001 Package flags: 0 Header version: 0 Internal package information: Name: cc_spa BuildTime: 2007-12-04_05.24 ReleaseDate: Tue 04-Dec-07 01:00 RouteProcessor: rp1 Platform: ASR1000 User: mcpre PackageName: sipspa Build: v122_33_xn_asr_rls0_throttle_20071204_051318 Package is not bootable. Related Commands Command Description request platform software package install file Upgrades an individual package or a superpackage file. request platform software package expand file CF-463 Cisco IOS Configuration Fundamentals Command Reference April 2010 request platform software package expand file To extract the individual modules from a Cisco IOS-XE image, use the request platform software package expand file command in privileged EXEC or diagnostic mode. request platform software package expand file source-URL [to destination-URL] [force] [verbose] [wipe] Syntax Description Command Default No default behavior or values Command Modes Privileged EXEC (#) Diagnostic Mode (diag) Command History Usage Guidelines This command only extracts individual module files and a provisioning file from the Cisco IOS-XE image. Additional configuration is needed to configure the router to boot using the provisioning files and run using the individual modules. When this command is used, copies of each module and the provisioning file within the Cisco IOS-XE image are copied and placed on the destination directory. The Cisco IOS-XE image file is unchanged after the operation is complete. If the to destination-URL option is not entered, the Cisco IOS-XE image contents will be extracted onto the same directory where the Cisco IOS-XE image is currently stored. If this command is used to extract individual module files onto a directory that already contains individual module files, the files that would have been extracted onto the same directory are instead extracted to an automatically created directory on the destination device. source-URL Specifies the URL to the Cisco IOS-XE file that stores the contents that will be extracted. to destination-URL Specifies the destination URL where the files that were extracted from the Cisco IOS-XE file are left after the operation is complete. If this option is not entered, the Cisco IOS-XE image file contents are extracted onto the same directory where the Cisco IOS-XE image file is currently stored. force (Optional) Specifies that the operation will be forced, meaning that the upgrade will proceed despite any warning messages. verbose (Optional) Displays verbose information, meaning all output that can be displayed on the console during the process will be displayed. wipe (Optional) Erases all content on the destination snapshot directory before extracting the files and placing them on the snapshot directory. Release Modification IOS XE Release 2.1 This command was introduced. request platform software package expand file CF-464 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example shows how to extract the individual modules and the provisioning file from a Cisco IOS-XE image that has already been placed in the directory where the user wants to store the individual modules and the provisioning file. Output of the directory before and after the extraction is given to confirm the files were extracted. Router# dir bootflash: Directory of bootflash:/ 11 drwx 16384 Dec 4 2007 11:26:07 +00:00 lost+found 14401 drwx 4096 Dec 4 2007 11:27:41 +00:00 .installer 12 -rw- 218783948 Dec 4 2007 12:12:16 +00:00 ASR1000rp1-advipservicesk9.01.00.00.12-33.XN.bin Router# request platform software package expand file bootflash:ASR1000rp1-advipservicesk9.01.00.00.12-33.XN.bin Verifying parameters Validating package type Copying package files Router# dir bootflash: Directory of bootflash:/ 11 drwx 16384 Dec 4 2007 11:26:07 +00:00 lost+found 14401 drwx 4096 Dec 4 2007 11:27:41 +00:00 .installer 12 -rw- 218783948 Dec 4 2007 12:12:16 +00:00 ASR1000rp1-advipservicesk9.01.00.00.12-33.XN.bin 28803 -rw- 52072652 Dec 4 2007 12:14:17 +00:00 asr1000rp1-espbase.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg 28804 -rw- 21844172 Dec 4 2007 12:14:17 +00:00 asr1000rp1-rpaccess-k9.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg 28805 -rw- 21520588 Dec 4 2007 12:14:18 +00:00 asr1000rp1-rpbase.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg 28806 -rw- 24965324 Dec 4 2007 12:14:19 +00:00 asr1000rp1-rpcontrol.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg 28807 -rw- 48515276 Dec 4 2007 12:14:20 +00:00 asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg 28808 -rw- 36954316 Dec 4 2007 12:14:21 +00:00 asr1000rp1-sipbase.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg 28809 -rw- 19933388 Dec 4 2007 12:14:22 +00:00 asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg 28802 -rw- 7145 Dec 4 2007 12:14:22 +00:00 packages.conf 928833536 bytes total (483700736 bytes free) The following example shows how to extract the individual modules and the provisioning file from a Cisco IOS-XE image that has already been placed on the router in a directory that will not store the individual modules and the provisioning file. In this particular example, the contents of a Cisco IOS-XE image stored in usb0: are extracted into bootflash:. Output of the bootflash: directory before and after the extraction is given to confirm the files were extracted. Router# dir usb0: Directory of usb0:/ 1120 -rwx 213225676 Dec 4 2007 10:50:36 +00:00 asr1000rp1-advipservicesk9.v122_33_xn_asr_rls0_throttle.bin Router# dir bootflash: Directory of bootflash:/ 11 drwx 16384 Dec 4 2007 12:32:46 +00:00 lost+found request platform software package expand file CF-465 Cisco IOS Configuration Fundamentals Command Reference April 2010 86401 drwx 4096 Dec 4 2007 14:06:24 +00:00 .ssh 14401 drwx 4096 Dec 4 2007 14:06:36 +00:00 .rollback_timer 43201 drwx 4096 Dec 4 2007 12:34:45 +00:00 .installer Router# request platform software package expand file usb0:asr1000rp1-advipservicesk9.v122_33_xn_asr_rls0_throttle.bin to bootflash: Verifying parameters Validating package type Copying package files Router# dir bootflash: Directory of bootflash:/ 11 drwx 16384 Dec 4 2007 12:32:46 +00:00 lost+found 86401 drwx 4096 Dec 4 2007 14:06:24 +00:00 .ssh 14401 drwx 4096 Dec 4 2007 14:06:36 +00:00 .rollback_timer 43201 drwx 4096 Dec 4 2007 12:34:45 +00:00 .installer 28803 -rw- 51986636 Dec 4 2007 16:40:38 +00:00 asr1000rp1-espbase.v122_33_xn_asr_rls0_throttle.pkg 28804 -rw- 21838028 Dec 4 2007 16:40:39 +00:00 asr1000rp1-rpaccess-k9.v122_33_xn_asr_rls0_throttle.pkg 28805 -rw- 21508300 Dec 4 2007 16:40:39 +00:00 asr1000rp1-rpbase.v122_33_xn_asr_rls0_throttle.pkg 28806 -rw- 24963276 Dec 4 2007 16:40:40 +00:00 asr1000rp1-rpcontrol.v122_33_xn_asr_rls0_throttle.pkg 28807 -rw- 48419020 Dec 4 2007 16:40:41 +00:00 asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle.pkg 28808 -rw- 36946124 Dec 4 2007 16:40:43 +00:00 asr1000rp1-sipbase.v122_33_xn_asr_rls0_throttle.pkg 28809 -rw- 14670028 Dec 4 2007 16:40:43 +00:00 asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg 28802 -rw- 6563 Dec 4 2007 16:40:43 +00:00 packages.conf 928862208 bytes total (708186112 bytes free) Related Commands Command Description request platform software package install file Upgrades an individual module or a Cisco IOS-XE file. request platform software package install commit CF-466 Cisco IOS Configuration Fundamentals Command Reference April 2010 request platform software package install commit To cancel the rollback timer and commit a software upgrade, use the request platform software package install commit command in privileged EXEC or diagnostic mode. request platform software package install rp rp-slot-number commit [verbose] Syntax Description Command Default No default behavior or values. Command Modes Privileged EXEC (#) Diagnostic Mode (diag) Command History Usage Guidelines This command is entered after the request platform software package install rp rp-slot-number file command is used with the auto-rollback minutes option to begin an individual sub-package or a consolidated package upgrade. When the auto-rollback minutes option is used in this context, a rollback timer that cancels the upgrade after the number of specified minutes cancels the upgrade if the request platform software package install rp rp-slot-number commit command is not entered to commit the upgrade. If this command is not entered after the request platform software package install rp rp-slot-number file command is used with the auto-rollback minutes option to upgrade an individual sub-package or a consolidated package and the rollback timer expires, the upgrade does not complete and the router continues running the previous sub-package or consolidated package. Examples In the following example, this command is entered to commit an upgrade: request platform software package install rp 1 commit rp rp-slot-number Specifies the RP slot number. commit Specifies that an upgrade that was done using a rollback timer that has not expired can be committed. verbose (Optional) Displays verbose information, meaning all information that can be displayed on the console during the process will be displayed. Release Modification Cisco IOS XE Release 2.1 This command was introduced. request platform software package install commit CF-467 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description request platform software package install file Upgrades a consolidated package or sub-package. request platform software package install rollback Rolls back a previous software upgrade. request platform software package install file CF-468 Cisco IOS Configuration Fundamentals Command Reference April 2010 request platform software package install file To upgrade a consolidated package or an individual sub-package, use the request platform software package install file command in privileged EXEC or diagnostic mode. request platform software package install rp rp-slot-number file file-URL [auto-rollback minutes] [provisioning-file URL] [slot slot-number] [bay bay-number] [force] [on-reboot] [verbose] Syntax Description Command Default No default behavior or values. Command Modes Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines This command is used to upgrade consolidated packages and individual sub-packages. When this command is used to upgrade a SIPBASE sub-package, the slot slot-number of the SIP must be specified. When this command is used to upgrade a SIPSPA sub-package, the slot slot-number of the SIP and the bay bay-number of the SPA must be specified. rp rp-slot-number Specifies the RP slot number. file file-URL Specifies the URL to the consolidated package or sub-package. auto-rollback minutes Specifies the setting of a rollback timer, and sets the number of minutes on the rollback timer before the rollback timer expires. provisioning-file provisioning-file-URL Specifies the URL to the provisioning file. A provisioning file is used for booting only when a Cisco ASR 1000 Series Router is booted using individual sub-packages. slot slot-number Specifies the router slot number where a SIP can be installed. bay bay-number Specifies the SPA bay number within a SIP. force Specifies that the operation will be forced, meaning that the upgrade will proceed despite any warning messages. on-reboot Specifies that the installation will not be completed until the next RP reboot. verbose Displays verbose information, meaning all output that can be displayed on the console during the process will be displayed. Release Modification Cisco IOS XE Release 2.1 This command was introduced. request platform software package install file CF-469 Cisco IOS Configuration Fundamentals Command Reference April 2010 When the auto-rollback minutes option is used, the request platform software package install rp rp-slot-number commit command must be entered before the rollback timer expires to complete the upgrade. If this command is not entered, the router rolls back to the previous software version. The rollback timer expires after the number of specified minutes. If the auto-rollback minutes option is not used, the upgrade simply occurs. Examples Managing and Configuring a consolidated package using the request platform package command In the following example, the request platform software package install command is used to upgrade a consolidated package running on RP 0. The force option, which forces the upgrade past any prompt (such as already having the same consolidated package installed), is used in this example. Router# request platform software package install rp 0 file bootflash:ASR1000rp1-advipservicesk9.01.00.00.12-33.XN.bin force --- Starting installation state synchronization --- Finished installation state synchronization --- Starting file path checking --- Finished file path checking --- Starting image file verification --- Checking image file names Verifying image file locations Locating image files and validating name syntax Inspecting image file types Processing image file constraints Extracting super package content Verifying parameters Validating package type Copying package files Checking and verifying packages contained in super package Creating candidate provisioning file WARNING: WARNING: Candidate software will be installed upon reboot WARNING: Finished image file verification --- Starting candidate package set construction --- Verifying existing software set Processing candidate provisioning file Constructing working set for candidate package set Constructing working set for running package set Checking command output Constructing merge of running and candidate packages Finished candidate package set construction --- Starting compatibility testing --- Determining whether candidate package set is compatible WARNING: WARNING: Candidate software combination not found in compatibility database WARNING: request platform software package install file CF-470 Cisco IOS Configuration Fundamentals Command Reference April 2010 Determining whether installation is valid Determining whether installation is valid ... skipped Checking IPC compatibility with running software Checking IPC compatibility with running software ... skipped Checking candidate package set infrastructure compatibility Checking infrastructure compatibility with running software Checking infrastructure compatibility with running software ... skipped Finished compatibility testing --- Starting commit of software changes --- Updating provisioning rollback files Creating pending provisioning file Committing provisioning file Finished commit of software changes SUCCESS: Software provisioned. New software will load on reboot. Router# reload Note A reload must be performed to finish this procedure. SIP Sub-package Installation with Verbose Option In the following example, the SIP sub-package for the SIP in slot 1 is installed using the request platform software package install command. In this example, the force option, which forces the upgrade past any prompt (such as already having the same sub-package installed), and the verbose option, which displays all possible output during the installation, are used. Router# request platform software package install rp 0 file bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg slot 1 force verbose --- Starting installation state synchronization --- Finished installation state synchronization --- Starting file path checking --- Finished file path checking --- Starting image file verification --- Checking image file names ... file names checked Verifying image file locations ... image file locations verified Locating image files and validating name syntax ... image file names validated Inspecting image file types ... image file types acceptable Processing image file constraints ... constraints satisfied Creating candidate provisioning file ... created candidate provisioning file Finished image file verification --- Starting candidate package set construction --- Verifying existing software set ... verified existing software set is valid Processing candidate provisioning file ... candidate provisioning file processed Constructing working set for candidate package set ... working set constructed Constructing working set for running package set request platform software package install file CF-471 Cisco IOS Configuration Fundamentals Command Reference April 2010 ... working set for running package set constructed Checking command output ... command output is consistent with command set Constructing merge of running and candidate packages ... merged running and candidate packages Finished candidate package set construction --- Starting compatibility testing --- Determining whether candidate package set is compatible WARNING: WARNING: Candidate software combination not found in compatibility database WARNING: ... candidate package set is valid Determining whether installation is valid Software is unchanged Software sets are identified as compatible ... installation is valid Checking IPC compatibility with running software calling minime_merge.sh for /tmp/tdlresolve/compat/_tmp_issu_provision_sw_ minime_merge done for /tmp/tdlresolve/compat/_tmp_issu_provision_sw_ ... IPC is compatible with running software Checking candidate package set infrastructure compatibility ... candidate package set infrastructure is compatible Checking infrastructure compatibility with running software ... infrastructure is compatible with running software Finished compatibility testing --- Starting impact testing --- Checking operational impact of change ... operational impact of change is allowable Finished impact testing --- Starting commit of software changes --- Updating provisioning rollback files ... rollback provisioning files updated Creating pending provisioning file Ensuring that cached content is written to media ... cached content flushed to media ... pending provisioning file created Committing provisioning file Ensuring that cached content is written to media ... cached content flushed to media ... running provisioning file committed Finished commit of software changes --- Starting analysis of software changes --- ------------ changes to running software ------------ 0 0 cc ----------------------------------------------------- Finished analysis of software changes --- Starting update running software --- Blocking peer synchronization of operating information ... peer synchronization blocked Creating the command set placeholder directory Finding latest command set ... latest command set identified Assembling CLI output libraries ... CLI output libraries assembled request platform software package install file CF-472 Cisco IOS Configuration Fundamentals Command Reference April 2010 Assembling CLI input libraries ... CLI input libraries assembled Applying interim IPC and database definitions interim IPC and database definitions applied Replacing running software ... running software replaced Replacing CLI software ... CLI software replaced Restarting software Restarting CC0 Restarting CC0 ... software restarted Applying interim IPC and database definitions *Oct 9 09:52:25.333: %MCP_OIR-6-OFFLINECARD: Card (cc) offline in slot 0 *Oct 9 09:52:25.334: %MCP_OIR-6-REMSPA: SPA removed from subslot 0/0, interfaces disabled *Oct 9 09:52:25.334: %MCP_OIR-6-REMSPA: SPA removed from subslot 0/1, interfaces disabled *Oct 9 09:52:25.334: %MCP_OIR-6-REMSPA: SPA removed from subslot 0/2, interfaces disabled *Oct 9 09:52:25.334: %MCP_OIR-6-REMSPA: SPA removed from subslot 0/3, interfaces disabled ... interim IPC and database definitions applied Notifying running software of updates ... running software notified Unblocking peer synchronization of operating information ... peer synchronization unblocked ... unmount of old packages scheduled Unmounting old packages ... inactive old packages unmounted Cleaning temporary installation files ... temporary installation files cleaned Finished update running software SUCCESS: Finished installing software. Router# Upgrading SIP Sub-package without using the verbose option In the following example, the SIP sub-package for the SIP in slot 1 is installed using the request platform software package install command. In this example, the force option, which forces the upgrade past any prompt (such as already having the same sub-package installed), is used. The verbose option is not used in this example. Router# request platform software package install rp 0 file bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg slot 1 force --- Starting installation state synchronization --- Finished installation state synchronization --- Starting file path checking --- Finished file path checking --- Starting image file verification --- Checking image file names Verifying image file locations Locating image files and validating name syntax Inspecting image file types Processing image file constraints Creating candidate provisioning file Finished image file verification request platform software package install file CF-473 Cisco IOS Configuration Fundamentals Command Reference April 2010 --- Starting candidate package set construction --- Verifying existing software set Processing candidate provisioning file Constructing working set for candidate package set Constructing working set for running package set Checking command output Constructing merge of running and candidate packages Finished candidate package set construction --- Starting compatibility testing --- Determining whether candidate package set is compatible WARNING: WARNING: Candidate software combination not found in compatibility database WARNING: Determining whether installation is valid Software sets are identified as compatible Checking IPC compatibility with running software Checking candidate package set infrastructure compatibility Checking infrastructure compatibility with running software Finished compatibility testing --- Starting impact testing --- Checking operational impact of change Finished impact testing --- Starting commit of software changes --- Updating provisioning rollback files Creating pending provisioning file Committing provisioning file Finished commit of software changes --- Starting analysis of software changes --- Finished analysis of software changes --- Starting update running software --- Blocking peer synchronization of operating information Creating the command set placeholder directory Finding latest command set Assembling CLI output libraries Assembling CLI input libraries Applying interim IPC and database definitions interim IPC and database definitions applied Replacing running software Replacing CLI software Restarting software Restarting CC1 Restarting CC1 Applying interim IPC and database definitions *Oct 9 09:54:55.365: %MCP_OIR-6-OFFLINECARD: Card (cc) offline in slot 1 *Oct 9 09:54:55.365: %MCP_OIR-6-REMSPA: SPA removed from subslot 1/1, interfaces disabled *Oct 9 09:54:55.365: %MCP_OIR-6-REMSPA: SPA removed from subslot 1/2, interfaces disabled Notifying running software of updates Unblocking peer synchronization of operating information Unmounting old packages Cleaning temporary installation files Finished update running software SUCCESS: Finished installing software. request platform software package install file CF-474 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router# Upgrading IOS Sub-package In the following example, the request platform software package install command is used to upgrade an IOS sub-package. In this example, the force option, which forces the upgrade past any prompt (such as already having the same module installed), is used. Router# request platform software package install rp 0 file bootflash:asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle_20071204_051318.pk g force --- Starting installation state synchronization --- Finished installation state synchronization --- Starting file path checking --- Finished file path checking --- Starting image file verification --- Checking image file names Verifying image file locations Locating image files and validating name syntax Inspecting image file types WARNING: In-service installation of IOSD package WARNING: requires software redundancy on target RP WARNING: or on-reboot parameter WARNING: Automatically setting the on-reboot flag Processing image file constraints Creating candidate provisioning file Finished image file verification --- Starting candidate package set construction --- Verifying existing software set Processing candidate provisioning file Constructing working set for candidate package set Constructing working set for running package set Checking command output Constructing merge of running and candidate packages Finished candidate package set construction --- Starting compatibility testing --- Determining whether candidate package set is compatible WARNING: WARNING: Candidate software combination not found in compatibility database WARNING: Determining whether installation is valid Determining whether installation is valid ... skipped Checking IPC compatibility with running software Checking IPC compatibility with running software ... skipped Checking candidate package set infrastructure compatibility Checking infrastructure compatibility with running software Checking infrastructure compatibility with running software ... skipped Finished compatibility testing --- Starting commit of software changes --- Updating provisioning rollback files Creating pending provisioning file Committing provisioning file request platform software package install file CF-475 Cisco IOS Configuration Fundamentals Command Reference April 2010 Finished commit of software changes SUCCESS: Software provisioned. New software will load on reboot. Router# Note that the new RPIOS sub-package will become active only after a reboot. Reboot the router to finish this procedure. Upgrading SPA Sub-package In the following example, the request platform software package install command is use to upgrade a SIPSPA sub-package for the SPA in bay 0 of router slot 1. In this example, the force option, which forces the upgrade past any prompt (such as already having the same module installed), is used. Router# request platform software package install rp 0 file bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg slot 1 bay 0 force --- Starting installation state synchronization --- Finished installation state synchronization --- Starting file path checking --- Finished file path checking --- Starting image file verification --- Checking image file names Verifying image file locations Locating image files and validating name syntax Inspecting image file types Processing image file constraints Creating candidate provisioning file Finished image file verification --- Starting candidate package set construction --- Verifying existing software set Processing candidate provisioning file Constructing working set for candidate package set Constructing working set for running package set Checking command output Constructing merge of running and candidate packages Finished candidate package set construction --- Starting compatibility testing --- Determining whether candidate package set is compatible WARNING: WARNING: Candidate software combination not found in compatibility database WARNING: Determining whether installation is valid Software sets are identified as compatible Checking IPC compatibility with running software Checking candidate package set infrastructure compatibility Checking infrastructure compatibility with running software Finished compatibility testing --- Starting impact testing --- Checking operational impact of change Finished impact testing request platform software package install file CF-476 Cisco IOS Configuration Fundamentals Command Reference April 2010 --- Starting commit of software changes --- Updating provisioning rollback files Creating pending provisioning file Committing provisioning file Finished commit of software changes --- Starting analysis of software changes --- Finished analysis of software changes --- Starting update running software --- Blocking peer synchronization of operating information Creating the command set placeholder directory Finding latest command set Assembling CLI output libraries Assembling CLI input libraries Applying interim IPC and database definitions interim IPC and database definitions applied Replacing running software Replacing CLI software Restarting software Restarting SPA CC1/0 Applying interim IPC and database definitions Notifying running software of updates Unblocking peer synchronization of operating information Unmounting old packages Cleaning temporary installation files Finished update running software SUCCESS: Finished installing software. Router# Related Commands Command Description request platform software package install commit Cancel the rollback timer and commits a software upgrade. request platform software package install rollback Rolls back a previous software upgrade. request platform software package install snapshot Creates a snapshot directory that will contain all the files extracted from a consolidated package. request platform software package install rollback CF-477 Cisco IOS Configuration Fundamentals Command Reference April 2010 request platform software package install rollback To roll back a previous software upgrade, use the request platform software package install rollback command in privileged EXEC or diagnostic mode. request platform software package install rp rp-slot-number rollback [as-booted | provisioning-file provisioning-file-URL] [force] [on-reboot] [verbose] Syntax Description Command Default No default behavior or values Command Modes Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines This command rolls back a configuration that has an active rollback timer. Active rollback timers are used when the auto-rollback option is entered when software is being upgraded using the request platform software package install file command. Examples In the following example, an upgrade that was using a rollback timer is rolled back to the previous configuration instead of upgraded: request platform software package install rp 0 rollback rp rp-slot-number Specifies the slot number of the RP doing the request. as-booted Specifies that the software update will not occur, and that the router will instead boot using the same procedure that it used during the last bootup. provisioning-file provisioning-file-URL Specifies that the software update will not occur, and that the router will instead boot using the specified provisioning file. force Specifies that the operation will be forced, meaning that the upgrade will proceed despite any warning messages. on-reboot Specifies that the installation will not be completed until the next RP reboot. verbose Displays verbose information, meaning all output that can be displayed on the console during the process will be displayed. Release Modification Cisco IOS XE Release 2.1 This command was introduced. request platform software package install rollback CF-478 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description request platform software package install commit Cancel the rollback timer and commits a software upgrade. request platform software package install file Upgrades a consolidated package or an individual sub-package. request platform software package install snapshot CF-479 Cisco IOS Configuration Fundamentals Command Reference April 2010 request platform software package install snapshot To create a snapshot directory that contains all the files extracted from a consolidated package, use the request platform software package install snapshot command in privileged EXEC or diagnostic mode. request platform software package install rp rp-slot-number snapshot to URL [as snapshot-provisioning-filename] [force] [verbose] [wipe] Syntax Description Command Default No default behavior or values Command Modes Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines This command is used to create a directory at the destination device and extract the individual sub-packages in a consolidated package to that directory. The request platform software package expand command is the only other command that can be used to extract individual sub-packages from a consolidated package. rp rp-slot-number Specifies the slot number. snapshot to URL Creates a directory and extracts all files from the consolidated package into that directory. The directory is named in the command-line as part of the URL_FS. If the URL_FS is specified as a file system, the files in the consolidated package will be extracted onto the file system and not a directory on the file system. as snapshot-provisionin g-filename (Optional) Renames the provisioning file in the snapshot directory. If this option is not used, the existing provisioning filename of the provisioning file in the consolidated package is used as the provisioning filename. wipe (Optional) Erases all content on the destination snapshot directory before extracting the files and placing them on the snapshot directory. force (Optional) Specifies that the operation will be forced, meaning that the upgrade will proceed despite any warning messages. verbose (Optional) Displays verbose information, meaning all output that can be displayed on the console during the process will be displayed. Release Modification Cisco IOS XE Release 2.1 This command was introduced. request platform software package install snapshot CF-480 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, a snapshot directory named snapdir1_snap is created in the bootflash: file system, and the individual sub-package files from the consolidated package are extracted into the snapshot directory. The second portion of the example first sets up the router to reboot using the files in the snapshot directory (deletes all previous boot system commands, configures the configuration register, then enters a boot system command to boot using the extracted provisioning file), saves the new configuration, then reboots so the router will boot using the extracted provisioning file, which allows the router to run using the extracted individual sub-package files. Router(diag)# request platform software package install rp 0 snapshot to bootflash:snapdir1_snap --- Starting active image file snapshot --- Validating snapshot parameters Creating destination directory Copying files to destination media Copied provisioning file as packages.conf Copying package file asr1000rp1-rpbase.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Copying package file asr1000rp1-rpcontrol.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Copying package file asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Copying package file asr1000rp1-rpaccess-k9.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Copying package file asr1000rp1-sipbase.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Copying package file asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Copying package file asr1000rp1-espbase.v122_33_xn_asr_rls0_throttle_20071204_051318.pkg Moving files into final location Finished active image file snapshot Router(config)# no boot system Router(config)# config-register 0x1 Router(config)# boot system harddisk:snapdir1_snap/packages.conf Router(config)# exit *May 11 01:31:04.815: %SYS-5-CONFIG_I: Configured from console by con Router# write mem Building configuration... [OK] Router# reload Related Commands Command Description request platform software package install file Upgrades a consolidated package or an indivual sub-package. request platform software process release CF-481 Cisco IOS Configuration Fundamentals Command Reference April 2010 request platform software process release To restart processes that have been placed in the hold down state by the Process Manager on the Cisco ASR 1000 Series Routers, use the request platform software process release command in privileged EXEC or diagnostic mode. request platform software process release slot all Syntax Description Command Default No default behavior or values Command Modes Privileged EXEC (#) Diagnostic Mode (diag) Command History Usage Guidelines This command is used to restart processes in the holddown state. If a process is in the holddown state, a console message is generated to notify the user that the process is helddown. Before placing any process in the holddown state, the Process Manager makes up to 5 attempts over 120 seconds to enable the process. These attempts to enable the process also happen automatically at startup. If the Process Manager is unable to enable the process after these attempts, the process will then be placed in the holddown state. slot Specifies the hardware slot. Options include: • number—The number of the SIP slot of the hardware module where the trace level is being set. For instance, if you wanted to specify the SIP in SIP slot 2 of the router, enter 2 as the number. • f0—The ESP in ESP slot 0. • f1—The ESP in ESP slot 1 • fp active—The active ESP. • fp standby—The standby ESP. • r0—The RP in RP slot 0. • r1—The RP in RP slot 1. • rp active—The active RP. • rp standby—The standby RP. all Specifies that all processes currently in the holddown state within the selected slot will be restarted. Release Modification Cisco IOS XE Release 2.1 This command was introduced. request platform software process release CF-482 Cisco IOS Configuration Fundamentals Command Reference April 2010 When this command is entered, it only attempts to restart processes currently in the holddown state. Active processes will not be affected by entering this command. Examples In the following example, this command is entered to restart any process currently on RP 0 in the holddown state: request platform software process release r0 all request platform software system shell CF-483 Cisco IOS Configuration Fundamentals Command Reference April 2010 request platform software system shell To request platform shell access, use the request platform software system shell command in privileged EXEC mode. request platform software system shell [rp | esp | sip] Syntax Description Command Modes Privileged EXEC (#) Command History Usage Guidelines The platform shell command needs to be entered before before using the request platform software system shell command. Providing shell access would not be necessary. However, there might be some cases where the command may not be available, or the IOS process hangs, or IOS console may not be available. In such cases, you can login to the shell and see the status of the system. The shell should be accessed under Cisco supervision, and no support is provided if accessed without supervision. The following message is displayed , before the shell access is granted: "Activity within this shell can jeopardize the functioning of the system. Use this functionality only under supervision of Cisco Support." Examples In the following example, a request to theplatform shell is made Router(config)# platform shell Router(config)# exit Router# request platform software shell system Activity within this shell can jeopardize the functioning of the system. Are you sure you want to continue? [y/n] y ********************************************************************** Activity within this shell can jeopardize the functioning of the system. Use this functionality only under supervision of Cisco Support. Related Commands rp Specifies the Route Processor (RP); it can be either active or standby. esp Specifies the Embedded Services Processor (ESP) control processor; it can be either active or standby. sip Specifies the SPA Interface Processor (SIP). Release Modification 12.2(33)XNC This command was introduced. Command Description platform shell Grants shell and enters shell access grant configuration mode. request platform software shell session output format CF-484 Cisco IOS Configuration Fundamentals Command Reference April 2010 request platform software shell session output format To modify the format of the output of some show commands on the Cisco ASR1000 Series Routers, use the request platform software shell session output format command in privileged EXEC and diagnostic mode. request platform software shell session output format format Syntax Description Command Default All show command output is seen in plaintext (the text format) by default. Command Modes Privileged EXEC (#) Diagnostic Mode (diag) Command History Usage Guidelines Entering this command can only change the output of some show commands that are available in both privileged EXEC and diagnostic mode. At the current time, most of these commands are show platform software and show platform hardware commands. Only a small subset of commands currently produce output using the html option. Examples In the following example, the request platform software shell session output format command is used to change the show output format from text to raw. The output of the show platform hardware slot r0 alarms visual command is shown both before and after the request platform software shell session output format command was entered to illustrate the change in output format. Router# show platform hardware slot r0 alarms visual Current Visual Alarm States Critical: On Major : On Minor : Off Router# request platform software shell session output format raw Router# show platform hardware slot r0 alarms visual message@alarms_msg: { format Specifies the output format for show command output. Options include: • html—Specifies Hypertext Markup Language (HTML) output. • raw—Specifies the raw message output. • text—Specifies plaintext output, which is the default. • xml—Specifies Extensible Markup Language (XML) output Release Modification IOS XE Release 2.1 This command was introduced request platform software shell session output format CF-485 Cisco IOS Configuration Fundamentals Command Reference April 2010 tdl_cman_alarms_data@tdl_cman_alarms_data: { critical@tdl_boolean:TDL_TRUE major@tdl_boolean:TDL_TRUE minor@tdl_boolean:TDL_FALSE } } message@ui_req_msg: { ui_req@ui_req: { request_id@U64:2 client@ui_client: { location@svc_loc: { fru@b_fru:BINOS_FRU_RP slotnum@I16:0 baynum@I16:0 } client_type@ui_client_type:UICLIENT_INVALID term_type@ui_terminal_type:UITT_INVALID ttynum@U32:0 tty_name@NS: user_name@NS: } command@NS: request_name@NS: flags@ui_req_flag: } } In the following example, the request platform software shell session output format command is used to change the show output format from text to xml. The output of the show platform hardware slot r0 alarms visual command is shown both before and after the request platform software shell session output format command was entered to illustrate the change in output format. Router# show platform hardware slot r0 alarms visual Current Visual Alarm States Critical: On Major : On Minor : Off Router# request platform software shell session output format xml Router# show platform hardware slot r0 alarms visual 4 0 0 0 request platform software shell session output format CF-486 Cisco IOS Configuration Fundamentals Command Reference April 2010 request platform software vty attach CF-487 Cisco IOS Configuration Fundamentals Command Reference April 2010 request platform software vty attach To enter EXEC mode on a router after persistent SSH or persistent Telnet is configured to connect to the router in diagnostic mode, use the request platform software vty attach command in diagnostic mode. request platform software vty attach [permanent] Syntax Description Command Default No default behavior or values Command Modes Diagnostic (diag) Command History Usage Guidelines If persistent Telnet or persistent SSH is configured to make users wait for an IOS vty line before allowing them to access the IOS CLI, this command can be used to attach to an IOS vty line and place the user in EXEC mode. Exiting EXEC mode returns the user to diagnostic mode unless the permanent keyword is entered. When the permanent keyword is entered, exiting EXEC mode exits the router. The vty lines must be configured to allow local login for this command to work. The vty lines must also be configured to accept the type of transport traffic (SSH or Telnet) being used to connect to the router for the session in which the request platform software vty attach command is entered. Examples In the following example, this command is used to leave diagnostic mode and enter privileged EXEC mode: Router(diag)# request platform software vty attach Router# In the following example, this command is used to leave diagnostic mode and enter privileged EXEC mode. The user then re-enters diagnostic mode by exiting privileged EXEC mode: Router(diag)# request platform software vty attach Router# exit Router(diag)# In the following example, this command is used with the permanent option to leave diagnostic mode and enter privileged EXEC mode. The user then exits the router by exiting privileged EXEC mode: Router(diag)# request platform software vty attach permanent Router# exit Connection to Router closed. permanent (Optional) Specifies that the router should not return to diagnostic mode if EXEC mode is exited. Release Modification Cisco IOS XE Release 2.1 This command was introduced. revision CF-488 Cisco IOS Configuration Fundamentals Command Reference April 2010 revision To set the revision number for the Multiple Spanning Tree (802.1s) (MST) configuration, use the revision command in MST configuration submode. To return to the default settings, use the no form of this command. revision version no revision Syntax Description Defaults version is 0. Command Modes MST configuration submode Command History Usage Guidelines Two Cisco 7600 series routers that have the same configuration but different revision numbers are considered to be part of two different regions. Caution Be careful when using the revision command to set the revision number of the MST configuration because a mistake can put the switch in a different region. Examples This example shows how to set the revision number of the MST configuration: Router(config-mst)# revision 5 Router(config-mst)# Related Commands version Revision number for the configuration; valid values are from 0 to 65535. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. revision CF-489 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Description instance Maps a VLAN or a set of VLANs to an MST instance. name (MST configuration submode) Sets the name of an MST region. show Verifies the MST configuration. show spanning-tree Displays information about the spanning-tree state. spanning-tree mst configuration Enters MST-configuration submode. rmdir CF-490 Cisco IOS Configuration Fundamentals Command Reference April 2010 rmdir To remove an existing directory in a Class C Flash file system, use the rmdir command in EXEC, privileged EXEC, or diagnostic mode. rmdir directory Syntax Description Command Modes User EXEC Privileged EXEC Diagnostic Command History Usage Guidelines This command is valid only on Class C Flash file systems. Caution You can use the rmdir command to remove a directory that another user is currently accessing in read-only mode, for example if it is that user’s default working directory. If you use the rmdir command to remove such a directory and a user whose current directory is set to the deleted directory then uses the pwd command to display the current working directory, the following error message is displayed: Cannot determine current directory. Examples The following example deletes the directory named newdir: Router# dir Directory of flash: 2 drwx 0 Mar 13 1993 13:16:21 newdir 8128000 bytes total (8126976 bytes free) Router# rmdir newdir Rmdir file name [newdir]? Delete flash:newdir? [confirm] Removed dir flash:newdir Router# dir Directory of flash: No files in directory 8128000 bytes total (8126976 bytes free) directory Directory to delete. Release Modification 11.3 AA This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR1000 Series Router and was made available in diagnostic mode. rmdir CF-491 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description dir Displays a list of files on a file system. mkdir Creates a new directory in a Class C Flash file system. rommon-pref CF-492 Cisco IOS Configuration Fundamentals Command Reference April 2010 rommon-pref To select a ReadOnly or Upgrade ROMmon image to be booted on the next reload of a Cisco 7200 VXR router or Cisco 7301 router when you are in ROMmon, use the rommon-pref command in ROM monitor mode. rommon-pref [readonly | upgrade] Syntax Description Defaults No default behavior or values Command Modes ROM monitor mode Command History Usage Guidelines You might select the ReadOnly ROMmon image to be booted on the next reload because the Upgrade image has features or side effects you do not like. When you are in ROMmon, there is no descriptive output to inform you whether the ReadOnly ROMmon image was reloaded. To confirm the reload, use the showmon command after entering the rommon-pref readonly command. Use this command when you are in ROMmon mode. Use the upgrade rom-monitor preference command when you are in Cisco IOS. Examples The following example, applicable to both the Cisco 7200 VXR and Cisco 7301 routers, shows how to select the ReadOnly ROMmon image to be booted on the next reload of the router when you are already in ROMmon mode: rommon 2 > rommon-pref readonly readonly Selects the ReadOnly ROMmon image to be booted on the next reload. upgrade Selects the Upgrade, second ROMmon image to be booted on the next reload. Release Modification 12.0(28)S This command was introduced on the Cisco 7200 VXR router. It was introduced in ROMmon version 12.3(4r)T1 for the Cisco 7200 VXR router. 12.3(8)T This command was integrated into Cisco IOS Release 12.3(8)T and supported on the Cisco 7200 VXR router and Cisco 7301 router. It was introduced in ROMmon version 12.3(4r)T2 for the Cisco 7301 router. 12.3(9) This command was integrated into Cisco IOS Release 12.3(9) and supported on the Cisco 7200 VXR router and Cisco 7301 router. rommon-pref CF-493 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description showmon Shows both the ReadOnly and the Upgrade ROMmon image versions when you are in ROMmon mode, as well as which ROMmon image is running. route-converge-interval CF-494 Cisco IOS Configuration Fundamentals Command Reference April 2010 route-converge-interval To configure the time interval after which the old FIB entries are purged, use the route-converge-interval command in main CPU submode. To return to the default settings, use the no form of this command. route-converge-interval seconds no route-converge-interval Syntax Description Defaults seconds is 120 seconds (2 minutes). Command Modes Main CPU submode Command History Usage Guidelines SRM/SSO is supported in the following releases only. • Release 12.2(17b)SXA and later rebuilds of Release 12.2(17b)SXA • Release 12.2(17d)SXB and later rebuilds of Release 12.2(17d)SXB This command is not supported in Cisco 7600 series routers that are configured with a Supervisor Engine 2. The time interval for route-converge delay is needed to simulate the route-converge time when routing protocols restart on switchover. Examples This example shows how to set the time interval for the route-converge delay: Router(config)# redundancy Router(config-red)# main-cpu Router(config-red-main)# route-converge-interval 90 Router(config-red-main)# This example shows how to return to the default time interval for the route-converge delay: Router(config)# redundancy Router(config-red)# main-cpu Router(config-red-main)# no route-converge-interval Router(config-red-main)# seconds Time interval, in seconds, after which the old FIB entries are purged; valid values are from 60 to 3600 seconds. Release Modification 12.2(17b)SXA Support for this command was introduced on the Supervisor Engine 720. 12.2(18)SXD This command is supported on releases prior to Release 12.2(18)SXD. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. route-converge-interval CF-495 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description redundancy Enters redundancy configuration mode. rsh CF-496 Cisco IOS Configuration Fundamentals Command Reference April 2010 rsh To execute a command remotely on a remote shell protocol (rsh) host, use the rsh command in privileged EXEC mode. rsh {ip-address | host} [/user username] remote-command Syntax Description Defaults If you do not specify the /user username keyword and argument, the Cisco IOS software sends a default remote username. As the default value of the remote username, the software sends the username associated with the current tty process, if that name is valid. For example, if the user is connected to the router through Telnet and the user was authenticated through the username command, then the software sends that username as the remote username. If the tty username is invalid, the software uses the host name as the both the remote and local usernames. Note For Cisco, tty lines are commonly used for access services. The concept of tty originated with UNIX. For UNIX systems, each physical device is represented in the file system. Terminals are sometimes called tty devices (tty stands for teletype, the original UNIX terminal). Command Modes Privileged EXEC Command History Usage Guidelines Use the rsh command to execute commands remotely. The host on which you remotely execute the command must support the rsh protocol, and the .rhosts files on the rsh host must include an entry that permits you to remotely execute commands on that host. For security reasons, the software does not default to a remote login if no command is specified, as does UNIX. Instead, the router provides Telnet and connect services that you can use rather than rsh. ip-address IP address of the remote host on which to execute the rsh command. Either the IP address or the host name is required. host Name of the remote host on which to execute the command. Either the host name or the IP address is required. /user username (Optional) Remote username. remote-command Command to be executed remotely. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. rsh CF-497 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following command specifies that the user named sharon attempts to remotely execute the UNIX ls command with the -a argument on the remote host named mysys.cisco.com. The command output resulting from the remote execution follows the command example: Router1# rsh mysys.cisco.com /user sharon ls -a . . . .alias .cshrc .emacs .exrc .history .login .mailrc .newsrc .oldnewsrc .rhosts .twmrc .xsession jazz scheduler allocate CF-498 Cisco IOS Configuration Fundamentals Command Reference April 2010 scheduler allocate To guarantee CPU time for processes, use the scheduler allocate command in global configuration mode. To restore the default, use the no form of this command. scheduler allocate interrupt-time process-time no scheduler allocate Syntax Description Defaults Approximately 5 percent of the CPU is available for process tasks. Command Modes Global configuration Command History Usage Guidelines This command applies to the Catalyst 6500 series switches, Cisco 7200 series, Cisco 7500 series, and Cisco 7600 series routers. Caution We recommend that you do not change the default settings. Changing settings associated with CPU processes can negatively impact system performance. Entering the scheduler allocate command without arguments is the same as entering the no scheduler allocate or the default scheduler allocate command. interrupt-time Integer (in microseconds) that limits the maximum number of microseconds to spend on fast switching within any one network interrupt context. The range is from 400 to 60000 microseconds. The default is 4000 microseconds. process-time Integer (in microseconds) that guarantees the minimum number of microseconds to spend at the process level when network interrupts are disabled. The range is from 100 to 4000 microseconds.The default is 200 microseconds. The default for Catalyst 6500 series switches and Cisco 7600 series routers is 800 microseconds. Release Modification 11.2 This command was introduced. 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17a)SX This command was changed as follows: • The process-time default setting was changed from 200 microseconds to 800 microseconds. • The no scheduler allocate action was changed to return to the default settings. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to the 12.2(17d)SXB release. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. scheduler allocate CF-499 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example makes 20 percent of the CPU available for process tasks: Router(config)# scheduler allocate 2000 500 Related Commands Command Description scheduler interval Controls the maximum amount of time that can elapse without running system processes. scheduler heapcheck process CF-500 Cisco IOS Configuration Fundamentals Command Reference April 2010 scheduler heapcheck process To perform a “sanity check” for corruption in memory blocks when a process switch occurs, use the scheduler heapcheck process command in global configuration mode. To disable this feature, use the no form of this command. scheduler heapcheck process [memory [fast] [io] [multibus] [pci] [processor] [checktype {all | magic | pointer | refcount | lite-chunks}]] no scheduler heapcheck process Syntax Description Defaults This command is disabled by default. If no keywords are specified, a sanity check will be performed on all the memory blocks and memory pools. Command Modes Global configuration Command History Usage Guidelines When configuring this command, you can choose none or all memory block keywords (fast, io, multibus, pci, processor, and checktype). Enabling this command has a significant impact on router performance. memory (Optional) Specifies checking all memory blocks and memory pools. fast (Optional) Specifies checking the fast memory block. io (Optional) Specifies checking the I/O memory block. multibus (Optional) Specifies checking the multibus memory block. pci (Optional) Specifies checking the process control information (PCI) memory block. processor (Optional) Specifies checking the processor memory block. checktype (Optional) Specifies checking specific memory pools. all (Optional) Specifies checking the value of the block magic, red zone, size, refcount, and pointers (next and previous). magic (Optional) Specifies checking the value of the block magic, red zone, and size. pointer (Optional) Specifies checking the value of the next and previous pointers. refcount (Optional) Specifies checking the value of the block magic and refcount. lite-chunks (Optional) Specifies checking the memory blocks allocated by the memory allocation lite (malloc_lite) feature. Release Modification 12.2(15)T This command was introduced. 12.3(11)T The lite-chunks keyword was added. scheduler heapcheck process CF-501 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example shows how to sanity check for corruption in the I/O memory block when a process switch occurs. In this example, the values of only the block magic, red zone, and size will be checked. scheduler heapcheck process memory io checktype magic The following example shows how to sanity check for corruption in the processor memory block when a process switch occurs. In this example, the values of only the next and previous pointers will be checked. scheduler heapcheck process memory processor checktype pointer Related Commands Command Description memory lite Enables the malloc_lite feature. memory sanity Performs a “sanity check” for corruption in buffers and queues. scheduler interrupt mask profile CF-502 Cisco IOS Configuration Fundamentals Command Reference April 2010 scheduler interrupt mask profile To start interrupt mask profiling for all processes running on the system, use the scheduler interrupt mask profile command in global configuration mode. To stop interrupt mask profiling, use the no form of this command. scheduler interrupt mask profile no scheduler interrupt mask profile Syntax Description This command has no arguments or keywords. Defaults Interrupt mask profiling is disabled by default. Command Modes Global configuration Command History Usage Guidelines This command enables the collection of details regarding the total amount of time a process has masked interrupts since the interrupt mask profiler was enabled. Examples The following example shows how to enable interrupt mask profiling: Router(config)# scheduler interrupt mask profile Related Commands Release Modification 12.4(2)T This command was introduced. Command Description clear processes interrupt mask detail Clears the interrupt masked details for all processes and stack traces that have been dumped into the interrupt mask buffer. scheduler interrupt mask size Configures the maximum number of entries that can exist in the interrupt mask buffer. scheduler interrupt mask time Configures the maximum allowed time that a process can run with interrupts masked. show process interrupt mask buffer Displays the information stored in the interrupt mask buffer. show processes interrupt mask detail Displays interrupt masked details for the specified process or all processes in the system. scheduler interrupt mask size CF-503 Cisco IOS Configuration Fundamentals Command Reference April 2010 scheduler interrupt mask size To configure the maximum number of entries that can exist in the interrupt mask buffer, use the scheduler interrupt mask size command in global configuration mode. To reset the maximum number of entries that can exist in the interrupt mask buffer to the default, use the no form of this command. scheduler interrupt mask size buffersize no scheduler interrupt mask size Syntax Description Defaults The default buffer size is 50 entries. Command Modes Global configuration Command History Examples The following example shows how to configure 100 entries the maximum number of entries that can exist in the interrupt mask buffer: Router(config)# scheduler interrupt mask size 100 Related Commands buffersize Specifies the number of entries that can exist in the interrupt mask buffer. Release Modification 12.4(2)T This command was introduced. Command Description clear processes interrupt mask detail Clears the interrupt masked details for all processes and stack traces that have been dumped into the interrupt mask buffer. scheduler interrupt mask profile Enables or disables interrupt mask profiling for all processes running on the system. scheduler interrupt mask time Configures the maximum amount of time a process can run with interrupts masked. show processes interrupt mask buffer Displays interrupt masked details for the specified process or all processes in the system and displays information stored in the interrupt mask buffer. show processes interrupt mask detail Displays interrupt masked details for the specified or all processes in the system. scheduler interrupt mask time CF-504 Cisco IOS Configuration Fundamentals Command Reference April 2010 scheduler interrupt mask time To configure the maximum time that a process can run with interrupts masked before another entry is created in the interrupt mask buffer, use the scheduler interrupt mask time command in global configuration mode. To reset the threshold time to the default, use the no form of this command. scheduler interrupt mask time threshold-time no scheduler interrupt mask time Syntax Description Defaults The default threshold time value is 50 microseconds. Command Modes Global configuration Command History Examples The following shows how to configure 100 microseconds as the maximum time a process can run with interrupts masked before another entry is created in the interrupt mask buffer: Router(config)# scheduler interrupt mask time 100 Related Commands threshold-time Specifies the maximum amount of timein microseconds a process can be in interrupt masked state without creating an entry in the interrupt mask buffer. Release Modification 12.4(2)T This command was introduced. Command Description clear processes interrupt mask detail Clears the interrupt masked details for all processes and stack traces that have been dumped into the interrupt mask buffer. scheduler interrupt mask profile Enables or disables interrupt mask profiling for all processes running on the system. scheduler interrupt mask size Configures the maximum number of entries that can exist in the interrupt mask buffer. show processes interrupt mask buffer Displays the information stored in the interrupt mask buffer. show processes interrupt mask detail Displays interrupt masked details for the specified process or all processes in the system. scheduler interval CF-505 Cisco IOS Configuration Fundamentals Command Reference April 2010 scheduler interval To control the maximum amount of time that can elapse without running system processes, use the scheduler interval command in global configuration mode. To restore the default, use the no form of this command. scheduler interval milliseconds no scheduler interval Syntax Description Defaults High-priority operations are allowed to use as much of the CPU as needed. Command Modes Global configuration Command History Usage Guidelines The normal operation of the network server allows the switching operations to use as much of the central processor as is required. If the network is running unusually heavy loads that do not allow the processor the time to handle the routing protocols, give priority to the system process scheduler. High-priority operations are allowed to use as much of the CPU as needed. Note Changing settings associated with CPU processes can negatively impact system performance. On the Cisco 7200 series and Cisco 7500 series, use the scheduler allocate global configuration command instead of the scheduler interval command. Examples The following example changes the low-priority process schedule to an interval of 750 milliseconds: Router(config)# scheduler interval 750 Related Commands milliseconds Integer that specifies the interval (in milliseconds). The minimum interval that you can specify is 500 milliseconds; there is no maximum value. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description scheduler allocate Guarantees CPU time for processes. send CF-506 Cisco IOS Configuration Fundamentals Command Reference April 2010 send To send messages to one or all terminal lines, use the send command in EXEC mode. send {line-number | * | aux number | console number | tty number | vty number} Syntax Description Defaults No messages are sent. Command Modes User EXEC Priviledged EXEC Command History Usage Guidelines After entering this command, the system prompts for the message to be sent, which can be up to 500 characters long. Enter Ctrl-Z to end the message. Enter Ctrl-C to abort this command. Caution Be aware that in some circumstances text sent using the send command may be interpreted as an executable command by the receiving device. For example, if the receiving device is Unix workstation, and the receiving device is in a state (shell) where commands can be executed, the incoming text, if a properly formated Unix command, will be accepted by the workstation as a command. For this reason, you should limit your exposure to potential messages from terminal servers or other Cisco IOS-based devices when running an interactive shell. Examples The following example sends a message to all lines: 2509# send * Enter message, end with CTRL/Z; abort with CTRL/C: The system 2509 will be shut down in 10 minutes for repairs.^Z Send message? [confirm] 2509# line-number Line number to which the message will be sent. * Sends a message to all lines. aux number Sends a message to the specified AUX port. console number Sends a message to the specified console port. tty number Sends a message to the specified asynchronous line. vty number Sends a message to the specified virtual asynchronous line. Release Modification 11.2 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. send CF-507 Cisco IOS Configuration Fundamentals Command Reference April 2010 *** *** *** Message from tty0 to all terminals: *** The system 2509 will be shut down in 10 minutes for repairs. service compress-config CF-508 Cisco IOS Configuration Fundamentals Command Reference April 2010 service compress-config To compress startup configuration files, use the service compress-config command in global configuration mode. To disable compression, use the no form of this command. service compress-config no service compress-config Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes Global configuration Command History Usage Guidelines After you configure the service compress-config command, the router will compress configuration files every time you save a configuration to the startup configuration. For example, when you enter the copy system:running-config nvram:startup-config command, the running configuration will be compressed before storage in NVRAM. If the file compression succeeds, the following message is displayed: Compressing configuration from configuration-size to compressed-size [OK] If the boot ROMs do not recognize a compressed configuration, the following message is displayed: Boot ROMs do not support NVRAM compression Config NOT written to NVRAM If the file compression fails, the following message is displayed: Error trying to compress nvram One way to determine whether a configuration file will be compressed enough to fit into NVRAM is to use a text editor to enter the configuration, then use the UNIX compress command to check the compressed size. To get a closer approximation of the compression ratio, use the UNIX compress -b12 command. Once the configuration file has been compressed, the router functions normally. At boot time, the system recognizes that the configuration file is compressed, uncompresses it, and proceeds normally. A partition nvram:startup-config command uncompresses the configuration before displaying it. To disable compression of the configuration file, enter configuration mode and specify the no service compress-config command. Then, exit global configuration mode and enter the copy system:running-config nvram:startup-config command. The router displays an OK message if it is Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. service compress-config CF-509 Cisco IOS Configuration Fundamentals Command Reference April 2010 able to write the uncompressed configuration to NVRAM. Otherwise, the router displays an error message indicating that the configuration is too large to store. If the configuration file is larger than the physical NVRAM, the following message is displayed: ##Configuration too large to fit uncompressed in NVRAM Truncate configuration? [confirm] When the file is truncated, commands at the end of the file are erased. Therefore, you will lose part of your configuration. To truncate and save the configuration, type Y. To not truncate and not save the configuration, type N. Examples In the following example, the configuration file is compressed: Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)# service compress-config Router(config)# end Router# %SYS-5-CONFIG_I: Configured from console by console Router# copy system:running-config nvram:startup-config Building configuration... Compressing configuration from 1179 bytes to 674 bytes [OK] Related Commands Command Description partition nvram:startup-config Separates Flash memory into partitions on Class B file system platforms. service config CF-510 Cisco IOS Configuration Fundamentals Command Reference April 2010 service config To enable autoloading of configuration files from a network server, use the service config command in global configuration mode. To restore the default, use the no form of this command. service config no service config Syntax Description This command has no arguments or keywords. Defaults Disabled, except on systems without NVRAM or with invalid or incomplete information in NVRAM. In these cases, autoloading of configuration files from a network server is enabled automatically. Command Modes Global configuration Command History Usage Guidelines Usually, the service config command is used in conjunction with the boot host or boot network command. You must enter the service config command to enable the router to automatically configure the system from the file specified by the boot host or boot network command. With IOS software versions 12.3(2)T , 12.3(1)B, and later, you no longer have to specify the service config command for the boot host or boot network command to be active. If you specify both the no service config command and the boot host command, the router attempts to find the specified host configuration file. The service config command can also be used without the boot host or boot network command. If you do not specify host or network configuration filenames, the router uses the default configuration files. The default network configuration file is network-confg. The default host configuration file is host-confg, where host is the hostname of the router. If the Cisco IOS software cannot resolve its hostname, the default host configuration file is router-confg. Examples In the following example, a router is configured to autoload the default network and host configuration files. Because no boot host or boot network commands are specified, the router uses the broadcast address to request the files from a TFTP server. Router(config)# service config Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. service config CF-511 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following example changes the network configuration filename to bridge_9.1, specifies that rcp is to be used as the transport mechanism, and gives 172.16.1.111 as the IP address of the server on which the network configuration file resides: Router(config)# service config Router(config)# boot network rcp://172.16.1.111/bridge_9.1 Related Commands Command Description boot host Changes the default name of the host configuration filename from which to load configuration commands. boot network Changes the default name of the network configuration file from which to load configuration commands. service counters max age CF-512 Cisco IOS Configuration Fundamentals Command Reference April 2010 service counters max age To set the time interval for retrieving statistics, use the service counters max age command in global configuration mode. To return to the default settings, use the no form of this command. service counters max age seconds no service counters max age Syntax Description Defaults seconds is 5 seconds. Command Modes Global configuration Command History Usage Guidelines A fully loaded Catalyst 6500 series switch chassis running Cisco IOS software version 12.2(18)SXF or its minor variants (SXF through SXF5) takes 1-2 minutes to update the SNMP counters maintained under ifTable and ifXTable. Polling the ifTable/ifXTable is done with the need to understand how much traffic is being handled by a specific port/interface. The typical polling interval to meet this need is 3-5 minutes. No gain is achived by reducing the polling interval to intervals lesser than 3 minutes. Note If you decrease the time interval for retrieving statistics from the default setting (5 seconds), traffic congestion may result in situations where frequent SNMP (SMNP bulk) retrievals occur. Examples This example shows how to set the time interval for retrieving statistics: Router(config)# service counters max age 10 Router(config)# seconds Maximum age, in seconds, of the statistics retrieved from the CLI or SNMP; valid values are from 0 to 60 seconds. Release Modification 12.2(18)SXD Support for this command was introduced on the Supervisor Engine 720 and the Supervisor Engine 2. 12.2(18)SXF This command was changed as follows: • The default was changed from 10 seconds to 5 seconds. • The valid values for seconds was changed from 1 to 60 seconds to 0 to 60 seconds. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. service counters max age CF-513 Cisco IOS Configuration Fundamentals Command Reference April 2010 This example shows how to return to the default setting: Router(config)# no service counters max age Router(config)# service decimal-tty CF-514 Cisco IOS Configuration Fundamentals Command Reference April 2010 service decimal-tty To specify that line numbers be displayed and interpreted as octal numbers rather than decimal numbers, use the no service decimal-tty command in global configuration mode. To restore the default, use the service decimal-tty command. service decimal-tty no service decimal-tty Syntax Description This command has no arguments or keywords. Defaults Enabled (line numbers displayed as decimal numbers) Command Modes Global configuration Command History Examples In the following example, the router is configured to display decimal rather than octal line numbers: Router(config)# service decimal-tty Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. service exec-wait CF-515 Cisco IOS Configuration Fundamentals Command Reference April 2010 service exec-wait To delay the startup of the EXEC on noisy lines, use the service exec-wait command in global configuration mode. To disable the delay function, use the no form of this command. service exec-wait no service exec-wait Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes Global configuration Command History Usage Guidelines This command delays startup of the EXEC until the line has been idle (no traffic seen) for 3 seconds. The default is to enable the line immediately on modem activation. This command is useful on noisy modem lines or when a modem attached to the line is configured to ignore MNP/V.42 negotiations, and MNP/V.42 modems may be dialing in. In these cases, noise or MNP/V.42 packets may be interpreted as usernames and passwords, causing authentication failure before the user has a chance to type a username or password. The command is not useful on nonmodem lines or lines without some kind of login configured. Examples The following example delays the startup of the EXEC: Router(config)# service exec-wait Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. service finger CF-516 Cisco IOS Configuration Fundamentals Command Reference April 2010 service finger The service finger command has been replaced by the ip finger command. However, the service finger and no service finger commands continue to function to maintain backward compatibility with older versions of Cisco IOS software. Support for this command may be removed in a future release. See the description of the ip finger command for more information. service hide-telnet-address CF-517 Cisco IOS Configuration Fundamentals Command Reference April 2010 service hide-telnet-address To hide addresses while trying to establish a Telnet session, use the service hide-telnet-address command in global configuration mode. To disable this service, use the no form of this command. service hide-telnet-address no service hide-telnet-address Syntax Description This command has no arguments or keywords. Defaults Addresses are displayed. Command Modes Global configuration Command History Usage Guidelines When you attempt to connect to a device, the router displays addresses and other messages (for example, “Trying router1 (171.69.1.154, 2008)...).” With the hide feature, the router suppresses the display of the address (for example, “Trying router1 address #1...”). The router continues to display all other messages that would normally be displayed during a connection attempt, such as detailed error messages if the connection was not successful. The hide feature improves the functionality of the busy-message feature. When you configure only the busy-message command, the normal messages generated during a connection attempt are not displayed; only the busy-message is displayed. When you use the hide and busy features together you can customize the information displayed during Telnet connection attempts. When you configure the service hide-telnet-address command and the busy-message command, the router suppresses the address and displays the message specified with the busy-message command if the connection attempt is not successful. Examples The following example hides Telnet addresses: Router(config)# service hide-telnet-address Related Commands Release Modification 11.2 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description busy-message Creates a “host failed” message that is displayed when a connection fails. service linenumber CF-518 Cisco IOS Configuration Fundamentals Command Reference April 2010 service linenumber To configure the Cisco IOS software to display line number information after the EXEC or incoming banner, use the service linenumber command in global configuration mode. To disable this function, use the no form of this command. service linenumber no service linenumber Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes Global configuration Command History Usage Guidelines With the service linenumber command, you can have the Cisco IOS software display the host name, line number, and location each time an EXEC process is started, or an incoming connection is made. The line number banner appears immediately after the EXEC banner or incoming banner. This feature is useful for tracking problems with modems, because the host and line for the modem connection are listed. Modem type information can also be included. Examples In the following example, a user Telnets to Router2 before and after the service linenumber command is enabled. The second time, information about the line is displayed after the banner. Router1> telnet Router2 Trying Router2 (172.30.162.131)... Open Welcome to Router2. User Access Verification Password: Router2> enable Password: Router2# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router2(config)# service linenumber Router2(config)# end Router2# logout [Connection to Router2 closed by foreign host] Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. service linenumber CF-519 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router1> telnet Router2 Trying Router2 (172.30.162.131)... Open Welcome to Router2. Router2 line 10 User Access Verification Password: Router2> Related Commands Command Description show users Displays information about the active lines on the router. service nagle CF-520 Cisco IOS Configuration Fundamentals Command Reference April 2010 service nagle To enable the Nagle congestion control algorithm, use the service nagle command in global configuration mode. To disable the algorithm, use the no form of this command. service nagle no service nagle Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes Global configuration Command History Usage Guidelines When using a standard TCP implementation to send keystrokes between machines, TCP tends to send one packet for each keystroke typed. On larger networks, many small packets use up bandwidth and contribute to congestion. The algorithm developed by John Nagle (RFC 896) helps alleviate the small-packet problem in TCP. In general, it works this way: The first character typed after connection establishment is sent in a single packet, but TCP holds any additional characters typed until the receiver acknowledges the previous packet. Then the second, larger packet is sent, and additional typed characters are saved until the acknowledgment comes back. The effect is to accumulate characters into larger chunks, and pace them out to the network at a rate matching the round-trip time of the given connection. This method is usually effective for all TCP-based traffic. However, do not use the service nagle command if you have XRemote users on X Window system sessions. Examples The following example enables the Nagle algorithm: Router(config)# service nagle Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. service prompt config CF-521 Cisco IOS Configuration Fundamentals Command Reference April 2010 service prompt config To display the configuration prompt (config), use the service prompt config command in global configuration mode. To remove the configuration prompt, use the no form of this command. service prompt config no service prompt config Syntax Description This command has no arguments or keywords. Defaults The configuration prompts appear in all configuration modes. Command Modes Global configuration Command History Examples In the following example, the no service prompt config command prevents the configuration prompt from being displayed. The prompt is still displayed in EXEC mode. When the service prompt config command is entered, the configuration mode prompt reappears. Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)# no service prompt config hostname newname end newname# configure terminal Enter configuration commands, one per line. End with CNTL/Z. service prompt config newname(config)# hostname Router Router(config)# end Router# Related Commands Release Modification 11.1 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description hostname Specifies or modifies the host name for the network server. prompt Customizes the prompt. service sequence-numbers CF-522 Cisco IOS Configuration Fundamentals Command Reference April 2010 service sequence-numbers To enable visible sequence numbering of system logging messages, use the service sequence-numbers command in global configuration mode. To disable visible sequence numbering of logging messages, use the no form of this command. service sequence-numbers no service sequence-numbers Syntax Description This command has no arguments or keywords. Defaults Disabled. Command Modes Global configuration Command History Usage Guidelines Each system status messages logged in the system logging process have a sequence reference number applied. This command makes that number visible by displaying it with the message. The sequence number is displayed as the first part of the system status message. See the description of the logging commands for information on displaying logging messages. Examples In the following example logging message sequence numbers are enabled: .Mar 22 15:28:02 PST: %SYS-5-CONFIG_I: Configured from console by console Router# config terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)# service sequence-numbers Router(config)# end Router# 000066: .Mar 22 15:35:57 PST: %SYS-5-CONFIG_I: Configured from console by console Related Commands Release Modification 12.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description logging on Enables system logging globally. service timestamps Enables time-stamping of system logging messages or debugging messages. service slave-log CF-523 Cisco IOS Configuration Fundamentals Command Reference April 2010 service slave-log To allow slave Versatile Interface Processor (VIP) cards to log important error messages to the console, use the service slave-log command in global configuration mode. To disable slave logging, use the no form of this command. service slave-log no service slave-log Syntax Description This command has no arguments or keywords. Defaults This command is enabled by default. Command Modes Global configuration Command History Usage Guidelines This command allows slave slots to log error messages of level 2 or higher (critical, alerts, and emergencies). Examples In the following example, the router is configured to log important messages from the slave cards to the console: Router(config)# service slave-log The following is sample output generated when this command is enabled: %IPC-5-SLAVELOG: VIP-SLOT2: IPC-2-NOMEM: No memory available for IPC system initialization The first line indicates which slot sent the message. The second line contains the error message. Release Modification 11.1 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. service tcp-keepalives-in CF-524 Cisco IOS Configuration Fundamentals Command Reference April 2010 service tcp-keepalives-in To generate keepalive packets on idle incoming network connections (initiated by the remote host), use the service tcp-keepalives-in command in global configuration mode. To disable the keepalives, use the no form of this command. service tcp-keepalives-in no service tcp-keepalives-in Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes Global configuration Command History Examples In the following example, keepalives on incoming TCP connections are generated: Router(config)# service tcp-keepalives-in Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description service tcp-keepalives-out Generates keepalive packets on idle outgoing network connections (initiated by a user). service tcp-keepalives-out CF-525 Cisco IOS Configuration Fundamentals Command Reference April 2010 service tcp-keepalives-out To generate keepalive packets on idle outgoing network connections (initiated by a user), use the service tcp-keepalives-out command in global configuration mode. To disable the keepalives, use the no form of this command. service tcp-keepalives-out no service tcp-keepalives-out Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes Global configuration Command History Examples In the following example, keepalives on outgoing TCP connections are generated: Router(config)# service tcp-keepalives-out Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description service tcp-keepalives-in Generates keepalive packets on idle incoming network connections (initiated by the remote host). service tcp-small-servers CF-526 Cisco IOS Configuration Fundamentals Command Reference April 2010 service tcp-small-servers To access minor TCP/IP services available from hosts on the network, use the service tcp-small-servers command in global configuration mode. To disable these services, use the no form of the command. service tcp-small-servers no service tcp-small-servers Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes Global configuration Command History Usage Guidelines By default, the TCP servers for Echo, Discard, Chargen, and Daytime services are disabled. When the minor TCP/IP servers are disabled, access to the Echo, Discard, Chargen, and Daytime ports cause the Cisco IOS software to send a TCP RESET packet to the sender and discard the original incoming packet. Examples The following example enables minor TCP/ IP services available from the network: Router(config)# service tcp-small-servers Release Modification 11.1 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. service telnet-zero-idle CF-527 Cisco IOS Configuration Fundamentals Command Reference April 2010 service telnet-zero-idle To set the TCP window to zero (0) when the Telnet connection is idle, use the service telnet-zero-idle command in global configuration mode. To disable this service, use the no form of this command. service telnet-zero-idle no service telnet-zero-idle Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes Global configuration Command History Usage Guidelines Normally, data sent to noncurrent Telnet connections is accepted and discarded. When the service telnet-zero-idle command is enabled, if a session is suspended (that is, some other connection is made active or the EXEC is sitting in command mode), the TCP window is set to zero. This action prevents the remote host from sending any more data until the connection is resumed. Use this command when it is important that all messages sent by the host be seen by the users and the users are likely to use multiple sessions. Do not use this command if your host will eventually time out and log out a TCP user whose window is zero. Examples The following example sets the TCP window to zero when the Telnet connection is idle: Router(config)# service telnet-zero-idle Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description resume Switches to another open Telnet, rlogin, LAT, or PAD session. service timestamps CF-528 Cisco IOS Configuration Fundamentals Command Reference April 2010 service timestamps To configure the system to apply a time stamp to debugging messages or system logging messages, use the service timestamps command in global configuration mode. To disable this service, use the no form of this command. service timestamps [debug | log] [uptime | datetime [msec]] [localtime] [show-timezone] [year] no service timestamps [debug | log] Syntax Description debug (Optional) Indicates time-stamping for debugging messages. log (Optional) Indicates time-stamping for system logging messages. uptime (Optional) Specifies that the time stamp should consist of the time since the system was last rebooted. For example “4w6d” (time since last reboot is 4 weeks and 6 days). • This is the default time-stamp format for both debugging messages and logging messages. • The format for uptime varies depending on how much time has elapsed: – HHHH:MM:SS (HHHH hours: MM minutes: SS seconds) for the first 24 hours – DdHHh (D days HH hours) after the first day – WwDd (W weeks D days) after the first week datetime (Optional) Specifies that the time stamp should consist of the date and time. • The time-stamp format for datetime is MMM DD HH:MM:SS, where MMM is the month, DD is the date, HH is the hour (in 24-hour notation), MM is the minute, and SS is the second. • If the datetime keyword is specified, you can optionally add the msec localtime, show-timezone, or year keywords. • If the service timestamps datetime command is used without addtional keywords, time stamps will be shown using UTC, without the year, without milliseconds, and without a time zone name. msec (Optional) Includes milliseconds in the time stamp, in the format HH:DD:MM:SS.mmm, where .mmm is milliseconds localtime (Optional) Time stamp relative to the local time zone. year (Optional) Include the year in the date-time format. show-timezone (Optional) Include the time zone name in the time stamp. Note If the localtime keyword option is not used (or if the local time zone has not been configured using the clock timezone command), time will be displayed in Coordinated Universal Time (UTC). service timestamps CF-529 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Default Time stamps are applied to debug and logging messages. Command Modes Global configuration (config) Command History Usage Guidelines Time stamps can be added to either debugging messages (service timestamp debug) or logging messages (service timestamp log) independently. If the service timestamps command is specified with no arguments or keywords, the default is service timestamps debug uptime. The no service timestamps command by itself disables time stamps for both debug and log messages. The uptime form of the command adds time stamps (such as “2w3d”) that indicating the time since the system was rebooted. The datetime form of the command adds time stamps (such as “Sep 5 2002 07:28:20”) that indicate the date and time according to the system clock. Entering the service timestamps {debug | log} command a second time will overwrite any previously configured service timestamp {debug | log} commands and associated options. To set the local time zone, use the clock timezone zone hours-offset command in global configuration mode. The time stamp will be preceeded by an asterisk or period if the time is potentially inaccurate. Table 48 describes the symbols that proceed the time stamp. Release Modification 10.0 This command was introduced. 11.3(5) Service time stamps are enabled by default. 12.3(1) The year keyword was added. 12.3(2)T This command was integrated into Cisco IOS Release 12.3(2)T. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB. Table 48 Time-Stamping Symbols for syslog Messages Symbol Description Example (blank) Time is authoritative: the software clock is in sync or has just been set manually 15:29:03.158 UTC Tue Feb 25 2003: * Time is not authoritative: the software clock has not been set, or is not in sync with configured Network Time Protocol (NTP) servers. *15:29:03.158 UTC Tue Feb 25 2003: . Time is authoritative, but the NTP is not synchronized: the software clock was in sync, but has since lost contact with all configured NTP servers. .15:29:03.158 UTC Tue Feb 25 2003: service timestamps CF-530 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, the router begins with time-stamping disabled. Then, the default time-stamping is enabled (uptime time stamps applied to debug output). Then, the default time-stamping for logging is enabled (uptime time stamps applied to logging output). Router# show running-config | include time no service timestamps debug uptime no service timestamps log uptime Router# config terminal Router(config)# service timestamps ! issue the show running-config command in config mode using do Router(config)# do show running-config | inc time ! shows that debug timestamping is enabled, log timestamping is disabled service timestamps debug uptime no service timestamps log uptime ! enable timestamps for logging messages Router(config)# service timestamps log Router(config)# do show run | inc time service timestamps debug uptime service timestamps log uptime Router(config)# service sequence-numbers Router(config)# end 000075: 5w0d: %SYS-5-CONFIG_I: Configured from console by console ! The following is a level 5 system logging message ! The leading number comes from the service sequence-numbers command. ! 4w6d indicates the timestamp of 4 weeks, 6 days 000075: 4w6d: %SYS-5-CONFIG_I: Configured from console by console In the following example, the user enables time-stamping on logging messages using the current time and date in Coordinated Universal Time/Greenwich Mean Time (UTC/GMT), and enables the year to be shown. Router(config)# ! The following line shows the timestamp with uptime (1 week 0 days) 1w0d: %SYS-5-CONFIG_I: Configured from console by console Router(config)# service timestamps log datetime show-timezone year Router(config)# end ! The following line shows the timestamp with datetime (11:13 PM March 22nd) .Mar 22 2004 23:13:25 UTC: %SYS-5-CONFIG_I: Configured from console by console The following example shows the change from UTC to local time: Router# configure terminal ! Logging output can be quite long; first changing line width to show full ! logging message Router(config)# line 0 Router(config-line)# width 180 Router(config-line)# logging synchronous Router(config-line)# end service timestamps CF-531 Cisco IOS Configuration Fundamentals Command Reference April 2010 ! Timestamping already enabled for logging messages; time shown in UTC. Oct 13 23:20:05 UTC: %SYS-5-CONFIG_I: Configured from console by console Router# show clock 23:20:53.919 UTC Wed Oct 13 2004 Router# configure terminal Enter configuration commands, one per line. End with the end command. ! Timezone set as Pacific Standard Time, with an 8 hour offset from UTC Router(config)# clock timezone PST -8 Router(config)# Oct 13 23:21:27 UTC: %SYS-6-CLOCKUPDATE: System clock has been updated from 23:21:27 UTC Wed Oct 13 2004 to 15:21:27 PST Wed Oct 13 2004, configured from console by console. Router(config)# ! Pacific Daylight Time (PDT) configured to start in April and end in October. ! Default offset is +1 hour. Router(config)# clock summer-time PDT recurring first Sunday April 2:00 last Sunday October 2:00 Router(config)# ! Time changed from 3:22 P.M. Pacific Standard Time (15:22 PST) ! to 4:22 P.M. Pacific Daylight (16:22 PDT) Oct 13 23:22:09 UTC: %SYS-6-CLOCKUPDATE: System clock has been updated from 15:22:09 PST Wed Oct 13 2004 to 16:22:09 PDT Wed Oct 13 2004, configured from console by console. ! Change the timestamp to show the local time and timezone. Router(config)# service timestamps log datetime localtime show-timezone Router(config)# end Oct 13 16:23:19 PDT: %SYS-5-CONFIG_I: Configured from console by console Router# show clock 16:23:58.747 PDT Wed Oct 13 2004 Router# config t Enter configuration commands, one per line. End with the end command. Router(config)# service sequence-numbers Router(config)# end Router# In the following example, the service timestamps log datetime command is used to change previously configured options for the date-time time stamp. Router(config)# service timestamps log datetime localtime show-timezone Router(config)# end ! The year is not displayed. Oct 13 15:44:46 PDT: %SYS-5-CONFIG_I: Configured from console by console Router# config t service timestamps CF-532 Cisco IOS Configuration Fundamentals Command Reference April 2010 Enter configuration commands, one per line. End with the end command. Router(config)# service timestamps log datetime show-timezone year Router(config)# end ! note: because the localtime option was not specified again, that option is ! removed from the output, and time is displayed in UTC (the default) Oct 13 2004 22:45:31 UTC: %SYS-5-CONFIG_I: Configured from console by console Related Commands Command Description clock set Manually sets the system clock. ntp Controls access to the system’s NTP services. service sequence-numbers Stamps system logging messages with a sequence number. service udp-small-servers CF-533 Cisco IOS Configuration Fundamentals Command Reference April 2010 service udp-small-servers To access minor User Datagram Protocol (UDP) services available from hosts on the network, use the service udp-small-servers command in global configuration mode. To disable these services, use the no form of this command. service udp-small-servers no service udp-small-servers Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes Global configuration Command History Usage Guidelines By default the UPD servers for Echo, Discard, and Chargen services are disabled. When the servers are disabled, access to Echo, Discard, and Chargen ports causes the Cisco IOS software to send an “ICMP port unreachable” message to the sender and discard the original incoming packet. Examples In the following example, the UDP server (UDP services) is enabled: Router(config)# service udp-small-servers Release Modification 11.2 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. service-module apa traffic-management CF-534 Cisco IOS Configuration Fundamentals Command Reference April 2010 service-module apa traffic-management To configure traffic management on the router, use the service-module apa traffic-management command in interface configuration mode. service-module apa traffic-management [ monitor | inline ] Syntax Description Command Default None Command Modes Interface configuration mode Command History Usage Guidelines To perform traffic management, you enable or disable the flow of packets by configuring the service module interface and the router interface. • Configure the router interface with the service-module apa traffic-management [monitor | inline] command. Two traffic management options are available: – Monitor—will copy the packet and designate the copy as the one forwarded to the Application Performance Assurance module (NME-APA). – Inline—will send the packet to the NME-APA, rather than sending a copy of the packet. After the NME-APA has processes the packet, it sends it back to the router. Note Enable only one traffic management option on the router, but not both concurrently. • Configure the service module interface with the Application Performance Assurance (APA) graphical user interface (GUI). See the Cisco Application Performance Assurance User Guide on Cisco.com for details. monitor Enables promiscuous monitoring. inline Enables inline monitoring. Release Modification 12.4(20)YA This command was introduced for the NME-APA on Cisco 2811, 2821, 2851, and Cisco 3800 Series Integrated Services Routers. service-module apa traffic-management CF-535 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example configures an interface on a Cisco 2851 Integrated Services Router for inline traffic management. Router> enable Router# configure terminal Router(config)# interface gigabitethernet 0/1 Router(config-if)# ip address 10.10.10.43 255.255.255.0 Router(config-if)# service-module apa traffic-management inline Router(config-if)# exit end Related Commands Command Description interface gigabitethernet Defines the interface on the router ip address Defines the IP address and subnet mask on the interface service-module wlan-ap bootimage CF-536 Cisco IOS Configuration Fundamentals Command Reference April 2010 service-module wlan-ap bootimage To configure the boot image on the service module, use the service-module wlan-ap bootimage command in privileged EXEC mode. service-module wlan-ap interface number bootimage [autonomous|unified] Syntax Description Command Default Autonomous software image Command Modes Privileged EXEC Command History Usage Guidelines When running the advanced IP services feature set on either Cisco 880 Series routers or Cisco 890 Series routers, use the service-module wlan-ap 0 bootimage unified command to enable the Cisco unified software upgrade image on the embedded wireless access point. After enabling the unified image, use the service-module wlan-ap 0 reload command to perform a graceful shutdown and reboot of the access point. Note The service-module wlan-ap 0 bootimage command does not support recovery images on the embedded access point. Use the service-module wlan-ap 0 reload command to shutdown and reboot the access point. Cisco 880 Series and Cisco 890 Series routers with embedded access point running the unified software image require DHCP to obtain an IP address for the access point. An IP address is needed to communicate with the Wireless LAN Controller (WLC) and to download its image upon boot up. The host router can provide DHCP server functionality through the DHCP pool to reach the WLC, and setup option 43 for the controller IP address in the DHCP pool configuration. Use the following guideline to setup a DHCP pool on the host router. ip dhcp pool embedded-ap-pool network 60.0.0.0 255.255.255.0 default router 60.0.0.1 option 43 hex f104.0a0a.0a0f /* Single WLC IP address (10.10.10.15) in HEX format */ int vlan 1 /* Default Vlan */ ip address 60.0.0.1 255.255.255.0 int Wlan-GigabitEthernet0 /* internal switch-port to AP */ switchport access vlan 1 interface number The interface number for the wireless device. Always use 0. autonomous Autonomous software image. unified Upgrade image with Lightweight Access Point Protocol (LWAPP). Release Modification 12.4(20) T This command was introduced for wireless-enabled Cisco 880 Series and Cisco 890 Series Integrated Services Routers. service-module wlan-ap bootimage CF-537 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example upgrades the embedded access point image from autonomous to unified. Router#configure terminal Router(config)#service-module wlan-ap 0 bootimage unified *Jan 18 05:31:58.172: %WLAN_AP_SM-6-UNIFIED_IMAGE: Embedded AP will change boot image to mini-IOS also called LWAPP recovery Please check router config to ensure connectivity between WLC and AP. Use service-module wlan-ap 0 reload to bootup mini-IOS image on AP Router(config)#end Router# *Jan 18 05:32:04.136: %SYS-5-CONFIG_I: Configured from console by console Router#service-module wlan-ap 0 reload Reload will save AP config.... Do you want to proceed with reload?[confirm] Trying to reload Service Module wlan-ap0. Router# Service Module saved config, start reset. Received reload request from router Saving configuration... Building configuration... Related Commands Command Description interface wlan-ap Enters wireless interface configuration mode to configure an interface. service-module wlan-ap reload Performs a graceful shutdown and reboot of the service module. service-module wlan-ap reset Resets the service module hardware. service-module wlan-ap reload CF-538 Cisco IOS Configuration Fundamentals Command Reference April 2010 service-module wlan-ap reload To perform a graceful shutdown and reboot of the service module use the service-module wlan-ap reload command in privileged EXEC mode. service-module wlan-ap interface number reload Syntax Description Command Default None Command Modes Privileged EXEC Command History Usage Guidelines Autonomous Mode At the confirmation prompt, press Enter to confirm the action, or press n to cancel. Note When running in autonomous mode, the reload command saves the configuration before rebooting. If the attempt is unsuccessful, the following message displays: Failed to save service module configuration. Unified Mode The service module reload command is usually handled by the Wireless LAN Controller (WLC). Note When running in Unified mode, the reload command will produce the following message: The embedded wireless device is in Unified mode. Reload/reset is normally handled by WLC controller. Still want to proceed? [yes] interface number The interface number for the wireless device. Always use 0. Release Modification 12.4(20)T This command was introduced for wireless-enabled Cisco 860, 880, and 890 Integrated Services Routers. service-module wlan-ap reload CF-539 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following examples show a graceful shut down and reboot of the service module: Autonomous Mode Router# service-module wlan-ap0 reload Do you want to proceed with reload?[confirm] Router# reload Do you want to reload the internal AP ? [yes/no]: Do you want to save the configuration of the AP ? [yes/no]: System configuration has been modified. Save [yes/no]: Proceed with reload? [confirm] Unified Mode Router# service-module wlan-ap0 reload The embedded AP is in Unified mode. Reload/reset is normally handled by WLC controller. Still want to proceed? [yes] Router# reload The embedded AP is in Unified mode. Reload/reset is normally handled by WLC controller. Do you want to reload the internal AP [yes/no]: System configuration has been modified. Save [yes/no]: Proceed with reload [Confirm] Related Commands Command Description interface wlan-ap Enters wireless interface configuration mode to configure an interface. service-module wlan-ap reset Resets the service module hardware. service-module wlan-ap reset CF-540 Cisco IOS Configuration Fundamentals Command Reference April 2010 service-module wlan-ap reset To reset the service module hardware, software, and configuration, use the service-module wlan-ap reset command in privileged EXEC mode. service-module wlan-ap interface number reset [bootloader | default-config] Syntax Description Command Default None Command Modes Privileged EXEC Command History Usage Guidelines At the confirmation prompt, press Enter to confirm the action, or press n to cancel. Caution Because you may lose data, use the service-module wlan-ap reset command only to recover from a shutdown or failed state. Examples The following example resets a wireless device on a router that is operating in either autonomous mode or LWAPP mode: Autonomous Mode Router# service-module wlan-ap0 reset Use reset only to recover from shutdown or failed state. LWAPP Mode Router# service-module wlan-ap0 reset The embedded device is in LWAPP mode. Reload/reset is normally handled by WLC controller. Still want to proceed? [yes] interface number The interface number for the wireless device. Always use 0. bootloader Resets the wireless device to the bootloader for manual image recovery. default-config Resets the wireless device to the factory default configuration. Release Modification 12.4(20)T This command was introduced for wireless-enabled Cisco 860, 880, and 890 Integrated Services Routers. service-module wlan-ap reset CF-541 Cisco IOS Configuration Fundamentals Command Reference April 2010 Resetting the Factory Default Configuration on the Wireless Device The following example resets the wireless device to the default configuration. Router#service-module wlan-ap 0 reset default-config Router# Recovering the Image on the Wireless Device The following example resets the wireless device down to the bootloader level for manual image recovery. Router#service-module wlan-ap0 reset bootloader Router# Related Commands Command Description interface wlan-ap Enters wireless interface configuration mode to configure an interface. service-module wlan-ap reload Performs a graceful shutdown and reboot of the service module. service-module wlan-ap session CF-542 Cisco IOS Configuration Fundamentals Command Reference April 2010 service-module wlan-ap session To begin a configuration session with a service module through a console connection use the service-module wlan-ap session command in privileged EXEC mode. service-module wlan-ap interface number session [clear | disconnect] Syntax Description Command Default None Command Modes Privileged EXEC Command History Usage Guidelines Only one session is allowed at a time into the wireless device from a router console-port connection. After starting a session, perform configuration tasks on the wireless device. You first access the router in a user-level shell. To access the privileged EXEC command shell, where most commands are available, use the enable command. When you finish configuring the device, and would like to exit the console session, type Ctrl-Shift 6x to return to the router’s console. Type service-module wlan-ap session clear or disconnect to close the session with the device. At the confirmation prompt, press Enter twice to confirm the action or n to cancel. Note If you do not clear or disconnect the session on the service module, it will remain open in the background after you return to the router’s console prompt. When the session is open in the background, pressing Enter will toggle you back to the wireless device prompt. Examples The following example shows a session being opened on a service-module in an ISR: Router# service-module wlan-ap 0 session Trying 1.2.3.4, 2002 ... Open AP# The following example clears the session on the service-module in the ISR: Router#service-module wlan-ap 0 session clear [confirm] [OK] interface number The interface number for the wireless device. Always use 0. clear (Optional) Clears the wireless device configuration session. Release Modification 12.4(20)T This command was introduced for wireless-enabled Cisco 860, 880, and 890 Integrated Services Routers. service-module wlan-ap session CF-543 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description enable Enters privileged EXEC mode. interface wlan-ap Enters wireless interface configuration mode to configure an interface. service-module wlan-ap statistics CF-544 Cisco IOS Configuration Fundamentals Command Reference April 2010 service-module wlan-ap statistics To display reset and reload information for a service module and its operating system software, use the service-module wlan-ap statistics command in privileged EXEC mode. service-module wlan-ap interface number statistics Syntax Description Command Default none Command Modes Privileged EXEC Command History Examples The following example displays information for wireless-enabled Cisco ISRs: Router#service-module wlan-ap 0 statistics Module Reset Statistics: CLI reset count = 0 CLI reload count = 1 Registration request timeout reset count = 0 Error recovery timeout reset count = 0 Module registration count = 10 The last IOS initiated event was a cli reload at *04:27:32.041 UTC Fri Mar 8 2007 Related Commands interface number The interface number for the wireless device. Always use 0. Release Modification 12.4(20)T This command was introduced for wireless-enabled Cisco 860, 880, and 890 Integrated Services Routers. Command Description interface wlan-ap Enters wireless interface configuration mode and configures a wireless device. service-module wlan-ap reset Resets the wireless device. service-module wlan-ap reload Performs a graceful shutdown and reboot on the wireless device. service-module wlan-ap status CF-545 Cisco IOS Configuration Fundamentals Command Reference April 2010 service-module wlan-ap status To display configuration information related to hardware and software on the service module, use the service-module wlan-ap status command in privileged EXEC mode. service-module wlan-ap interface number status Syntax Description Command Default None Command Modes Privileged EXEC Command History Usage Guidelines Use the service-module wlan-ap status command to • Display the wireless device’s software release version • Check the wireless device’s status (steady or down) • Display hardware information for the wireless device, including image, memory, interface, and system uptime Examples The following example displays information for the wireless device on a Cisco Integrated Services Router: Router#service-module wlan-ap 0 status Service Module is Cisco wlan-ap0 Service Module supports session via TTY line 2 Service Module is in Steady state Service Module reset on error is disabled Getting status from the Service Module, please wait.. Image path = flash:c8xx_19xx_ap-k9w7-mx.acregr/c8xx_19xx_ap-k9w7-mx.acre gr System uptime = 0 days, 4 hours, 28 minutes, 5 seconds Router#d was introduced for embedded wireless LAN access points on Cisco 860 and 880 Series Integrated Services Routers. interface number The interface number for the wireless device. Aways use 0. Release Modification 12.4(20)T This command was introduced for wireless-enabled Cisco 860, 880, and 890 Integrated Services Routers. session slot CF-546 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands session slot To open a session with a module (for example, the Multilayer Switch Module (MSM), Network Analysis Module (NAM), or Asynchronous Transfer Mode (ATM)), use the session slot command in EXEC mode. session slot mod processor processor-id Syntax Description Defaults This command has no default settings. Command Modes EXEC Command History Usage Guidelines To end the session, enter the quit command. This command allows you to use the module-specific CLI. Examples This example shows how to open a session with an MSM (module 4): Router# session slot 4 processor 2 Router# Command Description interface wlan-ap Enters wireless service module's console interface. mod Slot number. processor processor-id Specifies the processor ID. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. set memory debug incremental starting-time CF-547 Cisco IOS Configuration Fundamentals Command Reference April 2010 set memory debug incremental starting-time To set the current time as the starting time for incremental analysis, use the set memory debug incremental starting-time command in privileged EXEC mode. set memory debug incremental starting-time [none] Syntax Description Defaults No default behavior or values. Command Modes Privileged EXEC Command History Usage Guidelines For incremental analysis, a starting point can be defined by using the set memory debug incremental starting-time command. When a starting time is set, only memory allocated after that starting time will be considered for reporting as leaks. Examples The following example shows the command used to set the starting time for incremental analysis to the time when the command was issued: Router# set memory debug incremental starting-time Related Commands none (Optional) Resets the defined start time for incremental analysis. Release Modification 12.3(8)T1 This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show memory debug incremental allocation Displays all memory blocks that were allocated after the issue of the set memory debug incremental starting-time command. show memory debug incremental leaks Displays only memory that was leaked after the issue of the set memory debug incremental starting-time command. show memory debug incremental leaks lowmem Forces incremental memory leak detection to work in low memory mode. Displays only memory that was leaked after the issue of the set memory debug incremental starting-time command. show memory debug incremental status Displays if the starting point of incremental analysis has been defined and the time elapsed since then. show memory debug leaks Displays detected memory leaks. setup CF-548 Cisco IOS Configuration Fundamentals Command Reference April 2010 setup To enter Setup mode, use the setup command in privileged EXEC mode. setup Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Usage Guidelines Setup mode gives you the option of configuring your system without using the Cisco IOS Command Line Interface (CLI). For some tasks, you may find it easier to use Setup than to enter Cisco IOS commands individually. For example, you might want to use Setup to add a protocol suite, to make major addressing scheme changes, or to configure a newly installed interface. Although you can use the CLI to make these changes, Setup provides you with a high-level view of the configuration and guides you through the configuration process. If you are not familiar with Cisco products and the CLI, Setup is a particularly valuable tool because it prompts you for the specific information required to configure your system. Note If you use the Setup mode to modify a configuration because you have added or modified the hardware, be sure to verify the physical connections using the show version EXEC command. Also, verify the logical port assignments using the show running-config EXEC command to ensure that you configure the correct port. Refer to the hardware documentation for your platform for more information on physical and logical port assignments. Before using the Setup mode, you should have the following information so that you can configure the system properly: • Which interfaces you want to configure • Which routing protocols you wish to enable • Whether the router is to perform bridging • Network addresses for the protocols being configured • Password strategy for your environment When you enter the setup EXEC command after first-time startup, an interactive dialog called the System Configuration Dialog appears on the system console screen. The System Configuration Dialog guides you through the configuration process. It prompts you first for global parameters and then for interface parameters. The values shown in brackets next to each prompt reflect either the default settings or the last configured setting. Release Modification 11.1 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. setup CF-549 Cisco IOS Configuration Fundamentals Command Reference April 2010 The prompts and the order in which they appear on the screen vary depending on the platform and the interfaces installed in the device. You must progress through the System Configuration Dialog until you come to the item that you intend to change. To accept default settings for items that you do not want to change, press the Return or Enter key. The default choice is indicated by square brackets (for example, [yes]) before the prompt colon (:). To exit Setup mode and return to privileged EXEC mode without making changes and without progressing through the entire System Configuration Dialog, press Ctrl-C. The facility also provides help text for each prompt. To access help text, press the question mark (?) key at a prompt. When you complete your changes, the system will automatically display the configuration file that was created during the Setup session. It also asks you if you want to use this configuration. If you answer Yes, the configuration is saved to NVRAM as the startup configuration file. If you answer No, the configuration is not saved and the process begins again. There is no default for this prompt; you must answer either Yes or No. Examples The following example displays the setup command facility to configure serial interface 0 and to add ARAP and IP/IPX PPP support on the asynchronous interfaces: Router# setup --- System Configuration Dialog --- At any point you may enter a question mark '?' for help. Use ctrl-c to abort configuration dialog at any prompt. Default settings are in square brackets '[]'. Continue with configuration dialog? [yes]: First, would you like to see the current interface summary? [yes]: Interface IP-Address OK? Method Status Protocol Ethernet0 172.16.72.2 YES manual up up Serial0 unassigned YES not set administratively down down Serial1 172.16.72.2 YES not set up up Configuring global parameters: Enter host name [Router]: The enable secret is a one-way cryptographic secret used instead of the enable password when it exists. Enter enable secret []: The enable password is used when there is no enable secret and when using older software and some boot images. Enter enable password [ww]: Enter virtual terminal password [ww]: Configure SNMP Network Management? [yes]: Community string [public]: Configure DECnet? [no]: Configure AppleTalk? [yes]: Multizone networks? [no]: yes Configure IPX? [yes]: Configure IP? [yes]: setup CF-550 Cisco IOS Configuration Fundamentals Command Reference April 2010 Configure IGRP routing? [yes]: Your IGRP autonomous system number [15]: Configure Async lines? [yes]: Async line speed [9600]: 57600 Configure for HW flow control? [yes]: Configure for modems? [yes/no]: yes Configure for default chat script? [yes]: no Configure for Dial-in IP SLIP/PPP access? [no]: yes Configure for Dynamic IP addresses? [yes]: no Configure Default IP addresses? [no]: yes Configure for TCP Header Compression? [yes]: no Configure for routing updates on async links? [no]: Configure for Async IPX? [yes]: Configure for Appletalk Remote Access? [yes]: AppleTalk Network for ARAP clients [1]: 20 Zone name for ARAP clients [ARA Dialins]: Configuring interface parameters: Configuring interface Ethernet0: Is this interface in use? [yes]: Configure IP on this interface? [yes]: IP address for this interface [172.16.72.2]: Number of bits in subnet field [8]: Class B network is 172.16.0.0, 8 subnet bits; mask is /24 Configure AppleTalk on this interface? [yes]: Extended AppleTalk network? [yes]: AppleTalk starting cable range [1]: AppleTalk ending cable range [1]: AppleTalk zone name [Sales]: AppleTalk additional zone name: Configure IPX on this interface? [yes]: IPX network number [1]: Configuring interface Serial0: Is this interface in use? [no]: yes Configure IP on this interface? [no]: yes Configure IP unnumbered on this interface? [no]: yes Assign to which interface [Ethernet0]: Configure AppleTalk on this interface? [no]: yes Extended AppleTalk network? [yes]: AppleTalk starting cable range [2]: 3 AppleTalk ending cable range [3]: 3 AppleTalk zone name [myzone]: ZZ Serial AppleTalk additional zone name: Configure IPX on this interface? [no]: yes IPX network number [2]: 3 Configuring interface Serial1: Is this interface in use? [yes]: Configure IP on this interface? [yes]: Configure IP unnumbered on this interface? [yes]: Assign to which interface [Ethernet0]: Configure AppleTalk on this interface? [yes]: Extended AppleTalk network? [yes]: AppleTalk starting cable range [2]: AppleTalk ending cable range [2]: AppleTalk zone name [ZZ Serial]: AppleTalk additional zone name: Configure IPX on this interface? [yes]: IPX network number [2]: Configuring interface Async1: IPX network number [4]: Default client IP address for this interface [none]: 172.16.72.4 setup CF-551 Cisco IOS Configuration Fundamentals Command Reference April 2010 Configuring interface Async2: IPX network number [5]: Default client IP address for this interface [172.16.72.5]: Configuring interface Async3: IPX network number [6]: Default client IP address for this interface [172.16.72.6]: Configuring interface Async4: IPX network number [7]: Default client IP address for this interface [172.16.72.7]: Configuring interface Async5: IPX network number [8]: Default client IP address for this interface [172.16.72.8]: Configuring interface Async6: IPX network number [9]: Default client IP address for this interface [172.16.72.9]: Configuring interface Async7: IPX network number [A]: Default client IP address for this interface [172.16.72.10]: Configuring interface Async8: IPX network number [B]: Default client IP address for this interface [172.16.72.11]: Configuring interface Async9: IPX network number [C]: Default client IP address for this interface [172.16.72.12]: Configuring interface Async10: IPX network number [D]: Default client IP address for this interface [172.16.72.13]: Configuring interface Async11: IPX network number [E]: Default client IP address for this interface [172.16.72.14]: Configuring interface Async12: IPX network number [F]: Default client IP address for this interface [172.16.72.15]: Configuring interface Async13: IPX network number [10]: Default client IP address for this interface [172.16.72.16]: Configuring interface Async14: IPX network number [11]: Default client IP address for this interface [172.16.72.17]: Configuring interface Async15: IPX network number [12]: Default client IP address for this interface [172.16.72.18]: Configuring interface Async16: IPX network number [13]: Default client IP address for this interface [172.16.72.19]: The following configuration command script was created: hostname Router enable secret 5 $1$krIg$emfYm/1OwHVspDuS8Gy0K1 enable password ww line vty 0 4 password ww snmp-server community public ! no decnet routing appletalk routing ipx routing ip routing ! line 1 16 speed 57600 flowcontrol hardware modem inout setup CF-552 Cisco IOS Configuration Fundamentals Command Reference April 2010 ! arap network 20 ARA Dialins line 1 16 arap enable autoselect ! ! Turn off IPX to prevent network conflicts. interface Ethernet0 no ipx network interface Serial0 no ipx network interface Serial1 no ipx network ! interface Ethernet0 ip address 172.16.72.2 255.255.255.0 appletalk cable-range 1-1 1.204 appletalk zone Sales ipx network 1 no mop enabled ! interface Serial0 no shutdown no ip address ip unnumbered Ethernet0 appletalk cable-range 3-3 appletalk zone ZZ Serial ipx network 3 no mop enabled ! interface Serial1 no ip address ip unnumbered Ethernet0 appletalk cable-range 2-2 2.2 appletalk zone ZZ Serial ipx network 2 no mop enabled ! Interface Async1 ipx network 4 ip unnumbered Ethernet0 peer default ip address 172.16.72.4 async mode interactive ! Interface Async2 ipx network 5 ip unnumbered Ethernet0 peer default ip address 172.16.72.5 async mode interactive ! Interface Async3 ipx network 6 ip unnumbered Ethernet0 peer default ip address 172.16.72.6 async mode interactive ! Interface Async4 ipx network 7 ip unnumbered Ethernet0 peer default ip address 172.16.72.7 async mode interactive async dynamic address ! Interface Async5 setup CF-553 Cisco IOS Configuration Fundamentals Command Reference April 2010 ipx network 8 ip unnumbered Ethernet0 peer default ip address 172.16.72.8 async mode interactive ! Interface Async6 ipx network 9 ip unnumbered Ethernet0 peer default ip address 172.16.72.9 async mode interactive ! Interface Async7 ipx network A ip unnumbered Ethernet0 peer default ip address 172.16.72.10 async mode interactive ! Interface Async8 ipx network B ip unnumbered Ethernet0 peer default ip address 172.16.72.11 async mode interactive ! Interface Async9 ipx network C ip unnumbered Ethernet0 peer default ip address 172.16.72.12 async mode interactive ! Interface Async10 ipx network D ip unnumbered Ethernet0 peer default ip address 172.16.72.13 async mode interactive ! Interface Async11 ipx network E ip unnumbered Ethernet0 peer default ip address 172.16.72.14 async mode interactive ! Interface Async12 ipx network F ip unnumbered Ethernet0 peer default ip address 172.16.72.15 async mode interactive ! Interface Async13 ipx network 10 ip unnumbered Ethernet0 peer default ip address 172.16.72.16 async mode interactive ! Interface Async14 ipx network 11 ip unnumbered Ethernet0 peer default ip address 172.16.72.17 async mode interactive ! Interface Async15 ipx network 12 ip unnumbered Ethernet0 peer default ip address 172.16.72.18 async mode interactive setup CF-554 Cisco IOS Configuration Fundamentals Command Reference April 2010 ! Interface Async16 ipx network 13 ip unnumbered Ethernet0 peer default ip address 172.16.72.19 async mode interactive ! router igrp 15 network 172.16.0.0 ! end Use this configuration? [yes/no]: yes Building configuration... Use the enabled mode 'configure' command to modify this configuration. Router# Related Commands Command Description erase nvram: Erases a file system. show running-config Displays the running configuration file. Command alias for the more system:running-config command. show startup-config Displays the startup configuration file. Command alias for the more system:startup-config command. show version Displays the configuration of the system hardware, the software version, the names and sources of configuration files, and the boot images. show CF-555 Cisco IOS Configuration Fundamentals Command Reference April 2010 show To verify the Multiple Spanning Tree (MST) configuration, use the show command. in MST configuration submode. show [current | pending] Syntax Description Defaults This command has no default settings. Command Modes MST configuration submode Command History Usage Guidelines The display output from the show pending command is the edited configuration that will replace the current configuration if you enter the exit command to exit MST configuration mode. Entering the show command with no arguments displays the pending configurations. Examples This example shows how to display the edited configuration: Router(config-mst)# show pending Pending MST configuration Name [zorglub] Version 31415 Instance Vlans Mapped -------- --------------------------------------------------------------------- 0 4001-4096 2 1010, 1020, 1030, 1040, 1050, 1060, 1070, 1080, 1090, 1100, 1110 1120 3 1-1009, 1011-1019, 1021-1029, 1031-1039, 1041-1049, 1051-1059 1061-1069, 1071-1079, 1081-1089, 1091-1099, 1101-1109, 1111-1119 1121-4000 ------------------------------------------------------------------------------ Router(config-mst)# This example shows how to display the current configuration: Router(config-mst)# show current current (Optional) Displays the current configuration that is used to run MST. pending (Optional) Displays the edited configuration that will replace the current configuration. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show CF-556 Cisco IOS Configuration Fundamentals Command Reference April 2010 Current MST configuration Name [] Revision 0 Instance Vlans mapped -------- --------------------------------------------------------------------- 0 1-4094 ------------------------------------------------------------------------------- Related Commands Command Description instance Maps a VLAN or a set of VLANs to an MST instance. name (MST configuration submode) Sets the name of an MST region. revision Sets the revision number for the MST configuration. show spanning-tree mst Displays the information about the MST protocol. spanning-tree mst configuration Enters MST-configuration submode. show append CF-557 Cisco IOS Configuration Fundamentals Command Reference April 2010 show append To redirect and add the output of any show command to an existing file, use the show command | append command in privileged EXEC mode. show command | append url Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines To display all URL prefixes that are supported for this command, use the show command | append ? command. This command adds the show command output to the end of the specified file. Examples In the following example, output from the show tech-support command is redirected to an existing file on Disk 1 with the file-name of “showoutput.txt.” This output is added at the end of any existing data in the file. Router# show tech-support | append disk1:showoutput.txt Related Commands command Any Cisco IOS show command. | append url The addition of this syntax redirects the command output to the file location specified in the Universal Resource Locator (URL). The pipe (|) is required. The Cisco IOS File System (IFS) uses URLs to specify the location of a file system, directory, and file. Typical URL elements include: prefix:[directory/]filename Prefixes can be local file locations, such as flash: or disk0:. Alternatively, you can specify network locations using the following syntax: ftp:[[//[username[:password]@]location]/directory]/filename tftp:[[//location]/directory]/filename The rcp: prefix is not supported. Release Modification 12.0(21)S This command was introduced. 12.2(13)T This command was integrated into Cisco IOS Release 12.2(13)T. Command Description show redirect Redirects the output of any show command to a specified file. show tee Copies the show command output to a file while displaying it on the terminal. show begin CF-558 Cisco IOS Configuration Fundamentals Command Reference April 2010 show begin To begin the output of any show command from a specified string, use the show command | begin command in EXEC mode. show command | begin regular-expression Syntax Description Command Modes EXEC Command History Usage Guidelines The regular-expression argument is case sensitive and allows for complex matching requirements. Use parenthesis to indicate a literal use of spaces. For example, | begin u indicates that the show output should begin with any line that contains a u; | begin ( u) indicates that the show output should begin with any line that contains a space and a u together (line has a word that begins with a lowercase u). To search the remaining output of the show command, use the following command at the --More-- prompt: /regular-expression You can specify a filtered search at any --More-- prompt. To filter the remaining output of the show command, use one of the following commands at the --More-- prompt: -regular-expression +regular-expression When output volume is large, the search can produce long lists of output. To interrupt the output, press Ctrl-^ (Ctrl-Shift-6) or Ctrl-z. command Any supported show command. | A vertical bar (the “pipe” symbol) indicates that an output processing specification follows. regular-expression Any regular expression found in show command output. The show output will begin from the first instance of this string (output prior to this string will not be printed to the screen). The string is case-sensitive. Use parenthesis to indicate a literal use of spaces. / Specifies a search at a --More-- prompt that begins unfiltered output with the first line that contains the regular expression. - Specifies a filter at a --More-- prompt that only displays output lines that do not contain the regular expression. + Specifies a filter at a --More-- prompt that only displays output lines that contain the regular expression. Release Modification 8.3 The show command was introduced. 12.0(1)T This extension of the show command was introduced.. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show begin CF-559 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note Once you specify a filter for a show command, you cannot specify another filter at the next --More-- prompt. The first specified filter remains until the more command output finishes or until you interrupt the output. The use of the keyword begin does not constitute a filter. Because prior output is not saved, you cannot search or filter backward through prior output. Note A few show commands that have long output requirements do not require user input at the --More-- prompt to jump to the next table of output; these types of output require you to enter the same number of Ctrl-^ or Ctrl-Z combinations as there are --More-- prompts to completely abort output. Examples The following is partial sample output of the show interface | begin command that begins unfiltered output with the first line that contains the regular expression “Ethernet.” At the --More-- prompt, the user specifies a filter to show only the lines in the remaining output that contain the regular expression “Serial.” Router# show interface | begin Ethernet Ethernet0 is up, line protocol is up Hardware is Lance, address is 0060.837c.6399 (bia 0060.837c.6399) Description: ip address is 172.1.2.14 255.255.255.0 Internet address is 172.1.2.14/24 . . . 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out --More-- +Serial filtering... Serial1 is up, line protocol is up Serial2 is up, line protocol is up Serial3 is up, line protocol is down Serial4 is down, line protocol is down Serial5 is up, line protocol is up Serial6 is up, line protocol is up Serial7 is up, line protocol is up Related Commands Command Description more begin Begins unfiltered output of the more command with the first line that contains the regular expression you specify. more exclude Filters more command output so that it excludes lines that contain a particular regular expression. more include Filters more command output so that it displays only lines that contain a particular regular expression. show exclude Filters show command output so that it excludes lines that contain a particular regular expression. show include Filters show command output so that it displays only lines that contain a particular regular expression. show exclude CF-560 Cisco IOS Configuration Fundamentals Command Reference April 2010 show exclude To filter show command output so that it excludes lines that contain a particular regular expression, use the show command | exclude command in EXEC mode. show command | exclude regular-expression Syntax Description Command Modes EXEC Command History Usage Guidelines The regular-expression argument is case sensitive and allows for complex matching requirements. You can specify a new search at every --More-- prompt. To search the remaining output of the show command, use the following syntax at the --More-- prompt: /regular-expression When output volume is large, the search can produce long lists of output. To interrupt the output, press Ctrl-^ (Ctrl-Shift-6) or Ctrl-Z. Because prior output is not saved, you cannot search or filter backward through prior output. Note A few show commands that have long output requirements do not require user input at the --More-- prompt to jump to the next table of output; these types of output require you to enter the same number of Ctrl-^ or Ctrl-Z combinations as there are --More-- prompts to completely abort output. Examples The following is partial sample output of the show | exclude command used with the show buffers command. It excludes lines that contain the regular expression “0 misses.” At the --More-- prompt, the user searches for the regular expression “Serial0,” which continues the filtered output with the first line that contains “Serial0.” Router# show buffers | exclude 0 misses Buffer elements: 398 in free list (500 max allowed) Public buffer pools: command Any supported show command. | A vertical bar (the “pipe” symbol) indicates that an output processing specification follows. regular-expression Any regular expression found in show command output. / Specifies a search at a --More-- prompt that begins unfiltered output with the first line that contains the regular expression. Release Modification 12.0(1)T This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show exclude CF-561 Cisco IOS Configuration Fundamentals Command Reference April 2010 Small buffers, 104 bytes (total 50, permanent 50): 50 in free list (20 min, 150 max allowed) 551 hits, 3 misses, 0 trims, 0 created Big buffers, 1524 bytes (total 50, permanent 50): 49 in free list (5 min, 150 max allowed) Very Big buffers, 4520 bytes (total 10, permanent 10): . . . Huge buffers, 18024 bytes (total 0 permanent 0): 0 in free list (0 min, 4 max allowed) --More-- /Serial0 filtering... Serial0 buffers, 1543 bytes (total 64, permanent 64): 16 in free list (0 min, 64 max allowed) 48 hits, 0 fallbacks Related Commands Command Description more begin Begins unfiltered output of the more command with the first line that contains the regular expression you specify. more exclude Filters more command output so that it excludes lines that contain a particular regular expression. more include Filters more command output so that it displays only lines that contain a particular regular expression. show begin Searches the output of any show command and displays the output from the first instance of a specified string. show include Filters show command output so that it displays only lines that contain a particular regular expression. show include CF-562 Cisco IOS Configuration Fundamentals Command Reference April 2010 show include To filter show command output so that it only displays lines that contain a particular regular expression, use the show command | include command in EXEC mode. show command | include regular-expression Syntax Description Command Modes EXEC Command History Usage Guidelines The regular-expression argument is case sensitive and allows for complex matching requirements. You can specify a new search at every --More-- prompt. To search the remaining output of the show command, use the following syntax at the --More-- prompt: /regular-expression When output volume is large, the search can produce long lists of output. To interrupt the output, press Ctrl-^ (Ctrl-Shift-6) or Ctrl-Z. Because prior output is not saved, you cannot search or filter backward through prior output. Note A few show commands that have long output requirements do not require user input at the --More-- prompt to jump to the next table of output; these types of output require you to enter the same number of Ctrl-^ or Ctrl-Z combinations as there are --More-- prompts to completely abort output. Examples The following is partial sample output of the show interface | include command. It displays only lines that contain the regular expression “( is ).” The parentheses force the inclusion of the spaces before and after “is.” Use of the parenthesis ensures that only lines containing “is” with a space both before and after it will be included in the output. Lines with words like “disconnect” will be excluded because there are not spaces around the instance of the string “is”. Router# show interface | include ( is ) command Any supported show command. | A vertical bar (the “pipe” symbol) indicates that an output processing specification follows. regular-expression Any regular expression found in show command output. Use parenthesis to include spaces in the expression. / Specifies a search at a --More-- prompt that begins unfiltered output with the first line that contains the regular expression. Release Modification 12.0(1)T This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show include CF-563 Cisco IOS Configuration Fundamentals Command Reference April 2010 ATM0 is administratively down, line protocol is down Hardware is ATMizer BX-50 Dialer1 is up (spoofing), line protocol is up (spoofing) Hardware is Unknown DTR is pulsed for 1 seconds on reset Ethernet0 is up, line protocol is up Hardware is Lance, address is 0060.837c.6399 (bia 0060.837c.6399) Internet address is 172.21.53.199/24 Ethernet1 is up, line protocol is up Hardware is Lance, address is 0060.837c.639c (bia 0060.837c.639c) Internet address is 5.5.5.99/24 Serial0:0 is down, line protocol is down Hardware is DSX1 . . . --More-- At the --More-- prompt, the user searches for the regular expression “Serial0:13”, which continues filtered output with the first line that contains “Serial0:13.” /Serial0:13 filtering... Serial0:13 is down, line protocol is down Hardware is DSX1 Internet address is 11.0.0.2/8 0 output errors, 0 collisions, 2 interface resets Timeslot(s) Used:14, Transmitter delay is 0 flags Related Commands Command Description more begin Begins unfiltered output of the more command with the first line that contains the regular expression you specify. more exclude Filters more command output so that it excludes lines that contain a particular regular expression. more include Filters more command output so that it displays only lines that contain a particular regular expression. show begin Searches the output of any show command and displays the output from the first instance of a specified string. show exclude Filters show command output so that it excludes lines that contain a particular regular expression. show redirect CF-564 Cisco IOS Configuration Fundamentals Command Reference April 2010 show redirect To redirect the output of any show command to a file, use the show command | redirect command in privileged EXEC mode. show command | redirect url Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines To display all URL prefixes that are supported for this command, use the show command | redirect ? command. This command creates a new file at the specified location, or overwrites an existing file. Examples In the following example, output from the show tech-support command is write to the file “showtech.txt” on the host at 172.16.101.101 in the directory “//tftpboot/docs/” using FTP: Router# show tech | redirect ftp://USER:MYPASSWORD@172.16.101.101//tftpboot/docs/showtech.txt Related Commands command Any Cisco IOS show command. | redirect url The addition of this syntax redirects the command output to the file location specified in the Universal Resource Locator (URL). The pipe (|) is required. The Cisco IOS File System (IFS) uses URLs to specify the location of a file system, directory, and file. Typical URL elements include: prefix:[directory/]filename Prefixes can be local file locations, such as flash: or disk0:. Alternatively, you can specify network locations using the following syntax: ftp:[[//[username[:password]@]location]/directory]/filename tftp:[[//location]/directory]/filename The rcp: prefix is not supported. Release Modification 12.0(21)S This command was introduced. 12.2(13)T This command was integrated into Cisco IOS Release 12.2(13)T. Command Description show append Redirects and appends show command output to the end of an existing file. show tee Copies the show command output to a file while displaying it on the terminal. show section CF-565 Cisco IOS Configuration Fundamentals Command Reference April 2010 show section To filter the output of a show command to match a given expression as well as any lines associated with that expression, use the show command section command in privileged EXEC mode. show command | section [include | exclude] regular-expression Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines In many cases, it is useful to filter the output of a show command to match a specific expression. Filtering provides some control over the type and amount of information displayed by the system. The show section command provides enhanced filtering capabilities by matching lines in the show command output containing specific expressions as well as matching any entries associated with those expressions. Filtering is especially useful, for example, when displaying large configuration files using the show running-configuration command or the show interfaces command. If the include or exclude keyword is not specified, include is the default. If there are no associated entries for an expression, then only the line matching the expression is displayed. Examples The following examples compare the filtering characteristics of the show running-config | include command with the show running-config | section command. The first example gathers just the lines from the configuration file with “interface” in them. Router# show running-config | include interface interface Ethernet0/0 interface Ethernet1/0 interface Serial2/0 interface Serial3/0 The next example uses the show command section command to gather the lines in the configuration file with “interface” in them as well as any lines associated with those entries. In this example, interface configuration information is captured. command Any Cisco IOS show command. include (Optional) Includes only the lines that contain a particular regular expression. This is the default keyword when none is specified. exclude (Optional) Excludes any lines that contain a particular regular expression. regular-expression Any regular expression or plain text string found in show command output. The syntax of the regular expression conforms to that of Bell V8 regexp(3). Release Modification 12.3(2)T This command was introduced. 12.2(33)SRE This command was integrated into Cisco IOS release 12.(33)SRE. show section CF-566 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router# show running-config | section include interface interface Ethernet0/0 shutdown no cdp enable interface Ethernet1/0 shutdown no cdp enable interface Serial2/0 shutdown no cdp enable interface Serial3/0 shutdown no cdp enable Related Commands Command Description show append Redirects the output of any show command and adds it to the end of an existing file. show exclude Filters show command output so that it excludes lines that contain a particular regular expression. show include Filters show command output so that it displays only lines that contain a particular regular expression. show redirect Redirects the output of any show command to a specified file. show tee CF-567 Cisco IOS Configuration Fundamentals Command Reference April 2010 show tee To copy the output of any show command to a file while displaying it on the terminal, use the show command | tee command in privileged EXEC mode. show command | tee [/append] url Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines To display all URL prefixes that are supported for this command, use the show command | tee ? command. The tee keyword was chosen to reflect that output is redirected to two locations; the terminal and a file (as a tee plumbing junction redirects water to two different pipes). Examples In the following example, output from the show tech-support command is displayed on-screen while it is written to the file “showoutput.txt” at the host 172.16.101.101 using TFTP: Router# show tech-support | tee tftp://172.16.101.101/docs/showoutput.txt The following example performs the same function as above, but in this case the output is added at the end of any existing data in the file “showoutput.txt”: Router# show tech-support | tee /append tftp://172.16.101.101/docs/showoutput.txt command Any Cisco IOS show command. | tee url The addition of this syntax copies the command output to the file location specified in the Universal Resource Locator (URL). The pipe (|) is required. The Cisco IOS File System (IFS) uses URLs to specify the location of a file system, directory, and file. Typical URL elements include: prefix:[directory/]filename Prefixes can be local file locations, such as flash: or disk0:. Alternatively, you can specify network locations using the following syntax: ftp:[[//[username[:password]@]location]/directory]/filename tftp:[[//location]/directory]/filename The rcp: prefix is not supported. /append (Optional) Adds the show command output to the end of an existing file. Release Modification 12.0(21)S This command was introduced. 12.2(13)T This command was integrated into Cisco IOS Release 12.2(13)T. show tee CF-568 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description show append Redirects the output of any show command and adds it to the end of existing file. show redirect Redirects the output of any show command to a specified file. show (Flash file system) CF-569 Cisco IOS Configuration Fundamentals Command Reference April 2010 show (Flash file system) To display the layout and contents of a Flash memory file system, use the show flash-filesystem command in EXEC mode. Class A Flash File Systems show flash-filesystem: [all | chips | filesys] Class B Flash File Systems show flash-filesystem:[partition-number:] [all | chips | detailed | err | summary] Class C Flash File Systems show flash-filesystem: Syntax Description flash-filesystem: Flash memory file system, followed by a colon. The availablity of Flash file system keywords will vary by platform. Valid flash file system keywords inlude: • bootflash • flash • slot0 • slot1 • slavebootflash • slaveslot0 • slaveslot1 all (Optional) On Class B Flash file systems, all keyword displays complete information about Flash memory, including information about the individual ROM devices in Flash memory and the names and sizes of all system image files stored in Flash memory, including those that are invalid. On Class A Flash file systems, the all keyword displays the following information: • The information displayed when no keywords are used. • The information displayed by the filesys keyword. • The information displayed by the chips keyword. chips (Optional) Displays information per partition and per chip, including which bank the chip is in, plus its code, size, and name. filesys (Optional) Displays the Device Info Block, the Status Info, and the Usage Info. partition-number (Optional) Displays output for the specified partition number. If you do not specify a partition in the command, the router displays output for all partitions. You can use this keyword only when Flash memory has multiple partitions. show (Flash file system) CF-570 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Modes EXEC Command History Usage Guidelines If Flash memory is partitioned, the command displays the requested output for each partition, unless you use the partition keyword. The command also specifies the location of the current image. To display the contents of boot Flash memory on Class A or B file systems, use the show bootflash: command as follows: Class A Flash file systems show bootflash: [all | chips | filesys] Class B Flash file systems show bootflash:[partition-number] [all | chips | detailed | err] To display the contents of internal Flash memory on Class A or B file systems, use the show flash: command as follows: Class A Flash file systems show flash: [all | chips | filesys] Class B Flash file systems show flash:[partition-number][all | chips | detailed | err | summary] The show (Flash file system) command replaces the show flash devices command. Examples The output of the show command depends on the type of Flash file system you select. Types include flash:, bootflash:, slot0:, slot1:, slavebootflash:, slaveslot0:, and slaveslot1:. detailed (Optional) Displays detailed file directory information per partition, including file length, address, name, Flash memory checksum, computer checksum, bytes used, bytes available, total bytes, and bytes of system Flash memory. err (Optional) Displays write or erase failures in the form of number of retries. summary (Optional) Displays summary information per partition, including the partition size, bank size, state, and method by which files can be copied into a particular partition. You can use this keyword only when Flash memory has multiple partitions. Release Modification 11.3 AA This command was introduced. 12.3 A timestamp that shows the offset from Coordinated Universal Time (UTC) was added to the show command display. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show (Flash file system) CF-571 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples of output from the show flash command are provided in the following sections: • Class A Flash File System • Class B Flash File Systems Although the examples use flash: as the Flash file system, you may also use the other Flash file systems listed. Class A Flash File System The following three examples show sample output for Class A Flash file systems. Table 49 describes the significant fields shown in the display. The following is sample output from the show flash: command. Router# show flash: -#- ED --type-- --crc--- -seek-- nlen -length- -----date/time------ name 1 .. unknown 317FBA1B 4A0694 24 4720148 Dec 15 2003 17:49:36 -08:00 hampton/nitro/c7200-j-mz 2 .. unknown 9237F3FF 92C574 11 4767328 Jan 02 2004 18:42:53 -08:00 c7200-js-mz 3 .D unknown 71AB01F1 10C94E0 10 7982828 Jan 02 2004 18:48:14 -08:00 rsp-jsv-mz 4 .D unknown 96DACD45 10C97E0 8 639 Jan 03 2004 12:09:17 -08:00 the_time 5 .. unknown 96DACD45 10C9AE0 3 639 Jan 03 2004 12:09:32 -08:00 the_time 6 .D unknown 96DACD45 10C9DE0 8 639 Jan 03 2004 12:37:01 -08:00 the_time 7 .. unknown 96DACD45 10CA0E0 8 639 Jan 03 2004 12:37:13 -08:00 the_time 3104544 bytes available (17473760 bytes used) The following is sample output from the show flash: chips command: RouterA# show flash: chips ******** Intel Series 2+ Status/Register Dump ******** ATTRIBUTE MEMORY REGISTERS: Config Option Reg (4000): 2 Table 49 show (Class A Flash File System) Field Descriptions Field Description # Index number for the file. ED Whether the file contains an error (E) or is deleted (D). type File type (1 = configuration file, 2 = image file). The software displays these values only when the file type is certain. When the file type is unknown, the system displays “unknown” in this field. crc Cyclic redundant check for the file. seek Offset into the file system of the next file. nlen Name length—Length of the filename. length Length of the file itself. date/time Date and time the file was created. In the example, -08:00 indicates that the given date and time is 8 hours behind Coordinated Universal Time (UTC). name Name of the file. show (Flash file system) CF-572 Cisco IOS Configuration Fundamentals Command Reference April 2010 Config Status Reg (4002): 0 Card Status Reg (4100): 1 Write Protect Reg (4104): 4 Voltage Cntrl Reg (410C): 0 Rdy/Busy Mode Reg (4140): 2 COMMON MEMORY REGISTERS: Bank 0 Intelligent ID Code : 8989A0A0 Compatible Status Reg: 8080 Global Status Reg: B0B0 Block Status Regs: 0 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 8 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 16 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 24 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 COMMON MEMORY REGISTERS: Bank 1 Intelligent ID Code : 8989A0A0 Compatible Status Reg: 8080 Global Status Reg: B0B0 Block Status Regs: 0 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 8 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 16 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 24 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 COMMON MEMORY REGISTERS: Bank 2 Intelligent ID Code : 8989A0A0 Compatible Status Reg: 8080 Global Status Reg: B0B0 Block Status Regs: 0 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 8 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 16 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 24 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 COMMON MEMORY REGISTERS: Bank 3 Intelligent ID Code : 8989A0A0 Compatible Status Reg: 8080 Global Status Reg: B0B0 Block Status Regs: 0 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 8 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 16 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 24 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 COMMON MEMORY REGISTERS: Bank 4 Intelligent ID Code : 8989A0A0 Compatible Status Reg: 8080 Global Status Reg: B0B0 Block Status Regs: 0 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 8 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 16 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 24 : B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 B0B0 The following is sample output from the show flash: filesys command: RouterA# show flash: filesys -------- F I L E S Y S T E M S T A T U S -------- Device Number = 0 DEVICE INFO BLOCK: Magic Number = 6887635 File System Vers = 10000 (1.0) show (Flash file system) CF-573 Cisco IOS Configuration Fundamentals Command Reference April 2010 Length = 1400000 Sector Size = 20000 Programming Algorithm = 4 Erased State = FFFFFFFF File System Offset = 20000 Length = 13A0000 MONLIB Offset = 100 Length = C730 Bad Sector Map Offset = 1FFEC Length = 14 Squeeze Log Offset = 13C0000 Length = 20000 Squeeze Buffer Offset = 13E0000 Length = 20000 Num Spare Sectors = 0 Spares: STATUS INFO: Writable NO File Open for Write Complete Stats No Unrecovered Errors No Squeeze in progress USAGE INFO: Bytes Used = 10AA0E0 Bytes Available = 2F5F20 Bad Sectors = 0 Spared Sectors = 0 OK Files = 4 Bytes = 90C974 Deleted Files = 3 Bytes = 79D3EC Files w/Errors = 0 Bytes = 0 The following is sample output from the show flash: command: RouterB> show flash: System flash directory: File Length Name/status 1 4137888 c3640-c2is-mz.Feb24 [4137952 bytes used, 12639264 available, 16777216 total] 16384K bytes of processor board System flash (Read/Write)\ The following example shows detailed information about the second partition in internal Flash memory: RouterB# show flash:2 System flash directory, partition 2: File Length Name/status 1 1711088 dirt/images/c3600-i-mz [1711152 bytes used, 15066064 available, 16777216 total] 16384K bytes of processor board System flash (Read/Write) Class B Flash File Systems Table 50 describes the significant fields shown in the displays. Table 50 show (Class B Flash File System) all Fields Field Description addr Address of the file in Flash memory. available Total number of bytes available in Flash memory. Bank Bank number. Bank-Size Size of bank in bytes. bytes used Total number of bytes used in Flash memory. ccksum Computed checksum. Chip Chip number. Code Code number. show (Flash file system) CF-574 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following is sample output from the show flash: all command: RouterB> show flash: all Partition Size Used Free Bank-Size State Copy Mode 1 16384K 4040K 12343K 4096K Read/Write Direct System flash directory: File Length Name/status addr fcksum ccksum 1 4137888 c3640-c2is-mz.Feb24 0x40 0xED65 0xED65 Copy-Mode Method by which the partition can be copied to: • RXBOOT-MANUAL indicates a user can copy manually by reloading to the boot ROM image. • RXBOOT-FLH indicates user can copy via Flash load helper. • Direct indicates user can copy directly into Flash memory. • None indicates that it is not possible to copy into that partition. fcksum Checksum recorded in Flash memory. File Number of the system image file. If no filename is specified in the boot system flash command, the router boots the system image file with the lowest file number. Free Number of bytes free in partition. Length Size of the system image file (in bytes). Name Name of chip manufacturer and chip type. Name/status Filename and status of a system image file. The status [invalidated] appears when a file has been rewritten (recopied) into Flash memory. The first (now invalidated) copy of the file is still present within Flash memory, but it is rendered unusable in favor of the newest version. The [invalidated] status can also indicate an incomplete file that results from the user abnormally terminating the copy process, a network timeout, or a Flash memory overflow. Partition Partition number in Flash memory. Size Size of partition (in bytes) or size of chip. State State of the partition. It can be one of the following values: • Read-Only indicates the partition that is being executed from. • Read/Write is a partition that can be copied to. System flash directory Flash directory and its contents. total Total size of Flash memory (in bytes). Used Number of bytes used in partition. Table 50 show (Class B Flash File System) all Fields (continued) Field Description show (Flash file system) CF-575 Cisco IOS Configuration Fundamentals Command Reference April 2010 [4137952 bytes used, 12639264 available, 16777216 total] 16384K bytes of processor board System flash (Read/Write) Chip Bank Code Size Name 1 1 01D5 1024KB AMD 29F080 2 1 01D5 1024KB AMD 29F080 3 1 01D5 1024KB AMD 29F080 4 1 01D5 1024KB AMD 29F080 1 2 01D5 1024KB AMD 29F080 2 2 01D5 1024KB AMD 29F080 3 2 01D5 1024KB AMD 29F080 4 2 01D5 1024KB AMD 29F080 1 3 01D5 1024KB AMD 29F080 2 3 01D5 1024KB AMD 29F080 3 3 01D5 1024KB AMD 29F080 4 3 01D5 1024KB AMD 29F080 1 4 01D5 1024KB AMD 29F080 2 4 01D5 1024KB AMD 29F080 3 4 01D5 1024KB AMD 29F080 4 4 01D5 1024KB AMD 29F080 The following is sample output from the show flash: all command on a router with Flash memory partitioned: Router# show flash: all System flash partition information: Partition Size Used Free Bank-Size State Copy-Mode 1 4096K 3459K 637K 4096K Read Only RXBOOT-FLH 2 4096K 3224K 872K 4096K Read/Write Direct System flash directory, partition 1: File Length Name/status addr fcksum ccksum 1 3459720 master/igs-bfpx.100-4.3 0x40 0x3DE1 0x3DE1 [3459784 bytes used, 734520 available, 4194304 total] 4096K bytes of processor board System flash (Read ONLY) Chip Bank Code Size Name 1 1 89A2 1024KB INTEL 28F008SA 2 1 89A2 1024KB INTEL 28F008SA 3 1 89A2 1024KB INTEL 28F008SA 4 1 89A2 1024KB INTEL 28F008SA Executing current image from System flash [partition 1] System flash directory, partition2: File Length Name/status addr fcksum ccksum 1 3224008 igs-kf.100 0x40 0xEE91 0xEE91 [3224072 bytes used, 970232 available, 4194304 total] 4096K bytes of processor board System flash (Read/Write) Chip Bank Code Size Name 1 2 89A2 1024KB INTEL 28F008SA 2 2 89A2 1024KB INTEL 28F008SA 3 2 89A2 1024KB INTEL 28F008SA 4 2 89A2 1024KB INTEL 28F008SA The following is sample output from the show flash: chips command: show (Flash file system) CF-576 Cisco IOS Configuration Fundamentals Command Reference April 2010 RouterB> show flash: chips 16384K bytes of processor board System flash (Read/Write) Chip Bank Code Size Name 1 1 01D5 1024KB AMD 29F080 2 1 01D5 1024KB AMD 29F080 3 1 01D5 1024KB AMD 29F080 4 1 01D5 1024KB AMD 29F080 1 2 01D5 1024KB AMD 29F080 2 2 01D5 1024KB AMD 29F080 3 2 01D5 1024KB AMD 29F080 4 2 01D5 1024KB AMD 29F080 1 3 01D5 1024KB AMD 29F080 2 3 01D5 1024KB AMD 29F080 3 3 01D5 1024KB AMD 29F080 4 3 01D5 1024KB AMD 29F080 1 4 01D5 1024KB AMD 29F080 2 4 01D5 1024KB AMD 29F080 3 4 01D5 1024KB AMD 29F080 4 4 01D5 1024KB AMD 29F080 The following is sample output from the show flash: detailed command: RouterB> show flash: detailed System flash directory: File Length Name/status addr fcksum ccksum 1 4137888 c3640-c2is-mz.Feb24 0x40 0xED65 0xED65 [4137952 bytes used, 12639264 available, 16777216 total] 16384K bytes of processor board System flash (Read/Write) The following is sample output from the show flash: err command: RouterB> show flash: err System flash directory: File Length Name/status 1 4137888 c3640-c2is-mz.Feb24 [4137952 bytes used, 12639264 available, 16777216 total] 16384K bytes of processor board System flash (Read/Write) Chip Bank Code Size Name erase write 1 1 01D5 1024KB AMD 29F080 0 0 2 1 01D5 1024KB AMD 29F080 0 0 3 1 01D5 1024KB AMD 29F080 0 0 4 1 01D5 1024KB AMD 29F080 0 0 1 2 01D5 1024KB AMD 29F080 0 0 2 2 01D5 1024KB AMD 29F080 0 0 3 2 01D5 1024KB AMD 29F080 0 0 4 2 01D5 1024KB AMD 29F080 0 0 1 3 01D5 1024KB AMD 29F080 0 0 2 3 01D5 1024KB AMD 29F080 0 0 3 3 01D5 1024KB AMD 29F080 0 0 4 3 01D5 1024KB AMD 29F080 0 0 1 4 01D5 1024KB AMD 29F080 0 0 2 4 01D5 1024KB AMD 29F080 0 0 3 4 01D5 1024KB AMD 29F080 0 0 4 4 01D5 1024KB AMD 29F080 0 0 show (Flash file system) CF-577 Cisco IOS Configuration Fundamentals Command Reference April 2010 See Table 50 for a description of the fields. The show flash: err command also displays two extra fields: erase and write. The erase field indications the number of erase errors. The write field indicates the number of write errors. The following is sample output from the show flash summary command on a router with Flash memory partitioned. The partition in the Read Only state is the partition from which the Cisco IOS image is being executed. Router# show flash summary System flash partition information: Partition Size Used Free Bank-Size State Copy-Mode 1 4096K 2048K 2048K 2048K Read Only RXBOOT-FLH 2 4096K 2048K 2048K 2048K Read/Write Direct Related Commands Command Description more Displays the contents of any file in the Cisco IOS File System. show aliases CF-578 Cisco IOS Configuration Fundamentals Command Reference April 2010 show aliases To display all alias commands, or the alias commands in a specified mode, use the show aliases command in EXEC mode. show aliases [mode] Syntax Description Command Modes EXEC Command History Usage Guidelines When used without the mode argument, this command will display all aliases currently configured on the system. Use the mode argument to display only the aliases configured for the specified command mode. To display a list of the command mode keywords available for your system, use the show aliases ? command. The following is sample output from the show aliases exec commands. The aliases configured for commands in EXEC mode are displayed. Router> show aliases exec Exec mode aliases: h help lo logout p ping r resume s show w where Related Commands mode (Optional) Name of a specific command or configuration mode. Specifies that only aliases configured for this mode should be displayed. Release Modification 10.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description alias Creates a command alias. show alignment CF-579 Cisco IOS Configuration Fundamentals Command Reference April 2010 show alignment To display alignment errors and spurious memory access errors, use the show alignment command in privileged EXEC mode. show alignment Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Usage Guidelines Alignment Errors Alignment errors are caused by misaligned reads and writes. For example, a two-byte read where the memory address is not an even multiple of two bytes is an alignment error. Alignment errors are caused by a software defect. Alignment errors are reported in the system log and recorded by the router. Output from the show alignment command provides a record of these errors along with potentially useful traceback information. The traceback information for alignment errors can generally be decoded to reveal the function causing the alignment problems. Spurious Memory Access Errors Spurious memory access errors occur when a software process attempts to access memory in a restricted location. A read operation to this region of memory is usually caused when a nonexisting value is returned to a function in the software, or in other words, when a null pointer is passed to a function. Spurious memory access errors are counted and recorded, if possible, by the software. This information is displayed with the show alignment command. Examples The following is sample output from the show alignment command when alignment detection is disabled. To enable alignment detection, use the enable command to enter privileged EXEC mode Router# show alignment Unaligned handler is disabled Router# The following is sample output from the show alignment command when there are no alignment or spurious memory errors: Router# show alignment Release Modification 12.3(7)T This command was introduced. 12.2(22)S This command was integrated into Cisco IOS Release 12.2(22)S. 12.2(18)SXE This command was integrated into Cisco IOS Release 12.2(18)SXE. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show alignment CF-580 Cisco IOS Configuration Fundamentals Command Reference April 2010 No alignment data has been recorded. No spurious memory references have been recorded. Router# The following is sample output from the show alignment command when there are only alignment errors. The traceback information is necessary to determine the cause and the fix of the alignment errors. Router# show alignment Total Corrections 134, Recorded 1, Reads 134, Writes 0 Initial Initial Address Count Access Type Traceback 1A014C5 134 32bit read 0x6012F538 0x601338F8 0x601344D8 0x6022D528 No spurious memory references have been recorded. Router# Table 51 describes the significant fields shown in the display. The following is sample output from the show alignment command when there are only spurious memory access errors: Router# show alignment No alignment data has been recorded. Total Spurious Accesses 50, Recorded 3 Address Count Traceback E 10 0x605351A0 0x603CA084 0x606C4060 0x606D6368 0x60743284 0x60743270 E 20 0x605351A0 0x6036EE7C 0x606C4060 0x606D6368 0x60743284 0x60743270 E 20 0x605351A0 0x603C998C 0x606D53EC 0x606C4060 0x606D6368 0x60743284 Router# Table 52 describes the significant fields shown in the display. Table 51 show alignment Field Descriptions Field Description Total Corrections Total number of alignment corrections made. Recorded Number of alignment entries. Reads Number of misaligned reads. Writes Number of misaligned writes. Initial Address Address of where the alignment error occurred. Count Number of times the alignment occurred at this address. Initial Access Address of where the alignment error occurred. Type Type of alignment error: read or write. Traceback The traceback address information necessary to determine the cause of the misalignment. show alignment CF-581 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following is sample output from the show alignment command when there are alignment errors and spurious memory access errors: Router# show alignment Total Corrections 134, Recorded 1, Reads 134, Writes 0 Initial Initial Address Count Access Type Traceback 1A014C5 134 32bit read 0x6012F538 0x601338F8 0x601344D8 0x6022D528 Total Spurious Accesses 50, Recorded 3 Address Count Traceback E 10 0x605351A0 0x603CA084 0x606C4060 0x606D6368 0x60743284 0x60743270 E 20 0x605351A0 0x6036EE7C 0x606C4060 0x606D6368 0x60743284 0x60743270 E 20 0x605351A0 0x603C998C 0x606D53EC 0x606C4060 0x606D6368 0x60743284 x60743270 Related Commands Table 52 show alignment Field Descriptions for Spurious Memory Access Errors Field Description Total Spurious Accesses Total number of spurious memory accesses made. Recorded Number of recorded spurious memory access entries. Address Address at which the spurious memory access error occurred. Count Number of times the spurious memory access occurred at each address. The sum equals the Total Spurious Accesses. Traceback The traceback address information necessary to determine the cause of the misalignment. Command Description enable To enter privileged EXEC mode, or any other security level set by a system administrator, use the enable command in user EXEC or privileged EXEC mode. show archive CF-582 Cisco IOS Configuration Fundamentals Command Reference April 2010 show archive To display information about the files saved in the Cisco IOS configuration archive, use the show archive command in privileged EXEC mode. show archive Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Examples The following is sample output from the show archive command: Router# show archive There are currently 1 archive configurations saved. The next archive file will be named disk0:myconfig-2 Archive # Name 0 1 disk0:myconfig-1 <- Most Recent 2 3 4 5 6 7 8 9 10 11 12 13 14 The following is sample output from the show archive command after several archive files of the running configuration have been saved. In this example, the maximum number of archive files to be saved is set to three. Router# show archive There are currently 3 archive configurations saved. Release Modification 12.3(7)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(31)SB2 This command was implemented on the Cisco 10000 series. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. show archive CF-583 Cisco IOS Configuration Fundamentals Command Reference April 2010 The next archive file will be named disk0:myconfig-8 Archive # Name 0 1 :Deleted 2 :Deleted 3 :Deleted 4 :Deleted 5 disk0:myconfig-5 6 disk0:myconfig-6 7 disk0:myconfig-7 <- Most Recent 8 9 10 11 12 13 14 Table 53 describes the significant fields shown in the displays. Related Commands Table 53 show archive Field Descriptions Field Description Archive # Indicates the number of the running configuration file saved to the Cisco IOS configuration archive. You can set the maximum number of archive files of the running configuration to be saved in the configuration archive. The most recent archive file is the last one shown in the display. Name Indicates the name of the running configuration file saved to the Cisco IOS configuration archive. Command Description archive config Saves a copy of the current running configuration to the Cisco IOS configuration archive. configure confirm Confirms replacement of the current running configuration with a saved Cisco IOS configuration file. configure replace Replaces the current running configuration with a saved Cisco IOS configuration file. maximum Sets the maximum number of archive files of the running configuration to be saved in the Cisco IOS configuration archive. path Specifies the location and filename prefix for the files in the Cisco IOS configuration archive. time-period Sets the time increment for automatically saving an archive file of the current running configuration in the Cisco IOS configuration archive. show archive config differences CF-584 Cisco IOS Configuration Fundamentals Command Reference April 2010 show archive config differences To perform a line-by-line comparison of any two configuration files (accessible through the Cisco IOS File System [IFS]) and generate a list of the differences between them, use the show archive config differences command in user EXEC or privileged EXEC mode. show archive config differences [filename1(path)[filename2(path)][ignorecase]] Syntax Description Command Default If the filename1(path) and filename2(path) arguments are not specified, the first configuration file is assumed to be the running configuration file and the second to be the startup configuration file. If only the filename1(path) argument is specified, the second configuration file is assumed to be the running configuration file. Command Modes User EXEC Privileged EXEC Command History Usage Guidelines Interpreting the output of the show archive config differences command is dependent on the order in which the two files are configured. Each entry in the generated output list is prefixed with a unique text symbol to indicate the type of difference found. The text symbols and their meanings are as follows: • A minus symbol (-) indicates that the configuration line exists in filename1(path) but not in filename2(path). filename1(path) (Optional) The filename (path) of the first configuration file. Can be files in the following locations: bootflash:, cns:, fpd:, ftp:, harddisk:, http:, https:, null:, nvram:, obfl:, pram:, rcp:, revrcsf:, scp:, stby-bootflash:, stby-harddisk:, stby-nvram:, stby-obfl:, stby-rcsf:, stby-usb0:, stby-usb1:, system:, tar:, tftp:, tmpsys:, usb0: filename2(path) (Optional) The filename of the second configuration file. Can be files in the following locations: bootflash:, cns:, fpd:, ftp:, harddisk:, http:, https:, null:, nvram:, obfl:, pram:, rcp:, revrcsf:, scp:, stby-bootflash:, stby-harddisk:, stby-nvram:, stby-obfl:, stby-rcsf:, stby-usb0:, stby-usb1:, system:, tar:, tftp:, tmpsys:, usb0: ignorecase (Optional) Indicates that the case of the filenames should be ignored. Release Modification 12.3(4)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(27)SBC This command was integrated into Cisco IOS Release 12.2(27)SBC. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. show archive config differences CF-585 Cisco IOS Configuration Fundamentals Command Reference April 2010 • A plus symbol (+) indicates that the configuration line exists in filename2(path) but not in filename1(path). • An exclamation point (!) with descriptive comments is used to identify order-sensitive configuration lines whose location is different in filename1(path) than in filename2(path). Examples In this example, a diff operation is performed on the running and startup configuration files. Table 54 shows the configuration files used for this example. The following is sample output from the show archive config differences command. This sample output displays the results of the diff operation performed on the configuration files in Table 54. Router# show archive config differences running-config startup-config +ip subnet-zero +ip name-server 10.4.4.4 +voice dnis-map 1 +dnis 111 interface Ethernet1/0 +no ip address +shutdown +ip default-gateway 10.5.5.5 +ip classless +access-list 110 deny ip any host 10.1.1.1 +access-list 110 deny ip any host 10.1.1.2 +access-list 110 deny ip any host 10.1.1.3 +snmp-server community private RW -no ip subnet-zero interface Ethernet1/0 -ip address 10.7.7.7 255.0.0.0 -no ip classless -snmp-server community public RO Related Commands Table 54 Configuration Files Used for the Diff Operation Example Running Configuration File Startup Configuration File no ip subnet-zero ip cef interface Ethernet1/0 ip address 10.7.7.7 255.0.0.0 no ip route-cache no ip mroute-cache duplex half no ip classless snmp-server community public RO ip subnet-zero ip cef ip name-server 10.4.4.4 voice dnis-map 1 dnis 111 interface Ethernet1/0 no ip address no ip route-cache no ip mroute-cache shutdown duplex half ip default-gateway 10.5.5.5 ip classless access-list 110 deny ip any host 10.1.1.1 access-list 110 deny ip any host 10.1.1.2 access-list 110 deny ip any host 10.1.1.3 snmp-server community private RW show archive config differences CF-586 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Description more nvram:startup-config Displays the startup configuration file contained in NVRAM or specified by the CONFIG_FILE environment variable. more system:running-config Displays the contents of the currently running configuration file. show archive config incremental-diffs Performs a line-by-line comparison of a specified configuration file to the running configuration file and generates a list of the configuration lines that do not appear in the running configuration file. show archive config incremental-diffs CF-587 Cisco IOS Configuration Fundamentals Command Reference April 2010 show archive config incremental-diffs To perform a line-by-line comparison of a specified configuration file to the running configuration file and generate a list of the configuration lines that do not appear in the running configuration file, use the show archive config incremental-diffs command in user EXEC or privileged EXEC mode. show archive config incremental-diffs file Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines When an incremental diff operation is performed, a list of the configuration lines that do not appear in the running configuration file (in other words, configuration lines that only appear in the specified file that is being compared to the running configuration file) is generated as output. An exclamation point (!) with descriptive comments is used to identify order-sensitive configuration lines whose location is different in the specified configuration file than in the running configuration file. Examples In this example, an incremental diff operation is performed on the startup and running configuration files. Table 55 shows the configuration files used for this example. file The filename of the configuration file to be compared to the running configuration file. Release Modification 12.3(4)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(27)SBC This command was integrated into Cisco IOS Release 12.2(27)SBC. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. show archive config incremental-diffs CF-588 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following is sample output from the show archive config incremental-diffs command. This sample output displays the results of the incremental diff operation performed on the configuration files in Table 55. Router# show archive config incremental-diffs nvram:startup-config ip subnet-zero ip name-server 10.4.4.4 voice dnis-map 1 dnis 111 interface Ethernet1/0 no ip address shutdown ip default-gateway 10.5.5.5 ip classless access-list 110 deny ip any host 10.1.1.1 access-list 110 deny ip any host 10.1.1.2 access-list 110 deny ip any host 10.1.1.3 snmp-server community private RW Related Commands Table 55 Configuration Files Used for the Incremental Diff Operation Example Startup Configuration File Running Configuration File ip subnet-zero ip cef ip name-server 10.4.4.4 voice dnis-map 1 dnis 111 interface Ethernet1/0 no ip address no ip route-cache no ip mroute-cache shutdown duplex half ip default-gateway 10.5.5.5 ip classless access-list 110 deny ip any host 10.1.1.1 access-list 110 deny ip any host 10.1.1.2 access-list 110 deny ip any host 10.1.1.3 snmp-server community private RW no ip subnet-zero ip cef interface Ethernet1/0 ip address 10.7.7.7 255.0.0.0 no ip route-cache no ip mroute-cache duplex half no ip classless snmp-server community public RO Command Description more nvram:startup-config Displays the startup configuration file contained in NVRAM or specified by the CONFIG_FILE environment variable. more system:running-config Displays the contents of the currently running configuration file. show archive config differences Performs a line-by-line comparison of any two configuration files (accessible through the IFS) and generates a list of the differences between them. show archive config rollback timer CF-589 Cisco IOS Configuration Fundamentals Command Reference April 2010 show archive config rollback timer To display settings of the timed rollback, use the show archive config rollback timer command in privileged EXEC mode. show archive config rollback timer Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC (#) Command History Usage Guidelines Use the show archive config rollback timer command to display the timed rollback settings, such as the timer type (idle timer or absolute timer) and timer value, after a timed rollback is configured on a router. Examples The following is sample output from the show archive config rollback timer command: Router# show archive config rollback timer Time configured(or reconfigured): 22:50:48 UTC Sat Feb 21 2009 Timer type: absolute timer Timer value: 2 min User: console Table 56 describes the significant fields shown in the display. Release Modification 12.4(15)T This command was introduced in Cisco IOS Release12.4(15)T. 12.2(33)SRC This command was integrated into a release earlier than Cisco IOS Release 12.2(33)SRC. 12.2(33)SXI This command was integrated into a release earlier than Cisco IOS Release 12.2(33)SXI. Cisco IOS XE Release 2.1 This command was integrated into Cisco IOS XE Release 2.1. Table 56 show archive config rollback timer Field Descriptions Field Description Time configured (or reconfigured) The time at which the timer refreshes every time the Enter key is pressed. Timer type The type of the timer: Idle or absolute. Timer value Displays the time, in minutes, for which to wait for confirmation. User Displays the username. show archive config rollback timer CF-590 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description configure revert Cancels the timed rollback and trigger the rollback immediately or resets parameters for the timed rollback. configure terminal revert timer Enter global configuration mode and sets the parameters for reverting the configuration if confirmation of the new configuration is not received. show archive log config CF-591 Cisco IOS Configuration Fundamentals Command Reference April 2010 show archive log config To display entries from the configuration log, use the show archive log config command in privileged EXEC mode. show archive log config {all | record-number [end-number] | user username [session session-number] record-number [end-number] | statistics} [provisioning] [contenttype {plaintext | xml}] [persistent] Syntax Description Command Modes Privileged EXEC Command History all Displays all configuration log entries. record-number [end-number] Displays the log entry by record number. If you specify a record number for the optional end-number argument, all log entries with record numbers between the values entered for the record-number and end-number arguments are displayed. Valid values for the record-number and end-number arguments range from 1 to 2147483647. user username Displays log entries attributed to a particular user. session session-number (Optional) Displays log entries attributed to a particular session. Valid values for the session-number argument range from 1 to 1000. statistics Displays memory usage information for the configuration log. provisioning (Optional) Displays configuration log file information as it would appear in a configuration file, rather than in tabular format. contenttype (Optional) Specifies the format for the display of configuration change results. plaintext Specifies that the configuration change results will be formatted as plain text. This keyword appears only if the contenttype keyword has been entered. xml Specifies that the configuration change results will be in eXtensible Markup Language (XML) format. This keyword appears only if the contenttype keyword has been entered. persistent (Optional) Displays the persistent configuration changes in a configlet format. Release Modification 12.3(4)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(27)SBC This command was integrated into Cisco IOS Release 12.2(27)SBC. 12.2(33)SRA The contenttype, plaintext, xml, and persistent keywords were added. 12.4(11)T This command was integrated into Cisco IOS Release 12.4(11)T. show archive log config CF-592 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines If you do not specify the all keyword, you must specify a record number with the record-number argument. You can optionally specify an end record number with the end-number argument to display a range of records. If you use the end-number argument to specify a record number that does not exist, all records after the starting record number with a record number lower than that specified with the end-number argument are displayed. Specifying the provisioning keyword results in the display appearing as it would in a configuration file, rather than in tabular format. This output includes commands used to change configuration modes and logged configuration commands. This output can be used to set up another router if desired. Examples The following is sample output from the show archive log config command, which displays configuration log entry numbers 1 and 2: Router# show archive log config 1 2 idx sess user@line Logged command 1 1 user1@console logging enable 2 1 user1@console logging size 200 Table 57 describes the significant fields shown in the display. The following example results in the display of all configuration log files as they would appear in a configuration file rather than in tabular format. In addition to displaying logged commands, the example shows the commands used to change configuration modes that are required to correctly apply the logged commands. Router# show archive log config all provisioning archive log config logging enable logging size 200 The following example results in the display of memory usage statistics for the configuration log: Router# show archive log config statistics 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.2(33)SB This command with syntax updated in 12.2(33)SRA was integrated into Cisco IOS Release 12.2(33)SB. This command was implemented on the Cisco 10000 series. Release Modification Table 57 show archive log config Field Descriptions Field Description idx The record number of the configuration log entry. sess The session number associated with the configuration log entry. user@line The username of the user who executed the command that generated the configuration log entry. Logged command The command that was executed. show archive log config CF-593 Cisco IOS Configuration Fundamentals Command Reference April 2010 Config Log Session Info: Number of sessions being tracked: 1 Memory being held: 3910 bytes Total memory allocated for session tracking: 3910 bytes Total memory freed from session tracking: 0 bytes Config Log log-queue Info: Number of entries in the log-queue: 3 Memory being held in the log-queue: 671 bytes Total memory allocated for log entries: 671 bytes Total memory freed from log entries:: 0 bytes The output is self-explanatory. The following example shows the contents of the archive log in XML format: Router# show archive log config all contenttype xml jdoe con_0 2003-04-23T20:25:19.847Z begin test test1 jdoe con_0 2003-04-23T20:27:19.847Z interface e0 PRC_CHANGE interface e0 jdoe show archive log config CF-594 Cisco IOS Configuration Fundamentals Command Reference April 2010 con_0 2003-04-23T20:28:19.847Z interface e0 ip address 10.1.1.1 255.255.255.0 PRC_CHANGE ip address 10.1.1.1 255.255.255.0 jdoe con_0 2003-04-23T20:29:19.847Z end test test1 show async bootp CF-595 Cisco IOS Configuration Fundamentals Command Reference April 2010 show async bootp To display the extended BOOTP request parameters that have been configured for asynchronous interfaces, use the show async bootp command in privileged EXEC mode. show async bootp Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Examples The following is sample output from the show async bootp command: Router# show async bootp The following extended data will be sent in BOOTP responses: bootfile (for address 192.168.1.1) “pcboot” bootfile (for address 172.16.1.111) “dirtboot” subnet-mask 255.255.0.0 time-offset -3600 time-server 192.168.1.1 Table 58 describes the significant fields shown in the display. Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 58 show async bootp Field Descriptions Field Description bootfile... “pcboot” Boot file for address 192.168.1.1 is named pcboot. subnet-mask 255.255.0.0 Subnet mask. time-offset -3600 Local time is one hour (3600 seconds) earlier than UTC time. time-server 192.168.1.1 Address of the time server for the network. Command Description async-bootp Configures extended BOOTP requests for asynchronous interfaces as defined in RFC 1084. show autoupgrade configuration unknown CF-596 Cisco IOS Configuration Fundamentals Command Reference April 2010 show autoupgrade configuration unknown To display all of the unknown start-up configuration lines that the auto-upgraded Cisco IOS software image does not understand, use the show autoupgrade configuration unknown command in privileged EXEC mode. show autoupgrade configuration unknown Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC (#) Command History Usage Guidelines Use the show autoupgrade configuration unknown command to view any invalid start-up configuration. This command prints invalid start-up configuration data only when run from an an image which was upgraded using the Auto-Upgrade Manager. This command output is useful when you are upgrading to an image with a different feature set. Examples The following example shows how to view the invalid start-up configuration lines that the Cisco IOS software image, upgraded on the router using AUM, does not understand: Router# show autoupgrade configuration unknown ! Config Lines not understood by the current image: voice-card 0 no dspfarm crypto pki trustpoint aum_cisco_ca enrollment terminal revocation-check none crypto pki certificate chain aum_cisco_ca certificate ca 40DCB71E54EE24CBE5326F8006BBA4F6 nvram:SecureServer#A4F6CA.cer no ip http secure-server transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh Total 9 Invalid Config Lines Router# Related Commands Release Modification 12.4(15)T This command was introduced. Command Description upgrade automatic abortversion Cancels a scheduled reloading of the device with a new Cisco IOS software image. show autoupgrade configuration unknown CF-597 Cisco IOS Configuration Fundamentals Command Reference April 2010 upgrade automatic getversion Downloads a Cisco IOS software image directly from www.cisco.com or from a non-Cisco server. upgrade automatic runversion Reloads the device with a new Cisco IOS software image. Command Description show bootflash: CF-598 Cisco IOS Configuration Fundamentals Command Reference April 2010 show bootflash: To display information about the bootflash: file system, use the show bootflash: command in user EXEC or privileged EXEC mode. show bootflash: [all | chips | filesys] Syntax Description Defaults This command has no default settings. Command Modes User EXEC Privileged EXEC Command History Examples This example shows how to display information about the file system status: Router> show bootflash: filesys -------- F I L E S Y S T E M S T A T U S -------- Device Number = 0 DEVICE INFO BLOCK: bootflash Magic Number = 6887635 File System Vers = 10000 (1.0) Length = 1000000 Sector Size = 40000 Programming Algorithm = 39 Erased State = FFFFFFFF File System Offset = 40000 Length = F40000 MONLIB Offset = 100 Length = C628 Bad Sector Map Offset = 3FFF8 Length = 8 Squeeze Log Offset = F80000 Length = 40000 Squeeze Buffer Offset = FC0000 Length = 40000 Num Spare Sectors = 0 Spares: STATUS INFO: Writable NO File Open for Write Complete Stats No Unrecovered Errors No Squeeze in progress USAGE INFO: Bytes Used = 917CE8 Bytes Available = 628318 Bad Sectors = 0 Spared Sectors = 0 all (Optional) Displays all possible Flash information. chips (Optional) Displays information about the Flash chip. filesys (Optional) Displays information about the file system. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show bootflash: CF-599 Cisco IOS Configuration Fundamentals Command Reference April 2010 OK Files = 2 Bytes = 917BE8 Deleted Files = 0 Bytes = 0 Files w/Errors = 0 Bytes = 0 Router> This example shows how to display image information: Router> show bootflash: -#- ED --type-- --crc--- -seek-- nlen -length- -----date/time------ name 1 .. image 8C5A393A 237E3C 14 2063804 Aug 23 1999 16:18:45 c6msfc-boot-mz 2 .. image D86EE0AD 957CE8 9 7470636 Sep 20 1999 13:48:49 rp.halley Router> This example shows how to display all bootflash information: Router> show bootflash: all -#- ED --type-- --crc--- -seek-- nlen -length- -----date/time------ name 1 .. image 8C5A393A 237E3C 14 2063804 Aug 23 1999 16:18:45 c6msfc-bootmz 2 .. image D86EE0AD 957CE8 9 7470636 Sep 20 1999 13:48:49 rp.halley 6456088 bytes available (9534696 bytes used) -------- F I L E S Y S T E M S T A T U S -------- Device Number = 0 DEVICE INFO BLOCK: bootflash Magic Number = 6887635 File System Vers = 10000 (1.0) Length = 1000000 Sector Size = 40000 Programming Algorithm = 39 Erased State = FFFFFFFF File System Offset = 40000 Length = F40000 MONLIB Offset = 100 Length = C628 Bad Sector Map Offset = 3FFF8 Length = 8 Squeeze Log Offset = F80000 Length = 40000 Squeeze Buffer Offset = FC0000 Length = 40000 Num Spare Sectors = 0 Spares: STATUS INFO: Writable NO File Open for Write Complete Stats No Unrecovered Errors No Squeeze in progress USAGE INFO: Bytes Used = 917CE8 Bytes Available = 628318 Bad Sectors = 0 Spared Sectors = 0 OK Files = 2 Bytes = 917BE8 Deleted Files = 0 Bytes = 0 Files w/Errors = 0 Bytes = 0 Router> Related Commands Command Description delete Marks files on bootflash for deletion. squeeze Removes files from bootflash that have been marked for deletion. show bootvar CF-600 Cisco IOS Configuration Fundamentals Command Reference April 2010 show bootvar To display the contents of the BOOT variable, the name of the configuration file pointed to by the CONFIG_FILE variable, the contents of the BOOTLDR variable, and the configuration register setting, use the show bootvar command in user EXEC or privileged EXEC mode. show bootvar Syntax Description This command has no arguments or keywords. Command Modes User EXEC Privileged EXEC Command History Usage Guidelines Supported Platforms Other than the Cisco 7600 Series Router The show bootvar command replaces the show boot command. The show bootvar command allows you to view the current settings for the following variables: • BOOT • CONFIG_FILE • BOOTLDR The BOOT variable specifies a list of bootable images on various devices. The CONFIG_FILE variable specifies the configuration file used during system initialization. The BOOTLDR variable specifies the flash device and filename containing the rxboot image that ROM uses for booting. You set these variables with the boot system, boot config, and boot bootldr global configuration commands, respectively. When you use this command on a device with multiple Route Switch Processor (RSP) cards (Dual RSPs), this command also shows you the variable settings for both the master and slave RSP card. Cisco 7600 Series Router The show bootvar command displays information about the BOOT environmental variable. The command output depends on how you configure the boot statement as follows: • If you enter the boot system flash bootflash:sup720_image command in the boot configuration, then the show bootvar command output displays the bootflash information. Release Modification 11.3 AA This command was introduced. 12.2(14)SX Support for this command was implemented on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was integrated into Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show bootvar CF-601 Cisco IOS Configuration Fundamentals Command Reference April 2010 • If you enter the boot system flash sup-bootflash:sup720_image command in the boot configuration, then the show bootvar command output displays the sup-bootflash information. This action is the correct way of configuring the boot statement. The show bootvar command is available from the switch processor command-line interface (CLI) and the route processor CLI. From the switch processor CLI, the display is always bootflash. With either the bootflash or the sup-bootflash boot statement, the switch boots correctly. You should use sup-bootflash in the boot configuration statement because the image is stored in the switch processor bootflash; the route processor sees the image as sup-bootflash. The number displayed after the image name (for example, c6sup12-js-mz.121-13.E,12) indicates the number of times that the Cisco 7600 series router tries to reboot the file before giving up. Examples Supported Platforms Other than the Cisco 7600 Series Router The following is sample output from the show bootvar command: Router# show bootvar BOOT variable = CONFIG_FILE variable = nvram: Current CONFIG_FILE variable = slot0:router-config BOOTLDR variable not exist Configuration register is 0x0 In this example, the BOOT variable contains a null string; that is no bootable images are specified. The CONFIG_FILE variable points to the configuration file in NVRAM as the startup (initialization) configuration. The run-time value for the CONFIG_FILE variable points to the router-configuration file on the flash memory card inserted in the first slot of the RSP card. That is, during the run-time configuration, you have modified the CONFIG_FILE variable using the boot config command, but you have not saved the run-time configuration to the startup configuration. To save your run-time configuration to the startup configuration, use the copy system:running-config nvram:startup-config command. If you do not save the run-time configuration to the startup configuration, then the system reverts to the saved CONFIG_FILE variable setting for initialization information upon reload. In this sample, the system reverts to NVRAM for the startup configuration file. The BOOTLDR variable does not yet exist. That is, you have not created the BOOTLDR variable using the boot bootldr global configuration command. The following example is output from the show bootvar command for a Cisco 7513 router configured for high system availability (HSA): Router# show bootvar BOOT variable = CONFIG_FILE variable = Current CONFIG_FILE variable = BOOTLDR variable does not exist Configuration register is 0x0 current slave is in slot 7 BOOT variable = CONFIG_FILE variable = BOOTLDR variable does not exist Configuration register is 0x0 show bootvar CF-602 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 59 describes the significant fields shown in the displays. Cisco 7600 Series Router This example shows how to display information about the BOOT environment variable: Router# show bootvar BOOT variable = sup-bootflash:c6sup12-js-mz.121-13.E,12 CONFIG_FILE variable = BOOTLDR variable = bootflash:c6msfc2-boot-mz.121-13.E.bin Configuration register is 0x2102 Standby is up Standby has 112640K/18432K bytes of memory. Standby BOOT variable = bootflash:c6sup12-js-mz.121-13.E,12 Standby CONFIG_FILE variable = Standby BOOTLDR variable = bootflash:c6msfc2-boot-mz.121-13.E.bin Standby Configuration register is 0x2102 The number displayed after the image name (for example, c6sup12-js-mz.121-13.E,12) indicates the number of times that the Cisco 7600 series router tries to reboot the file before giving up. Related Commands Table 59 show bootvar Field Descriptions Field Description BOOT variable Displays a list of specified bootable images. CONFIG_FILE variable Indicates where to locate the startup (initialization) configuration file. Current CONFIG_FILE variable Identifies the run-time configuration file. BOOTLDR variable Identifies the location of the boot image that ROM uses for booting, if it is specified. Configuration register Specifies router behavior, such as how the router boots, options while booting, and console speed (baud rate for a terminal emulation session). current slave is in slot 7 Indicates the slot where the redundant system is located in HSA configurations. Command Description boot bootldr Specifies the location of the boot image that ROM uses for booting. boot bootstrap Configures the filename that is used to boot a secondary bootstrap image. boot config Specifies the device and filename of the configuration file from which the router configures itself during initialization (startup). boot system Specifies the system image that the router loads at startup. copy Copies a file from source to a destination. show version Displays the configuration of the system hardware, the software version, the names and sources of configuration files, and the boot images. show buffers CF-603 Cisco IOS Configuration Fundamentals Command Reference April 2010 show buffers To display statistics for the buffer pools on the network server when Cisco IOS or Cisco IOS Software Modularity images are running, use the show buffers command in user EXEC or privileged EXEC mode. show buffers [{address hex-address | failures | pool pool-name | processes | {all | assigned [process-id] | free | old | input-interface interface-type interface-number} [pool pool-name]} [dump | header | packet]] Syntax Description Command Default If no options are specified, all buffer pool information is displayed. Command Modes User EXEC (>) Privileged EXEC (#) Command History address (Optional) Displays buffers at a specified address. hex-address (Optional) Address in hexadecimal notation. failures (Optional) Displays buffer allocation failures. pool (Optional) Displays buffers in a specified buffer pool. pool-name (Optional) Name of buffer pool. processes (Optional) For Cisco IOS Software Modularity images only. Displays buffers connected to Packet Manager. all (Optional) Displays all buffers. assigned (Optional) Displays the buffers in use. process-id (Optional) For Cisco IOS Software Modularity images only. POSIX process identifier. free (Optional) Displays the buffers available for use. old (Optional) Displays buffers older than one minute. input-interface (Optional) Displays interface pool information. If an interface type is specified and this interface has its own buffer pool, information for that pool is displayed. interface-type (Optional) Interface type. interface-number (Optional) Interface number. dump (Optional) Displays the buffer header and all data. header (Optional) Displays the buffer header only. packet (Optional) Displays the buffer header and packet data. Release Modification 10.0 This command was introduced. 12.3 The option to filter display output based on specific buffer pools was expanded. show buffers CF-604 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples Example output varies between Cisco IOS software images and Cisco IOS Software Modularity software images. To view the appropriate output, choose one of the following sections: • Cisco IOS Software • Cisco IOS Software Modularity Cisco IOS Software The following is sample output from the show buffers command with no arguments, showing all buffer pool information: Router# show buffers Buffer elements: 398 in free list (500 max allowed) 1266 hits, 0 misses, 0 created Public buffer pools: Small buffers, 104 bytes (total 50, permanent 50): 50 in free list (20 min, 150 max allowed) 551 hits, 0 misses, 0 trims, 0 created Middle buffers, 600 bytes (total 25, permanent 25): 25 in free list (10 min, 150 max allowed) 39 hits, 0 misses, 0 trims, 0 created Big buffers, 1524 bytes (total 50, permanent 50): 49 in free list (5 min, 150 max allowed) 27 hits, 0 misses, 0 trims, 0 created VeryBig buffers, 4520 bytes (total 10, permanent 10): 10 in free list (0 min, 100 max allowed) 0 hits, 0 misses, 0 trims, 0 created Large buffers, 5024 bytes (total 0, permanent 0): 0 in free list (0 min, 10 max allowed) 0 hits, 0 misses, 0 trims, 0 created Huge buffers, 18024 bytes (total 0, permanent 0): 0 in free list (0 min, 4 max allowed) 0 hits, 0 misses, 0 trims, 0 created Interface buffer pools: Ethernet0 buffers, 1524 bytes (total 64, permanent 64): 16 in free list (0 min, 64 max allowed) 48 hits, 0 fallbacks 16 max cache size, 16 in cache Ethernet1 buffers, 1524 bytes (total 64, permanent 64): 16 in free list (0 min, 64 max allowed) 48 hits, 0 fallbacks 16 max cache size, 16 in cache Serial0 buffers, 1524 bytes (total 64, permanent 64): 16 in free list (0 min, 64 max allowed) 48 hits, 0 fallbacks 16 max cache size, 16 in cache Serial1 buffers, 1524 bytes (total 64, permanent 64): 16 in free list (0 min, 64 max allowed) 48 hits, 0 fallbacks 16 max cache size, 16 in cache 12.2(18)SXF4 Two additional fields were added to the output to support Cisco IOS Software Modularity. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Release Modification show buffers CF-605 Cisco IOS Configuration Fundamentals Command Reference April 2010 TokenRing0 buffers, 4516 bytes (total 48, permanent 48): 0 in free list (0 min, 48 max allowed) 48 hits, 0 fallbacks 16 max cache size, 16 in cache TokenRing1 buffers, 4516 bytes (total 32, permanent 32): 32 in free list (0 min, 48 max allowed) 16 hits, 0 fallbacks 0 failures (0 no memory) The following is sample output from the show buffers command with no arguments, showing onlybuffer pool information for Huge buffers. This output shows a highest total of five Huge buffers created five days and 18 hours before the command was issued. Router# show buffers Huge buffers, 18024 bytes (total 5, permanent 0, peak 5 @ 5d18h): 4 in free list (3 min, 104 max allowed) 0 hits, 1 misses, 101 trims, 106 created 0 failures (0 no memory) The following is sample output from the show buffers command with no arguments, showing only buffer pool information for Huge buffers. This output shows a highest total of 184 Huge buffers created one hour, one minute, and 15 seconds before the command was issued. Router# show buffers Huge buffers, 65280 bytes (total 4, permanent 2, peak 184 @ 01:01:15): 4 in free list (0 min, 4 max allowed) 32521 hits, 143636 misses, 14668 trims, 14670 created 143554 failures (0 no memory) The following is sample output from the show buffers command with an interface type and interface number: Router# show buffers Ethernet 0 Ethernet0 buffers, 1524 bytes (total 64, permanent 64): 16 in free list (0 min, 64 max allowed) 48 hits, 0 fallbacks 16 max cache size, 16 in cache Table 60 describes the significant fields shown in the display. Table 60 show buffers (Cisco IOS Software) Field Descriptions Field Description Buffer elements Small structures used as placeholders for buffers in internal operating system queues. Used when a buffer may need to be on more than one queue. free list Total number of the currently unallocated buffer elements. max allowed Maximum number of buffers that are available for allocation. hits Count of successful attempts to allocate a buffer when needed. misses Count of buffer allocation attempts that resulted in growing the buffer pool to allocate a buffer. created Count of new buffers created to satisfy buffer allocation attempts when the available buffers in the pool have already been allocated. show buffers CF-606 Cisco IOS Configuration Fundamentals Command Reference April 2010 Public Buffer Pools Small buffers Buffers that are 104 bytes long. Middle buffers Buffers that are 600 bytes long. Big buffers Buffers that are 1524 bytes long. VeryBig buffers Buffers that are 4520 bytes long. Large buffers Buffers that are 5024 bytes long. Huge buffers Buffers that are 18,024 bytes long. total Total number of this type of buffer. permanent Number of these buffers that are permanent. peak Maximum number of buffers created (highest total) and the time when that peak occurred. Formats include weeks, days, hours, minutes, and seconds. Not all systems report a peak value, which means this field may not display in output. free list Number of available or unallocated buffers in that pool. min Minimum number of free or unallocated buffers in the buffer pool. max allowed Maximum number of free or unallocated buffers in the buffer pool. hits Count of successful attempts to allocate a buffer when needed. misses Count of buffer allocation attempts that resulted in growing the buffer pool in order to allocate a buffer. trims Count of buffers released to the system because they were not being used. This field is displayed only for dynamic buffer pools, not interface buffer pools, which are static. created Count of new buffers created in response to misses. This field is displayed only for dynamic buffer pools, not interface buffer pools, which are static. Interface Buffer Pools total Total number of this type of buffer. permanent Number of these buffers that are permanent. free list Number of available or unallocated buffers in that pool. min Minimum number of free or unallocated buffers in the buffer pool. max allowed Maximum number of free or unallocated buffers in the buffer pool. hits Count of successful attempts to allocate a buffer when needed. fallbacks Count of buffer allocation attempts that resulted in falling back to the public buffer pool that is the smallest pool at least as big as the interface buffer pool. max cache size Maximum number of buffers from the pool of that interface that can be in the buffer pool cache of that interface. Each interface buffer pool has its own cache. These are not additional to the permanent buffers; they come from the buffer pools of the interface. Some interfaces place all of their buffers from the interface pool into the cache. In this case, it is normal for the free list to display 0. Table 60 show buffers (Cisco IOS Software) Field Descriptions (continued) Field Description show buffers CF-607 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco IOS Software Modularity The following is sample output from the show buffers command using a Cisco IOS Modularity image from Cisco IOS Release 12.2(18)SXF4 and later releases. Two new output fields were introduced—Public buffer heads and Temporary buffer heads—and are shown within comments in the following sample output. Router# show buffers Buffer elements: 500 in free list (500 max allowed) 106586 hits, 0 misses, 0 created Public buffer pools: Small buffers, 104 bytes (total 50, permanent 50, peak 54 @ 1d13h): 49 in free list (20 min, 150 max allowed) 54486 hits, 0 misses, 4 trims, 4 created 0 failures (0 no memory) Middle buffers, 600 bytes (total 25, permanent 25, peak 27 @ 1d13h): 25 in free list (10 min, 150 max allowed) 20 hits, 0 misses, 2 trims, 2 created 0 failures (0 no memory) Big buffers, 1536 bytes (total 50, permanent 50): 50 in free list (40 min, 150 max allowed) 6 hits, 0 misses, 0 trims, 0 created 0 failures (0 no memory) VeryBig buffers, 4520 bytes (total 10, permanent 10): 10 in free list (0 min, 100 max allowed) 0 hits, 0 misses, 0 trims, 0 created 0 failures (0 no memory) Large buffers, 5024 bytes (total 0, permanent 0): 0 in free list (0 min, 10 max allowed) 0 hits, 0 misses, 0 trims, 0 created 0 failures (0 no memory) Huge buffers, 18024 bytes (total 1, permanent 0, peak 1 @ 1d13h): 0 in free list (0 min, 4 max allowed) 1 hits, 0 misses, 0 trims, 0 created 0 failures (0 no memory) ! Start of Cisco IOS Software Modularity fields Public buffer headers: Header buffers, 880 bytes (total 1000, peak 142 @ 1d13h): 864 in permanent free list 142 hits, 0 misses Temporary buffer headers: Header buffers, 896 bytes (total 0): 0 in free list 0 hits, 0 misses, 0 trims, 0 created failures Total number of times a buffer creation failed. The failure may have occurred because of a number of different reasons, such as low processor memory, low IOMEM, or no buffers in the pool when called from interrupt context. no memory Number of times there has been low memory during buffer creation. Low or no memory during buffer creation may not necessarily mean that buffer creation failed; memory can be obtained from an alternate resource such as a fallback pool. Table 60 show buffers (Cisco IOS Software) Field Descriptions (continued) Field Description show buffers CF-608 Cisco IOS Configuration Fundamentals Command Reference April 2010 0 failures ! End of Cisco IOS Software Modularity fields Interface buffer pools: Logger Pool buffers, 600 bytes (total 150, permanent 150): 150 in free list (150 min, 150 max allowed) 22 hits, 0 misses Table 61 describes the significant fields shown in the display that are different from the fields in Table 60. Table 61 show buffers (Cisco IOS Software Modularity) Field Descriptions Field Description Public Buffer Headers Header buffers Buffers that are 880 bytes long. total Total number of this type of buffer. permanent free list Number of available or unallocated permanent header buffers. hits Count of successful attempts to allocate a header buffer when needed. misses Count of buffer allocation attempts that resulted in growing the buffer pool in order to allocate a buffer. Temporary Buffer Headers Header buffers Buffers that are 896 bytes long. total Total number of this type of buffer. free list Number of available or unallocated header buffers in that pool. hits Count of successful attempts to allocate a buffer when needed. misses Count of buffer allocation attempts that resulted in growing the buffer pool in order to allocate a buffer. trims Count of buffers released to the system because they were not being used. This field is displayed only for dynamic buffer pools, not interface buffer pools, which are static. created Count of new buffers created in response to misses. This field is displayed only for dynamic buffer pools, not interface buffer pools, which are static. failures Total number of allocation requests that have failed because no buffer was available for allocation; the datagram was lost. Such failures normally occur at interrupt level. show buffers summary CF-609 Cisco IOS Configuration Fundamentals Command Reference April 2010 show buffers summary To display the buffers usage summary for all caller and for all buffer pools, use the show buffers summary command in privileged EXEC mode. show buffers summary Syntax Description This command has no arguments or keywords. Command Default All buffer usage summary information is displayed. Command Modes Privileged EXEC (#) Command History Examples The following is sample output from the show buffers summary command: Router# show buffers summary Pool: Small Non-aligned packet(s): 25 Caller Summary pc = 0x40612F74 count = 37 pc = 0x418D77FC count = 24 pc = 0x418571E0 count = 1 pc = 0x41860488 count = 1 Pool: Medium Non-aligned packet(s): 39 Caller Summary pc = 0x418D77FC count = 38 pc = 0x41860488 count = 1 pc = 0x40612F74 count = 23 Pool: Middle Non-aligned packet(s): 333 Caller Summary pc = 0x418D77FC count = 333 pc = 0x40612F74 count = 2 pc = 0x4049FFD8 count = 3 Pool: Big Non-aligned packet(s): 32078 Caller Summary pc = 0x418D77FC count = 32006 pc = 0x4065FD40 count = 7 pc = 0x409E915C count = 1 pc = 0x40652A58 count = 65 Pool: VeryBig Release Modification 12.2(33)SXI This command was introduced. show buffers summary CF-610 Cisco IOS Configuration Fundamentals Command Reference April 2010 Non-aligned packet(s): 10 Caller Summary pc = 0x418D77FC count = 10 Pool: Large Non-aligned packet(s): 8 Caller Summary pc = 0x418D77FC count = 8 Pool: Huge Non-aligned packet(s): 2 Caller Summary pc = 0x418D77FC count = 2 Table 60 describes the significant fields shown in the display. Related Commands Table 62 show buffers summary Field Descriptions Field Description Non-alligned Indicates the number of packets not alligned to 32 bits PC Specifies who allocated buffer from this pool, for example, small buffer pool, middle buffer pool and so on. Public Buffer Pools Small buffers Buffers that are 104 bytes long. Middle buffers Buffers that are 600 bytes long. Big buffers Buffers that are 1524 bytes long. VeryBig buffers Buffers that are 4520 bytes long. Large buffers Buffers that are 5024 bytes long. Huge buffers Buffers that are 18,024 bytes long. Command Description show buffers Displays statistics for the buffer pools on the network server. show c2600 CF-611 Cisco IOS Configuration Fundamentals Command Reference April 2010 show c2600 To display information for troubleshooting the Cisco 2600 series router, use the show c2600 command in EXEC mode. show c2600 Syntax Description This command has no arguments or keywords. Command Modes EXEC Command History Usage Guidelines The show c2600 command provides complex troubleshooting information that pertains to the platform’s shared references rather than to a specific interface. Examples The following is sample output from the show c2600 command: Router# show c2600 C2600 Platform Information: Interrupts: Assigned Handlers... Vect Handler # of Ints Name 00 801F224C 00000000 Xilinx bridge error interrupt 01 801DE768 0D3EE155 MPC860 TIMER INTERRUPT 02 801E94E0 0000119E 16552 Con/Aux Interrupt 04 801F0D94 00000000 PA Network Management Int Handler 05 801E6C34 00000000 Timebase Reference Interrupt 06 801F0DE4 00002C1A PA Network IO Int Handler 07 801F0EA0 0000015D MPC860 CPM INTERRUPT 14 801F224C 00000000 Xilinx bridge error interrupt IOS Priority Masks... Level 00 = [ EF020000 ] Level 01 = [ EC020000 ] Level 02 = [ E8020000 ] Level 03 = [ E0020000 ] Level 04 = [ E0020000 ] Level 05 = [ E0020000 ] Level 06 = [ C0020000 ] Level 07 = [ 00000000 ] SIU_IRQ_MASK = FFFFFFFF SIEN = EF02xxxx Current Level = 00 Spurious IRQs = 00000000 SIPEND = 0000xxxx Interrupt Throttling: Throttle Count = 00000000 Timer Count = 00000000 Release Modification 11.3 XA This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show c2600 CF-612 Cisco IOS Configuration Fundamentals Command Reference April 2010 Netint usec = 00000000 Netint Mask usec = 000003E8 Active = 0 Configured = 0 Longest IRQ = 00000000 IDMA Status: Requests = 00000349 Drops = 00000000 Complete = 00000349 Post Coalesce Frames = 00000349 Giant = 00000000 Available Blocks = 256/256 ISP Status: Version string burned in chip: "A986122997" New version after next program operation: "B018020998" ISP family type: "2096" ISP chip ID: 0x0013 Device is programmable Table 63 describes the significant fields shown in the display. Table 63 show c2600 Field Descriptions Field Description Interrupts Denotes that the next section describes the status of the interrupt services. Assigned Handlers Denotes a subsection of the Interrupt section that displays data about the interrupt handlers. Vect The processor vector number. Handler The execution address of the handler assigned to this vector. # of Ints The number of times this handler has been called. Name The name of the handler assigned to this vector. IOS Priority Masks Denotes the subsection of the Interrupt section that displays internal Cisco IOS priorities. Each item in this subsection indicates a Cisco IOS interrupt level and the bit mask used to mask out interrupt sources when that Cisco IOS level is being processed. Used exclusively for debugging. SIU_IRQ_MASK For engineering level debug only. Spurious IRQs For engineering level debug only. Interrupt Throttling: This subsection describes the behavior of the Interrupt Throttling mechanism on the platform. Throttle Count Number of times throttle has become active. Timer Count Number of times throttle has deactivated because the maximum masked out time for network interrupt level has been reached. Netint usec Maximum time network level is allowed to run (in microseconds). Netint Mask usec Maximum time network level interrupt is masked out to allow process level code to run (in microseconds). Active Indicates that the network level interrupt is masked or that the router is in interrupt throttle state. Configured Indicates that throttling is enabled or configured when set to 1. show c2600 CF-613 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Longest IRQ Duration of longest network level interrupt (in microseconds). IDMA Status Monitors the activity of the Internal Direct Memory Access (IDMA) hardware and software. Used to coalesce packets (turn particularized packets into non particularized packets) for transfer to the process level switching mechanism. Requests Number of times the IDMA engine is asked to coalesce a packet. Drops Number of times the coalescing operation was aborted. Complete Number of times the operation was successful. Post Coalesce Frames Number of Frames completed post coalesce processing. Giant Number of packets too large to coalesce. Available Blocks Indicates the status of the request queue, in the format N/M where N is the number of empty slots in queue and M is the total number of slots; for example, 2/256 indicates that the queue has 256 entries and can accept two more requests before it is full. ISP Status Provides status of In-System-Programmable (ISP) hardware. Version string burned in chip Current version of ISP hardware. New version after next program operation Version of ISP hardware after next ISP programming operation. ISP family type Device family number of ISP hardware. ISP chip ID Internal ID of ISP hardware as designated by the chip manufacturer. Device is programmable “Yes” or “No.” Indicates if an ISP operation is possible on this board. Table 63 show c2600 Field Descriptions (continued) Field Description Command Description show context Displays information stored in NVRAM when the router crashes. show c7200 CF-614 Cisco IOS Configuration Fundamentals Command Reference April 2010 show c7200 To display information about the CPU and midplane for Cisco 7200 series routers, use the show c7200 command in EXEC mode. show c7200 Syntax Description This command has no arguments or keywords. Command Modes EXEC Command History Usage Guidelines You can use the output of this command to determine whether the hardware version level and upgrade is current. The information is generally useful for diagnostic tasks performed by technical support only. Examples The following is sample output from the show c7200 command: Router# show c7200 C7200 Network IO Interrupt Throttling: throttle count=0, timer count=0 active=0, configured=0 netint usec=3999, netint mask usec=200 C7200 Midplane EEPROM: Hardware revision 1.2 Board revision A0 Serial number 2863311530 Part number 170-43690-170 Test history 0xAA RMA number 170-170-170 MAC=0060.3e28.ee00, MAC Size=1024 EEPROM format version 1, Model=0x6 EEPROM contents (hex): 0x20: 01 06 01 02 AA AA AA AA AA AA AA AA 00 60 3E 28 0x30: EE 00 04 00 AA AA AA AA AA AA AA 50 AA AA AA AA C7200 CPU EEPROM: Hardware revision 2.0 Board revision A0 Serial number 3509953 Part number 73-1536-02 Test history 0x0 RMA number 00-00-00 EEPROM format version 1 EEPROM contents (hex): 0x20: 01 15 02 00 00 35 8E C1 49 06 00 02 00 00 00 00 0x30: 50 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF Release Modification 11.2 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show catalyst6000 CF-615 Cisco IOS Configuration Fundamentals Command Reference April 2010 show catalyst6000 To display the information about the Cisco 7600 series router, use the show catalyst6000 command in user EXEC or privileged EXEC mode. show catalyst6000 {all | chassis-mac-address | switching-clock | traffic-meter} Syntax Description Defaults all Command Modes User EXEC Privileged EXEC Command History Usage Guidelines If you enter the switching-clock keywords, the Cisco 7600 series router displays whether switching of the redundant clock sources on the backplane is allowed if the active clock source fails. The Cisco 7600 series router has either 64 or 1024 MAC addresses that are available to support the software features. You can enter the show catalyst6000 chassis-mac-address command to display the MAC-address range on your chassis. Examples This example shows how to display the MAC-address ranges and the current and peak traffic-meter readings: Router> show catalyst6000 all chassis MAC addresses: 64 addresses from 0001.6441.60c0 to 0001.6441.60ff traffic meter = 0% Never cleared peak = 0% reached at 08:14:38 UTC Wed Mar 19 2003 switching-clock: clock switchover and system reset is allowed Router> This example shows how to display the MAC-address ranges: Router# show catalyst6000 chassis-mac-address all Displays the MAC-address ranges and the current and peak traffic-meter reading. chassis-mac-address Displays the MAC-address range. switching-clock Displays the failure recovery mode of the switching clock. traffic-meter Displays the percentage of the backplane (shared bus) utilization. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show catalyst6000 CF-616 Cisco IOS Configuration Fundamentals Command Reference April 2010 chassis MAC addresses: 1024 addresses from 00d0.004c.1800 to 00d0.004c.1c00 Router# This example shows how to display the current and peak traffic-meter readings: Router> show catalyst6000 traffic-meter traffic meter = 0% peak = 0% at 09:57:58 UTC Mon Nov 6 2000 Router# This example shows how to display the failure recovery mode of the switching clock: Router> show catalyst6000 switching-clock switching-clock: clock switchover and system reset is allowed Router> Related Commands Command Description show environment alarm Displays the information about the environmental alarm. show fm summary Displays a summary of FM Information. show environment status Displays the information about the operational FRU status. show cls CF-617 Cisco IOS Configuration Fundamentals Command Reference April 2010 show cls To display the current status of all Cisco link services (CLS) sessions on the router, use the show cls command in EXEC mode. show cls [brief] Syntax Description Defaults Without the brief keyword, displays complete output. Command Modes EXEC Command History Usage Guidelines The Cisco link service (CLS) is used as the interface between data link users (DLUs), such as DLSw, LAN Network Manager (LNM), downstream physical unit (DSPU), and SNASw, and their corresponding data link circuits (DLCs) such as Logic Link Control (LLC), VDLC, and Qualified Logic Link Control (QLLC). Each DLU registers a particular service access point (SAP) with CLS, and establishes circuits through CLS over the DLC. The show cls command displays the SAP values associated with the DLU and the circuits established through CLS. For further information about CLS, use the Release 12.2 Cisco IOS Bridging and IBM Networking Configuration Guide. Examples The following is sample output from the show cls command: IBD-4500B# show cls DLU user:SNASW SSap:0x04 VDLC VDLC650 DTE:1234.4000.0001 1234.4000.0002 04 04 T1 timer:0 T2 timer:0 Inact timer:0 max out:0 max in:0 retry count:10 XID retry:10 XID timer:5000 I-Frame:0 flow:0 DataIndQ:0 DataReqQ:0 DLU user:DLSWDLUPEER DLU user:DLSWDLU Bridging VDLC VDLC1000 Bridging VDLC VDLC650 The following is sample output from the show cls brief command: brief (Optional) Displays a brief version of the output. Release Modification 11.0 This command was introduced in a release prior to Cisco IOS Release 11.0. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show cls CF-618 Cisco IOS Configuration Fundamentals Command Reference April 2010 IBD-4500B# show cls brief DLU user:SNASW SSap:0x04 VDLC VDLC650 DTE:1234.4000.0001 1234.4000.0002 04 04 DLU user:DLSWDLUPEER DLU user:DLSWDLU Bridging VDLC VDLC1000 Bridging VDLC VDLC650 The examples show two DLUs—SNASw and DLSw—active in the router. SNASw uses a SAP value of 0x04, and the associated DLC port is VDLC650. SNASw has a circuit established between MAC addresses 1234.4000.0001 and 1234.4000.0002 using source and destination SAPs 04 and 04. DLSw is a bridging protocol and uses VDLC1000 and VDLC650 ports. There are no circuits in place at this time. In the output from the show cls command (without the brief argument), the values of timers and counters applicable to this circuit are displayed. Related Commands Command Description stun peer-name Enables STUN for an IP address and uses Cisco Link Services (CLS) to access the Frame Relay network. show config id CF-619 Cisco IOS Configuration Fundamentals Command Reference April 2010 show config id The configuration change tracking identifier (CTID) assigns a version number to each saved version of the running-config file. To display output about the versions, use the show config id command in privileged EXEC mode. show config id [detail] Syntax Description Command Default This command is disabled by default. If this command is not entered, the management system has to query the device for the current running-config file and then compare the results to the last known configuration to determine if a change has been made. Command Modes Privileged EXEC (#) Command History Usage Guidelines This configuration infrastructure command assigns a version number that is updated every time the running-config file is changed. This version number is called the configuration change tracking identifier or CTID. The CTID can be used to compare configuration files to track configuration changes and take appropriate actions (for example, a configuration rollback). Config Logger can also use the CTID to determine if there have been any changes to the running-config file. CTID makes the management system more efficient by presenting information that indicates a change has been made to the running-config file. Without CTID, the management system has to query the device for the current running-config file and then compare the results to the last known configuration to determine if a change has been made. Examples The following example shows that the current running-config file is version 4 and that this file was saved on June 15, 2006 at 7.572 seconds after 3:02 p.m.: Router# show config id version:4 time:2006-06-15T15:02:07.572Z detail (Optional) Expands the output of the command to include the ID of the last user to make a configuration change and the process in which the changes were made. Release Modification 12.2(33)SRC This command was introduced. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. 12.4(20)T This command was integrated into Cisco IOS Release 12.4(20)T. show config id CF-620 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following example shows that the current running-config file is version 9 and that this file was last saved on June 18, 2006 at 34.431 seconds after 6:34 p.m. The file was saved by the system and changed from Init: Router# show config id detail Configuration version : 9 Last change time : 2006-06-18T18:34:34.431Z Changed by user : system Changed from process : Init Field descriptions are self-explanatory. Related Commands Command Description copy running-config startup-config Copies the current running-config file (source) to the startup-config file (destination). show running-config Displays the contents of the currently running configuration file or the configuration for a specific class map, interface, map class, policy map, or virtual-circuit class. show configuration lock CF-621 Cisco IOS Configuration Fundamentals Command Reference April 2010 show configuration lock To display information about the lock status of the running configuration file during a configuration replace operation, use the show configuration lock command in privileged EXEC mode. show configuration lock Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Examples The following is sample output from the show configuration lock command when the running configuration file is locked by another user. Cisco IOS Release 12.2(25)S, Release 12.2(28)SB, Release 12.3(14)T, and Later Releases Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)# configuration mode exclusive ? auto Lock configuration mode automatically manual Lock configuration mode on-demand Router(config)# configuration mode exclusive auto Router(config)# end Router# show running-config | include configuration configuration mode exclusive auto Router# configure terminal !<----------- Acquires the lock Enter configuration commands, one per line. End with CNTL/Z. Release Modification 12.2(25)S This command was introduced. 12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T. The output of this command was updated to display the configuration locking class. 12.0(31)S The command output was enhanced. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(31)SB2 This command was implemented on the Cisco 10000 series. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. show configuration lock CF-622 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router(config)# show configuration lock Parser Configure Lock --------------------- Owner PID : 3 User : unknown TTY : 0 Type : EXCLUSIVE State : LOCKED Class : EXPOSED Count : 1 Pending Requests : 0 User debug info : configure terminal Router(config)# Router(config)# end ! <------------ Releases the lock The following is sample output from the show configuration lock command when the running configuration file is not locked by another user. Router# show configuration lock Parser Configure Lock --------------------- Owner PID : -1 User : unknown TTY : -1 Type : NO LOCK State : FREE Class : unknown Count : 0 Pending Requests : 0 User debug info : Cisco IOS Release 12.0(31)S, 12.2(33)SRA, and Later Releases Router# show configuration lock Parser Configure Lock ------------------------------------------------------ Owner PID : 3 User : unknown TTY : 0 Type : EXCLUSIVE State : LOCKED Class : EXPOSED Count : 1 Pending Requests : 0 User debug info : configure terminal Session idle state : TRUE No of exec cmds getting executed : 0 No of exec cmds blocked : 0 Config wait for show completion : FALSE Remote ip address : Unknown Lock active time (in Sec) : 6 Lock Expiration timer (in Sec) : 593 show configuration lock CF-623 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 64 describes the significant fields shown in the displays. The following example shows how to configure the configuration file for single user auto configuration mode (using the configuration mode exclusive auto command). Use the configure terminal command to enter global configuration mode and lock the configuration mode exclusively. Once the Cisco IOS configuration mode is locked exclusively, you can verify the lock using the show configuration lock command. Router# configure terminal Router(config)# configuration mode exclusive auto Router(config)# end Router# configure terminal Router(config)# show configuration lock Parser Configure Lock Table 64 show configuration lock Field Descriptions Field Description Owner PID Process identifier (PID) of the process that owns the lock. User Owner’s username. TTY Owner’s terminal number. Type Lock type (EXCLUSIVE/COUNTER/NO LOCK). State State of the lock (FREE/LOCKED). Class Classification of users of the lock (EXPOSED/ROLLBACK). Processes other than ROLLBACK belong to the EXPOSED class. Count In the case of a counter lock, total number of processes holding the lock. Pending Requests Total number of processes blocked by the lock. User debug info Any string given by the process (used for debugging only). Session idle state Indicates whether the user in an access session locking session is idle. Displays TRUE or FALSE. No of exec cmds getting executed Total number of EXEC commands (show and clear) being executed simultaneously from different sessions. No of exec cmds blocked Total number of EXEC commands (show and clear) waiting for the configuration command (running from the access session locking session) to complete its execution. Config wait for show completion Indicates whether a configuration command executed in an access session locking session is waiting for the completion of the show command being executed simultaneously from a different session. Displays TRUE or FALSE. Remote ip address IP address of the terminal from which the user telneted to the router. Lock active time (in Sec) Amount of time, in seconds, that elapsed since the lock was acquired. Lock Expiration timer (in Sec) The amount of time, in seconds, that expires before the lock is automatically released. show configuration lock CF-624 Cisco IOS Configuration Fundamentals Command Reference April 2010 Owner PID : 10 User : User1 TTY : 3 Type : EXCLUSIVE State : LOCKED Class : Exposed Count : 0 Pending Requests : 0 User debug info : 0 Related Commands Command Description configuration mode exclusive Enables single-user (exclusive) access functionality for the Cisco IOS CLI. configure replace Replaces the current running configuration with a saved Cisco IOS configuration file. debug configuration lock Enables debugging of the Cisco IOS configuration lock. show context CF-625 Cisco IOS Configuration Fundamentals Command Reference April 2010 show context To display information stored in NVRAM when an unexpected system reload (system exception) occurs, use the show context command in user EXEC or priviledged EXEC mode. show context [summary | all | slot slot-number [crash-index] [all] [debug]] Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines The display from the show context command includes the following information: • Reason for the system reboot • Stack trace • Software version • The signal number, code, and router uptime information • All the register contents at the time of the crash Note This command is primarily for use by Cisco technical support representatives for analyzing unexpected system reloads. summary Displays a summary of all the crashes recorded. all Displays all crashes for all the slots. When optionally used with the slot keyword, displays crash information for the specified slot. slot slot-number [crash-index] Displays information for a particular line card. Slot numbers range from 0 to 11 for the Cisco 12012 router and from 0 to 7 for the Cisco 12008. The index number allows you to look at previous crash contexts. Contexts from the last 24 line card crashes are saved on the GRP card. If the GRP reloads, the last 24 line card crash contexts are lost. For example, show context slot 3 2 shows the second most recent crash for line card in slot 3. Index numbers are displayed by the show context summary command. debug (Optional) Displays crash information as a hex record dump in addition to one of the options listed. Release Modification 10.3 This command was introduced. 11.2 GS The slot slot-number [crash-index] [all] [debug] syntax was added for Cisco 12000 series routers. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show context CF-626 Cisco IOS Configuration Fundamentals Command Reference April 2010 Output for this command will vary by platform. Context information is specific to processors and architectures. For example, context information for the Cisco 2600 series router differs from that for other router types because the Cisco 2600 runs with an M860 processor. Examples The following is sample output from the show context command following a system failure: Router> show context System was restarted by error - a Software forced crash, PC 0x60189354 GS Software (RSP-PV-M), Experimental Version 11.1(2033) [ganesh 111] Compiled Mon 31-Mar-97 13:21 by ganesh Image text-base: 0x60010900, data-base: 0x6073E000 Stack trace from system failure: FP: 0x60AEA798, RA: 0x60189354 FP: 0x60AEA798, RA: 0x601853CC FP: 0x60AEA7C0, RA: 0x6015E98C FP: 0x60AEA7F8, RA: 0x6011AB3C FP: 0x60AEA828, RA: 0x601706CC FP: 0x60AEA878, RA: 0x60116340 FP: 0x60AEA890, RA: 0x6011632C Fault History Buffer: GS Software (RSP-PV-M), Experimental Version 11.1(2033) [ganesh 111] Compiled Mon 31-Mar-97 13:21 by ganesh Signal = 23, Code = 0x24, Uptime 00:04:19 $0 : 00000000, AT : 60930120, v0 : 00000032, v1 : 00000120 a0 : 60170110, a1 : 6097F22C, a2 : 00000000, a3 : 00000000 t0 : 60AE02A0, t1 : 8000FD80, t2 : 34008F00, t3 : FFFF00FF t4 : 00000083, t5 : 3E840024, t6 : 00000000, t7 : 11010132 s0 : 00000006, s1 : 607A25F8, s2 : 00000001, s3 : 00000000 s4 : 00000000, s5 : 00000000, s6 : 00000000, s7 : 6097F755 t8 : 600FABBC, t9 : 00000000, k0 : 30408401, k1 : 30410000 gp : 608B9860, sp : 60AEA798, s8 : 00000000, ra : 601853CC EPC : 60189354, SREG : 3400EF03, Cause : 00000024 Router> The following is sample output from the show context summary command on a Cisco 12012 router. The show context summary command displays a summary of all the crashes recorded for each slot (line card). Router# show context summary CRASH INFO SUMMARY Slot 0 : 0 crashes Slot 1 : 0 crashes Slot 2 : 0 crashes Slot 3 : 0 crashes Slot 4 : 0 crashes Slot 5 : 0 crashes Slot 6 : 0 crashes Slot 7 : 2 crashes 1 - crash at 18:06:41 UTC Tue Nov 5 1996 2 - crash at 12:14:55 UTC Mon Nov 4 1996 Slot 8 : 0 crashes Slot 9 : 0 crashes Slot 10: 0 crashes Slot 11: 0 crashes Router# The following is sample output from the show context command following an unexpected system reload on a Cisco 2600 series router. show context CF-627 Cisco IOS Configuration Fundamentals Command Reference April 2010 router# show context S/W Version: Cisco IOS Software Cisco IOS (tm) c2600 Software (c2600-JS-M), Released Version 11.3(19980115:184921] Copyright (c) 1986-2003 by Cisco Systems, Inc. Compiled Thu 15-Jan-98 13:49 by mmagno Exception occurred at: 00:02:26 UTC Mon Mar 1 1993 Exception type: Data TLB Miss (0x1200) CPU Register Context: PC = 0x80109964 MSR = 0x00009030 CR = 0x55FFFD35 LR = 0x80109958 CTR = 0x800154E4 XER = 0xC000BB6F DAR = 0x00000088 DSISR = 0x00000249 DEC = 0x7FFFDFCA TBU = 0x00000000 TBL = 0x15433FCF IMMR = 0x68010020 R0 = 0x80000000 R1 = 0x80E80BD0 R2 = 0x80000000 R3 = 0x00000000 R4 = 0x80E80BC0 R5 = 0x40800000 R6 = 0x00000001 R7 = 0x68010000 R8 = 0x00000000 R9 = 0x00000060 R10 = 0x00001030 R11 = 0xFFFFFFFF R12 = 0x00007CE6 R13 = 0xFFF379E8 R14 = 0x80D50000 R15 = 0x00000000 R16 = 0x00000000 R17 = 0x00000000 R18 = 0x00000000 R19 = 0x00000000 R20 = 0x00000000 R21 = 0x00000001 R22 = 0x00000010 R23 = 0x00000000 R24 = 0x00000000 R25 = 0x80E91348 R26 = 0x01936010 R27 = 0x80E92A80 R28 = 0x00000001 R29 = 0x019BA920 R30 = 0x00000000 R31 = 0x00000018 Stack trace: Frame 00: SP = 0x80E80BD0 PC = 0x80109958 Frame 01: SP = 0x80E80C28 PC = 0x8010A720 Frame 02: SP = 0x80E80C40 PC = 0x80271010 Frame 03: SP = 0x80E80C50 PC = 0x8025EE64 Frame 04: SP = 0x80DEE548 PC = 0x8026702C Frame 05: SP = 0x80DEE558 PC = 0x8026702C Table 65 describes the significant fields shown in the display. Related Commands Table 65 show context Field Descriptions Field Description S/W Version Standard Cisco IOS version string as displayed. Exception occurred at Router real time when exception occurred. The router must have the clock time properly configured for this to be accurate. Exception type Technical reason for exception. For engineering analysis. CPU Register Context Technical processor state information. For engineering analysis. Stack trace Technical processor state information. For engineering analysis. Command Description show processes Displays information about the active processes. show stacks Monitors the stack usage of processes and interrupt routines. show controllers (GRP image) CF-628 Cisco IOS Configuration Fundamentals Command Reference April 2010 show controllers (GRP image) To display information that is specific to the hardware, use the show controllers command in privileged EXEC mode. show controllers [atm slot-number | clock | csar [register] | csc-fpga | dp83800 | fab-clk | fia [register] | pos [slot-number] [details] | queues [slot-number] | sca | xbar] Syntax Description Command Modes Privileged EXEC atm slot-number (Optional) Displays the ATM controllers. Number is slot-number/ port-number (for example, 4/0). Slot numbers range from 0 to 11 for the Cisco 12012 router and from 0 to 7 for the Cisco 12008 router. clock (Optional) Displays the clock card configuration. csar [register] (Optional) Displays the Cisco Cell Segmentation and Reassembly (CSAR) information. CSAR is the name of the chip on the card that handles traffic between the GRP and the switch fabric interface ASICs. csc-fpga (Optional) Displays the clock and scheduler card register information in the field programmable gate array (FPGA). dp83800 (Optional) Displays the Ethernet information on the GRP card. fab-clk (Optional) Display the switch fabric clock register information. The switch fabric clock FPGA is a chip that monitors the incoming fabric clock generated by the switch fabric. This clock is needed by each card connecting to the switch fabric to properly communicate with it. Two switch fabric clocks arrive at each card; only one can be used. The FPGA monitors both clocks and selects which one to use if only one of them is running. fia [register] (Optional) Displays the fabric interface ASIC information and optionally displays the register information. pos [slot-number] [details] (Optional) Displays the POS framer state and optionally displays all the details for the interface. Number is slot-number/port-number (for example, 4/0). Slot numbers range from 0 to 11 for the Cisco 12012 router and from 0 to 7 for the Cisco 12008 router. queues [slot-number] (Optional) Displays the SDRAM buffer carve information and optionally displays the information for a specific line card. The SDRAM buffer carve information displayed is suggested carve information from the GRP card to the line card. Line cards might change the shown percentages based on SDRAM available. Slot numbers range from 0 to 11 for the Cisco 12012 router and from 0 to 7 for the Cisco 12008. sca (Optional) Displays the SCA register information. The SCA is an ASIC that arbitrates among the line cards requests to use the switch fabric. xbar (Optional) Displays the crossbar register information. The XBAR is an ASIC that switches the data as it passes through the switch fabric. show controllers (GRP image) CF-629 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command History Usage Guidelines This information provided by this command is intended for use only by technical support representatives in analyzing system failures in the field. Examples The following is sample output from the show controllers pos command for a Cisco 12012: Router# show controllers pos 7/0 POS7/0 SECTION LOF = 2 LOS = 0 BIP(B1) = 5889 Active Alarms: None LINE AIS = 2 RDI = 2 FEBE = 146 BIP(B2) = 2106453 Active Alarms: None PATH AIS = 2 RDI = 4 FEBE = 63 BIP(B3) = 3216 LOP = 0 PSE = 8 NSE = 3 NEWPTR = 2 Active Alarms: None APS COAPS = 3 PSBF = 2 State: PSBF_state = False Rx(K1/K2): F0/15 Tx(K1/K2): 00/00 S1S0 = 00, C2 = 64 PATH TRACE BUFFER : STABLE Remote hostname : GSR-C Remote interface: POS10/0 Remote IP addr : 10.201.101.2 Remote Rx(K1/K2): F0/15 Tx(K1/K2): 00/00 Router# Related Commands Release Modification 11.2 GS This command was introduced to support the Cisco 12000 series routers. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description clear controllers Resets the T1 or E1 controller. show controllers (line card image) Displays information that is specific to the hardware on a line card. show controllers (line card image) CF-630 Cisco IOS Configuration Fundamentals Command Reference April 2010 show controllers (line card image) To display information that is specific to the hardware on a line card, use the attach command in privileged EXEC mode to connect to the line card and then use the show controllers command in privileged EXEC mode or the execute-on command in privileged EXEC mode. show controllers atm [[port-number] [all | sar | summary]] show controllers fia [register] show controllers {frfab | tofab} {bma {microcode | ms-inst | register} | qelem start-queue-element [end-queue-element] | qnum start-queue-number [end-queue-number] | queues | statistics} show controllers io show controllers l3 show controllers pos {framers | queues | registers | rxsram port-number queue-start-address [queue-length] | txsram port-number queue-start-address [queue-length]} show controllers events [clear | punt-sniff [none | word1 | word2] | punt-verbose [all]] Syntax Description atm Displays the ATM controller information. port-number (Optional) Displays request for the physical interface on the ATM card. The range of choices is from 0 to 3. all (Optional) Lists all details. sar (Optional) Lists SAR interactive command. summary (Optional) Lists SAR status summary. fia Displays the fabric interface ASIC information. register (Optional) Displays the register information. frfab (Optional) Displays the "from" (transmit) fabric information. tofab (Optional) Displays the "to" (receive) fabric information. bma For the frfab or tofab keywords, displays microcode, micro sequencer, or register information for the silicon queuing engine (SQE), also known as the buffer management ASIC (BMA). microcode Displays SQE information for the microcode bundled in the line card and currently running version. mis-inst Displays SQE information for the micro sequencer instruction. register Displays silicon queuing engine (SQE) information for the register. qelem For the frfab or tofab keywords, displays the SDRAM buffer pool queue element summary information. start-queue-element Specifies the start queue element number from 0 to 65535. end-queue-element (Optional) Specifies the end queue element number from 0 to 65535). show controllers (line card image) CF-631 Cisco IOS Configuration Fundamentals Command Reference April 2010 qnum For the frfab or tofab keywords, displays the SDRAM buffer pool queue detail information. start-queue-number Specifies the start free queue number (from 0 to 127). end-queue-number (Optional) Specifies the end free queue number (from 0 to 127). queues For the frfab or tofab keywords, displays the SDRAM buffer pool information. statistics For the frfab or tofab keywords, displays the BMA counters. io Displays input/output registers. l3 Displays Layer 3 ASIC information. pos Displays packet-over-sonic (POS) information for framer registers, framer queues, and ASIC registers. framers Displays the POS framer registers. queues Displays the POS framer queue information. registers Displays the ASIC registers. rxsram Displays the receive queue SRAM. port-number Specifies a port number (valid range is from 0 to 3). queue-start-address Specifies the queue SRAM logical starting address. queue-length (Optional) Specifies the queue SRAM length. txsram Displays the transmit queue SRAM. events Displays the line card counter information of events generated from line card. clear (Optional) Clears all the line card event counter output details that are displayed using the commands: show controllers events, show controllers events punt-verbose, and show controllers events punt-sniff. punt-sniff (Optional) Sniffs the packets sent to route processor from line card by specifying the word and location. Note Punt sniff is enabled only if one of the word is configured. none (Optional) Clears the attributes and packets to be sniffed from route processor and resets the counters to zero. word1 (Optional) Sniffs packets sent to the route processor for the specified hexa decimal value of word1. Location of the word is optional. word2 (Optional) Sniffs packets sent to the route processor matching the specified hexa decimal value of word2. Location of the word is optional. punt-verbose (Optional) Displays application-wise packets punt to route processor (RP) from line card (LC). Displays non-zero punt counters if the command is executed without the all keyword. all (Optional) Displays zero and non-zero punt counters of packets punt to RP from LC. The all keyword is used along with the command show controllers events punt-verbose all. show controllers (line card image) CF-632 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Modes Privileged EXEC Command History Usage Guidelines This information displayed by this command is of use only to technical support representatives in analyzing unexpected system failures in the field. It is documented here in case you need to provide the displayed statistics to an technical support engineer. Cisco 10000 Series Router Usage Guidelines In releases prior to Cisco IOS Release 12.2(33)SB, when you configure the t1 loopback remote command on the local router, the command also displays in the running-config file of the far-end router. This is due to the route processor (RP) updating an incorrect parameter when it receives the loopback event message from the line card for loopback requests from the far end. In Cisco IOS Release 12.2(33)SB, the RP updates the correct parameter and the show controllers command correctly displays the loopback CLI commands applied on the local end and displays the loopback events and status received from the line card in response to loopback requests from the far end. This change in behavior affects the following line cards and is documented in the CSCsm84447 caveat: • 4-port channelized STM1 • 1-port channelized OC-12 • 6-port channelized T3 • 4-port half-height channelized T3 In Cisco IOS Release 12.2(33)SB, the output from the show controller command includes line code information for the 6-port channelized T3 line card and the 8-port E3/DS3 line card. However, because SONET line cards do not have a direct physical link at the T3 or E3 level, the output from the show controller t3 command does not include line code information. In Cisco IOS Release 12.2(31)SB, the output from the show controller command displays line code information. The output of the show controller t3 command for SONET-based T3 also includes line code information. Cisco 12000 Series Router Usage Guidelines The packets processed by a line card are either sent to a route processor or a line card in the form of Cisco cells. To track the packets sent to a route processor from a line card is essential for troubleshooting. The keywords punt-sniff and punt-verbose have been added for the command show controllers events to identify the packets sent to RP from LC. Release Modification 11.2 GS This command was added to support the Cisco 12000 series Gigabit Switch Routers. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(31)SB This command was integrated in Cisco IOS Release 12.2(31)SB. 12.2(33)SB This command’ behavior was modified on the Cisco 10000 series router for the PRE3 and PRE4. 12.0(33)S The keywords punt-sniff and punt-verbose were added in the command show controllers events for the Cisco 12000 Series Routers. show controllers (line card image) CF-633 Cisco IOS Configuration Fundamentals Command Reference April 2010 By default, the feature is enabled and packets punt to route processor are displayed using the command show controllers events punt-verbose. To view all the zero and non-zero punt counters use the command show controllers events punt-verbose all. To clear all the line card events and counters including resetting the packets to be sniffed to zero, executing the command show controllers events clear. Packets sent to route processor from line card can be sniffed by specifying the hexa-decimal value of the word. Packets can only be sniffed if the word along with the hexa-decimal value is specified. Specifying the location of the word, sniffs packets from the particular location. To reset the counters of packets to be sniffed to zero, execute the command show controllers events punt-sniff none. For example, use the command show controllers events punt-sniff word1 0x60000000 to sniff packets punt to RP with the hexa-decimal value 0x60000000. As the location is not specified, it searches the entire buffer for the value 0x60000000. Packets punt to RP can also be sniffed by specifying a particular location using the command show controllers events punt-sniff word1 0x60000000 34. Examples Because you are executing this command on the line card, you must use the execute-on command to use the show command, or you must connect to the card using the attach command. All examples in this section use the execute-on command The following is partial sample output from the show controllers atm command: Router# execute-on slot 4 show controllers atm 0 TX SAR (Beta 1.0.0) is Operational; RX SAR (Beta 1.0.0) is Operational; Interface Configuration Mode: STS-12c Active Maker Channels: total # 6 VCID ChnnlID Type OutputInfo InPkts InOAMs MacString 1 0888 UBR 0C010010 0 0 08882000AAAA030000000800 2 0988 VBR 04010020 0 0 09882000 3 8BC8 UBR 0C010030 0 0 8BC82000AAAA030000000800 4 0E08 UBR 0C010040 0 0 0E082000AAAA030000000800 10 1288 VBR 040100A0 0 0 12882000 11 8BE8 VBR 0C0100B0 0 0 8BE82000AAAA030000000800 SAR Total Counters: total_tx_idle_cells 215267 total_tx_paks 0 total_tx_abort_paks 0 total_rx_paks 0 total_rx_drop_paks 0 total_rx_discard_cells 15 Switching Code Counters: total_rx_crc_err_paks 0 total_rx_giant_paks 0 total_rx_abort_paks 0 total_rx_crc10_cells 0 total_rx_tmout_paks 0 total_rx_unknown_paks 0 total_rx_out_buf_paks 0 total_rx_unknown_vc_paks 0 BATMAN Asic Register Values: hi_addr_reg 0x8000, lo_addr_reg 0x000C, boot_msk_addr 0x0780, rmcell_msk_addr 0x0724, rmcnt__msk_addr 0x07C2, txbuf_msk_addr 0x070C, . . . CM622 SAR Boot Configuration: txind_q_addr 0x14000 txcmd_q_addr 0x20000 . . . SUNI-622 Framer Register Values: show controllers (line card image) CF-634 Cisco IOS Configuration Fundamentals Command Reference April 2010 Master Rst and Ident/Load Meters Reg (#0x0): 0x10 Master Configuration Reg (#0x1): 0x1F Master Interrupt Status Reg (#0x2): 0x00 PISO Interrupt Reg (#0x3): 0x04 Master Auto Alarm Reg (#0x4): 0x03 Master Auto Alarm Reg (#0x5): 0x07 Parallel Output Port Reg (#0x6): 0x02 . . . BERM Line BIP Threshold LSB Reg (#0x74): 0x00 BERM Line BIP Threshold MSB Reg (#0x75): 0x00 Router# The following is partial sample output from the show controllers command: Router# execute-on slot 6 show controllers Interface POS0 Hardware is BFLC POS lcpos_instance struct 60311B40 RX POS ASIC addr space 12000000 TX POS ASIC addr space 12000100 SUNI framer addr space 12000400 SUNI rsop intr status 00 CRC32 enabled, HDLC enc, int clock no loop Interface POS1 Hardware is BFLC POS lcpos_instance struct 603142E0 RX POS ASIC addr space 12000000 TX POS ASIC addr space 12000100 SUNI framer addr space 12000600 SUNI rsop intr status 00 CRC32 enabled, HDLC enc, int clock no loop . . . Router# The following is partial sample output from the show controllers pos framers command: Router# execute-on slot 6 show controllers pos framers Framer 0, addr=0x12000400: master reset C0 master config 1F rrate sts3c trate sts3c fixptr master control 00 clock rcv cntrl D0 RACP control 84 RACP gfc control 0F TACP control status 04 hcsadd RACP intr enable 04 RSOP cntrl intr enable 00 RSOP intr status 00 TPOP path sig lbl (c2) 13 SPTB control 04 tnull SPTB status 00 Framer 1, addr=0x12000600: master reset C0 master config 1F rrate sts3c trate sts3c fixptr show controllers (line card image) CF-635 Cisco IOS Configuration Fundamentals Command Reference April 2010 master control 00 clock rcv cntrl D0 RACP control 84 RACP gfc control 0F TACP control status 04 hcsadd RACP intr enable 04 RSOP cntrl intr enable 00 RSOP intr status 00 TPOP path sig lbl (c2) 13 SPTB control 04 tnull SPTB status 00 Framer 2, addr=0x12000800: master reset C0 master config 1F rrate sts3c trate sts3c fixptr master control 00 clock rcv cntrl D0 RACP control 84 RACP gfc control 0F TACP control status 04 hcsadd RACP intr enable 04 RSOP cntrl intr enable 00 RSOP intr status 00 TPOP path sig lbl (c2) 13 SPTB control 04 tnull SPTB status 00 . . . Router# The following is partial sample output from the show controllers fia command: Router# execute-on slot 7 show controllers fia ========= Line Card (Slot 7) ======= Fabric configuration: Full bandwidth redundant Master Scheduler: Slot 17 From Fabric FIA Errors ----------------------- redund fifo parity 0 redund overflow 0 cell drops 0 crc32 lkup parity 0 cell parity 0 crc32 0 0 1 2 3 4 -------- -------- -------- -------- -------- los 0 0 0 0 0 crc16 0 0 0 0 0 To Fabric FIA Errors ----------------------- sca not pres 0 req error 0 uni fifo overflow 0 grant parity 0 multi req 0 uni fifo undrflow 0 cntrl parity 0 uni req 0 crc32 lkup parity 0 multi fifo 0 empty dst req 0 handshake error 0 The following is a sample output from the show controllers events command: Router# execute-on slot 7 show controllers events Switching Stats Packets punt to RP: 935 HW engine punt: 62 HW engine reject: 38113520 show controllers (line card image) CF-636 Cisco IOS Configuration Fundamentals Command Reference April 2010 RX HW Engine Reject Counters Unrecognized Protocol ID: 19182546 IP TTL Expired: 14706652 Unrecognized L2 Frame: 4224320 IPv6 Control pkts: 2 The following is a sample output from the show controllers events punt-verbose command: Router# execute-on slot 7 show controllers events punt-verbose RP Punted L2 Statistics in Verbose ------------------------------------ HDLC Encap : 927 RP Punted L3 Statistics in Verbose ------------------------------------ ICMP : 40 UDP : 441 OSPF : 211 IPV6 : 40 RP Punted L3 Application Statistics in Verbose ----------------------------------------------- LDP : 441 DF Bit not Set : 692 The following is a partial sample output from the show controllers events punt-verbose all command which displays the zero and non-zero value of packets punt to RP from LC: Router# execute-on slot 7 show controllers events punt-verbose all RP Punted L2 Statistics in Verbose ------------------------------------ L2 Protocol - 0 : 0 ARPA Encap : 0 L2 Protocol - 2 : 0 L2 Protocol - 3 : 0 L2 Protocol - 4 : 0 HDLC Encap : 941 L2 Protocol - 6 : 0 L2 Protocol - 7 : 0 L2 Protocol - 8 : 0 L2 Protocol - 9 : 0 L2 Protocol - 10 : 0 L2 Protocol - 11 : 0 L2 Protocol - 12 : 0 L2 Protocol - 13 : 0 L2 Protocol - 14 : 0 L2 Protocol - 15 : 0 PPP Encap : 0 L2 Protocol - 17 : 0 L2 Protocol - 18 : 0 L2 Protocol - 19 : 0 Frame Relay Encap : 0 L2 Protocol - 21 : 0 L2 Protocol - 22 : 0 L2 Protocol - 23 : 0 L2 Protocol - 24 : 0 L2 Protocol - 25 : 0 L2 Protocol - 26 : 0 L2 Protocol - 27 : 0 L2 Protocol - 28 : 0 L2 Protocol - 29 : 0 show controllers (line card image) CF-637 Cisco IOS Configuration Fundamentals Command Reference April 2010 L2 Protocol - 30 : 0 L2 Protocol - 31 : 0 L2 Protocol - 32 : 0 ATM Encap : 0 L2 Protocol - 34 : 0 L2 Protocol - 35 : 0 RP Punted L3 Statistics in Verbose ------------------------------------ HOPOPT : 0 ICMP : 40 IGMP : 0 L3 Protocol - 3 : 0 IPINIP : 0 L3 Protocol - 5 : 0 RP Punted L3 Application Statistics in Verbose ----------------------------------------------- MPLS OAM : 0 FTP : 0 FTPD : 0 TFTP : 0 ..... The following is a sample output from the show controllers events clear command: Router# execute-on slot 7 show controllers events clear Drop, switching and reject counters cleared The following is a sample output from the show controllers events punt-sniff command: Router# execute-on slot 7 show controllers events punt-sniff Punt Sniff Statistics -------------------------------- Word Location Occurance 0x60000000 34 0 0xB6010102 37 5 Note: Location offset taken from the begining of BufferHeader(32 bytes). The following is a sample output from the show controllers events punt-sniff word1 0x60000000 command. This command is used to sniff a packet with a hexa-decimal value 0x60000000 from the start of the buffer header of the packet being punt to RP: Router# execute-on slot 7 show controllers events punt-sniff word1 0x60000000 The following is a sample output from the show controllers events punt-sniff word1 0x60000000 34 command. This command is used to sniff a packet with a hexa-decimal value 0x60000000 0 at the location 34 from the start of the buffer header of the packet being punt to RP: Router# execute-on slot 7 show controllers events punt-sniff word1 0x60000000 34 The following is a sample output from the show controllers events punt-sniff none command. This command is used to clear the counter of packets to be sniffed: Router# execute-on slot 7 show controllers events punt-sniff none Related Commands Command Description clear controllers Resets the T1 or E1 controller. show controllers logging CF-638 Cisco IOS Configuration Fundamentals Command Reference April 2010 show controllers logging To display logging information about a Versatile Interface Processor (VIP) card, use the show controllers logging command in privileged EXEC mode. show controllers vip slot-number logging Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines This command displays the state of syslog error and event logging, including host addresses, and whether console logging is enabled. When enabled, “trap logging” allows messages to be sent to a remote host (a syslog server). Examples The following is sample output from the show controllers logging command: Router# show controllers vip 1 logging show logging from Slot 1: Syslog logging:enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns) Console logging: disabled Monitor logging: level debugging, 0 messages logged Buffer logging: level debugging, 24 messages logged Trap logging: level informational, 266 messages logged. Logging to 209.165.202.129 Exception Logging size: 4096 bytes Count and timestamp logging messages:disabled Log Buffer (8192 bytes): smallest_local_pool_entries = 256, global particles = 5149 highest_local_visible_bandwidth = 155000 00:00:05:%SYS-5-RESTART:System restarted -- . . . Table 66 describes the significant fields shown in the display. vip slot-number VIP slot number. Release Modification 11.2 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show controllers logging CF-639 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Table 66 show controllers logging Field Descriptions Field Description Syslog logging Shows general state of system logging (enabled or disabled), and status of logged messages (number of messages dropped, rate-limited, or flushed). Console logging Logging to the console port. Shows "disabled" or, if enabled, the severity level limit and number of messages logged. Enabled using the logging console command. Monitor logging Logging to the monitor (all TTY lines). Shows "disabled" or, if enabled, the severity level limit and number of messages logged. Enabled using the logging monitor command. Buffer logging Logging to the standard syslog buffer. Shows "disabled" or, if enabled, the severity level limit and number of messages logged. Enabled using the logging buffered command. Trap logging Logging to a remote host (syslog host). Shows "disabled" or, if enabled, the severity level limit and number of messages logged. (The word "trap" means a trigger in the system software for sending error messages to a remote host.) Enabled using the logging host command. The severity level limit is set using the logging trap command. Command Description show logging Displays the state of logging (syslog). show controllers tech-support CF-640 Cisco IOS Configuration Fundamentals Command Reference April 2010 show controllers tech-support To display general information about a Versatile Interface Processor (VIP) card when reporting a problem, use the show controllers tech-support command in privileged EXEC mode. show controllers vip slot-number tech-support Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Use this command to help collect general information about a VIP card when you are reporting a problem. This command displays the equivalent of the following show commands for the VIP card: • more system:running-config • show buffers • show controllers • show interfaces • show processes cpu • show processes memory • show stacks • show version For a sample display of the show controllers tech-support command output, refer to these show commands. Related Commands vip slot-number VIP slot number. Release Modification 11.2 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description more system:running-config Displays the running configuration. show buffers Displays statistics for the buffer pools on the network server. show controllers Displays information that is specific to the hardware. show interfaces Uses the show interfaces EXEC command to display ALC information. show processes Displays information about the active processes. show processes memory Displays memory used. show stacks Monitors the stack usage of processes and interrupt routines. show controllers tech-support CF-641 Cisco IOS Configuration Fundamentals Command Reference April 2010 show tech-support Displays general information about the router when reporting a problem. show version Displays the configuration of the system hardware, the software version, the names and sources of configuration files, and the boot images. Command Description show coverage history CF-642 Cisco IOS Configuration Fundamentals Command Reference April 2010 show coverage history To display the system history table, use the show coverage history command in privileged EXEC mode. show coverage history [all | first number-of-entries | last number-of-entries | status] Syntax Description Command Modes Privileged EXEC (#) Command History Examples The following is sample output from the show coverage history command. The output is self-explanatory. Router# show coverage history status History table size is 23 entries. 0 entries have been used. Low-level count handler has been called 0 times. There were 0 entries not traced due to recursion detection. There were 0 entries not traced due to internal pauses. Related Commands all (Optional) Displays the entire history table. first (Optional) Displays the oldest entries in the history table. number-of-entries (Optional) Number of entries to be displayed. The range is from 1 to 100000. last (Optional) Displays the latest entries in the history table. status (Optional) Displays the status of the history system. Release Modification 12.4(24)T This command was introduced in a release earlier than Cisco IOS Release 12.4(24)T. Command Description coverage history Enables the system to record the history of the events. show data-corruption CF-643 Cisco IOS Configuration Fundamentals Command Reference April 2010 show data-corruption To display data inconsistency errors of the present software version, use the show data-corruption command in user EXEC or privileged EXEC mode. show data-corruption Syntax Description This command has no arguments or keywords. Command Modes User EXEC (>) Privileged EXEC (#) Command History Usage Guidelines Use this command to display all data inconsistency errors or the corrupt data. If there are no data errors, the “No data inconsistency errors have been recorded” message is displayed. Examples The following is sample output from show data-corruption command. The fields are self-explanatory. Router# show data-corruption Data inconsistency records for: 3800 Software (C3845-ADVIPSERVICESK9-M), Version 12.4(24)T, RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Compiled Thu 17-Dec-09 09:02 by xyz Count Traceback 1842 60523C58, 616E85FC 60523C58 62A9F648 1: Jun 12 18:24:33.960 2: Jun 12 18:24:33.960 3: Jun 12 18:24:33.960 1842: Jun 19 00:30:51.350 Release Modification 12.2(22)SE This command was introduced. 12.2(33)SRB This command was integrated into Cisco IOS Release 12.2(33)SRB. 12.4(20)T This command was integrated into Cisco IOS Release 12.4(20)T. 12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI. Cisco IOS 2.3 XE This command was integrated into Cisco IOS XE Release 2.3. show debugging CF-644 Cisco IOS Configuration Fundamentals Command Reference April 2010 show debugging To display information about the types of debugging that are enabled for your router, use the show debugging command in privileged EXEC mode. show debugging Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC (#) Command History Examples The following is sample output from the show debugging command. In this example, the remote host is not configured or connected. Router# show debugging ! TCP: TCP Packet debugging is on TCP ECN debugging is on ! Router# telnet 10.1.25.234 ! Trying 10.1.25.234 ... ! 00:02:48: 10.1.25.31:11001 <---> 10.1.25.234:23 out ECN-setup SYN 00:02:48: tcp0: O CLOSED 10.1.25.234:11001 10.1.25.31:23 seq 1922220018 OPTS 4 ECE CWR SYN WIN 4128 00:02:50: 10.1.25.31:11001 <---> 10.1.25.234:23 congestion window changes 00:02:50: cwnd from 1460 to 1460, ssthresh from 65535 to 2920 00:02:50: tcp0: R SYNSENT 10.1.25.234:11001 10.1.25.31:23 seq 1922220018 OPTS 4 ECE CWR SYN WIN 4128 00:02:54: 10.1.25.31:11001 <---> 10.1.25.234:23 congestion window changes 00:02:54: cwnd from 1460 to 1460, ssthresh from 2920 to 2920 00:02:54: tcp0: R SYNSENT 10.1.25.234:11001 10.1.25.31:23 seq 1922220018 OPTS 4 ECE CWR SYN WIN 4128 00:03:02: 10.1.25.31:11001 <---> 10.1.25.234:23 congestion window changes 00:03:02: cwnd from 1460 to 1460, ssthresh from 2920 to 2920 Release Modification 11.1 This command was introduced. 12.3(7)T The output of this command was enhanced to show TCP Explicit Congestion Notification (ECN) configuration. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(31)SB2 This command was integrated into Cisco IOS Release 12.2(31)SB2. 12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware. 12.4(20)T The output of this command was enhanced to show the user-group debugging configuration. show debugging CF-645 Cisco IOS Configuration Fundamentals Command Reference April 2010 00:03:02: tcp0: R SYNSENT 10.1.25.234:11001 10.1.25.31:23 seq 1922220018 OPTS 4 ECE CWR SYN WIN 4128 00:03:18: 10.1.25.31:11001 <---> 10.1.25.234:23 SYN with ECN disabled 00:03:18: 10.1.25.31:11001 <---> 10.1.25.234:23 congestion window changes 00:03:18: cwnd from 1460 to 1460, ssthresh from 2920 to 2920 00:03:18: tcp0: O SYNSENT 10.1.25.234:11001 10.1.25.31:23 seq 1922220018 OPTS 4 SYN WIN 4128 00:03:20: 10.1.25.31:11001 <---> 10.1.25.234:23 congestion window changes 00:03:20: cwnd from 1460 to 1460, ssthresh from 2920 to 2920 00:03:20: tcp0: R SYNSENT 10.1.25.234:11001 10.1.25.31:23 seq 1922220018 OPTS 4 SYN WIN 4128 00:03:24: 10.1.25.31:11001 <---> 10.1.25.234:23 congestion window changes 00:03:24: cwnd from 1460 to 1460, ssthresh from 2920 to 2920 00:03:24: tcp0: R SYNSENT 10.1.25.234:11001 10.1.25.31:23 seq 1922220018 OPTS 4 SYN WIN 4128 00:03:32: 10.1.25.31:11001 <---> 10.1.25.234:23 congestion window changes 00:03:32: cwnd from 1460 to 1460, ssthresh from 2920 to 2920 00:03:32: tcp0: R SYNSENT 10.1.25.234:11001 10.1.25.31:23 seq 1922220018 OPTS 4 SYN WIN 4128 !Connection timed out; remote host not responding The following is sample output from the show debugging command when user-group debugging is configured: Router# show debugging ! usergroup: Usergroup Deletions debugging is on Usergroup Additions debugging is on Usergroup Database debugging is on Usergroup API debugging is on ! Table 67 describes the significant fields in the output. Table 67 show debugging Field Descriptions Field Description OPTS 4 Bytes of TCP expressed as a number. In this case, the bytes are 4. ECE Echo congestion experience. CWR Congestion window reduced. SYN Synchronize connections—Request to synchronize sequence numbers, used when a TCP connection is being opened. WIN 4128 Advertised window size, in bytes. In this case, the bytes are 4128. cwnd Congestion window (cwnd)—Indicates that the window size has changed. ssthresh Slow-start threshold (ssthresh)—Variable used by TCP to determine whether or not to use slow-start or congestion avoidance. usergroup Statically defined usergroup to which source IP addresses are associated. show declassify CF-646 Cisco IOS Configuration Fundamentals Command Reference April 2010 show declassify To display the state of the declassify function (enabled, in progress, and so forth) and the sequence of declassification steps that will be performed, use the show declassify command in global configuration mode. show declassify Syntax Description This command has no arguments or keywords. Note The show declassify command is supported on the Cisco 3200 series routers only. Command Modes Global configuration Command History Examples The following example is sample output for the show declassify command: Router# show declassify Declassify facility: Enabled=Yes In Progress=No Erase flash=Yes Erase nvram=Yes Obtain memory size Shutdown Interfaces Declassify Console and Aux Ports Erase flash Declassify NVRAM Declassify Communications Processor Module Declassify RAM, D-Cache, and I-Cache Table 68 describes the significant fields shown in the display. Release Modification 12.3(8)YD This command was introduced. 12.4(2)T This command was integrated into Cisco IOS Release 12.4(2)T. Table 68 show declassify Field Descriptions Field Description Enabled A “Yes” value indicates that zeroization is enabled. A “No” value indicates that zeroization is disabled. In Progress A “Yes” value indicates that zeroization is currently in progress. A “No” value indicates that zeroization is currently not in progress. show declassify CF-647 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Erase flash A “Yes” value indicates that erasure of Flash memory is enabled. A “No” value indicates that the erasure of Flash memory is disabled. Erase nvram A “Yes” value indicates that the erasure of NVRAM is enabled. A “No” value indicates that the erasure of NVRAM is disabled. Obtain memory size Obtain the main memory size in order to understand how much of the memory is to be scrubbed. Shutdown Interfaces Shut down any and all network interfaces. Declassify Console and AUX Ports Remove potentially sensitive information from console and AUX port FIFOs. Erase flash Erase Flash memory. Declassify NVRAM Erase NVRAM. Declassify Communications Processor Module Erase the memory in the Communications Processor Module (CPM). Declassify RAM, D-Cache, and I-Cache Scrub the main memory, erase the Data Cache (D-Cache), and erase the Instruction Cache (I-Cache). Table 68 show declassify Field Descriptions (continued) Field Description Command Description service declassify Invokes declassification. show derived-config CF-648 Cisco IOS Configuration Fundamentals Command Reference April 2010 show derived-config To display the composite results of all the configuration commands that apply to an interface, including commands that come from sources such as static templates, dynamic templates, dialer interfaces, and authentication, authorization, and accounting (AAA) per-user attributes, use the show derived-config command in privileged EXEC mode. show derived-config [interface type number] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Configuration commands can be applied to an interface from sources such as static templates, dynamic templates bound by resource pooling, dialer interfaces, AAA per-user attributes and the configuration of the physical interface. The show derived-config command displays all the commands that apply to an interface. The output for the show derived-config command is nearly identical to that of the show running-config command. It differs when the configuration for an interface is derived from a template, a dialer interface, or some per-user configuration. In those cases, the commands derived from the template, dialer interface, and so on, will be displayed for the affected interface. If the same command is configured differently in two different sources that apply to the same interface, the command coming from the source that has the highest precedence will appear in the display. Examples The following examples show sample output for the show running-config and show derived-config commands for serial interface 0:23 and dialer interface 0. The output of the show running-config and show derived-config commands is the same for dialer interface 0 because none of the commands that apply to that interface are derived from any sources other than the configuration of the dialer interface. The output for the show running-config and show derived-config commands for serial interface 0:23 differs because some of the commands that apply to serial interface 0:23 come from dialer interface 0. Router# show running-config interface Serial0:23 Building configuration... Current configuration :296 bytes ! interface Serial0:23 description PRI to ADTRAN (#4444150) interface type number (Optional) Displays the derived configuration for a specific interface. If you use the interface keyword, you must specify the interface type and the interface number (for example, interface ethernet 0). Release Modification 12.1 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show derived-config CF-649 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip unnumbered Loopback0 encapsulation ppp dialer rotary-group 0 isdn switch-type primary-dms100 isdn incoming-voice modem isdn calling-number 4444150 peer default ip address pool old_pool end Router# show running-config interface Dialer0 Building configuration... Current configuration :257 bytes ! interface Dialer0 description Dialin Users ip unnumbered Loopback0 no ip proxy-arp encapsulation ppp dialer in-band dialer idle-timeout 30 dialer-group 1 peer default ip address pool new_pool ppp authentication pap chap callin end Router# show derived-config interface Serial0:23 Building configuration... Derived configuration :332 bytes ! interface Serial0:23 description PRI to ADTRAN (#4444150) ip unnumbered Loopback0 encapsulation ppp dialer rotary-group 0 isdn switch-type primary-dms100 isdn incoming-voice modem isdn calling-number 4444150 peer default ip address pool new_pool ppp authentication pap chap callin end Router# show derived-config interface Dialer0 Building configuration... Derived configuration :257 bytes ! interface Dialer0 description Dialin Users ip unnumbered Loopback0 no ip proxy-arp encapsulation ppp dialer in-band dialer idle-timeout 30 dialer-group 1 peer default ip address pool new_pool ppp authentication pap chap callin end show derived-config CF-650 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description show running-config Displays the contents of the currently running configuration file or the configuration for a specific interface. show diagnostic cns CF-651 Cisco IOS Configuration Fundamentals Command Reference April 2010 show diagnostic cns To display the information about the CNS subject, use the show diagnostic cns command in user EXEC or privileged EXEC mode. show diagnostic cns {publish | subscribe} Syntax Description Defaults This command has no default settings. Command Modes User EXEC Privileged EXEC Command History Usage Guidelines This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2. The CNS subsystem communicates with remote network applications through the CNS-event agent and follows the publish and subscribe model. An application sets itself up to receive events by subscribing to the approprate event subject name. Examples This example shows how to display the subject with which the diagnostic results is published: Router# show diagnostic cns publish Subject: cisco.cns.device.diag_results This example shows how to display the subscribed subject: Router# show diagnostic cns subscribe Subject: cisco.cns.device.diag_get_results Related Commands publish Displays the subject with which the diagnostic results is published. subscribe Displays the subscribed subjects. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description diagnostic cns Configures the CNS diagnostics. show diagnostic sanity CF-652 Cisco IOS Configuration Fundamentals Command Reference April 2010 show diagnostic sanity To display sanity check results, use the show diagnostic sanity command in privileged EXEC mode. show diagnostic sanity Syntax Description This command has no arguments or keywords. Defaults Displays information for all the Gigabit Ethernet WAN interfaces in the Cisco 7600 series router. Command Modes Privileged EXEC Command History Usage Guidelines The sanity check runs a set of predetermined checks on the configuration with a possible combination of certain system states to compile a list of warning conditions. The checks are designed to look for anything that seems out of place and are intended to serve as an aid to maintaining the system sanity. The following is a list of the checks that are run and the action taken when the condition is found: • Checks whether the default gateways are reachable. If so, the system stops pinging. • If a port auto-negotiates to half duplex, the system flags it. Trunking Checks • If a trunk port has the mode set to “on,” the system flags it. • If a port is trunking and mode is auto, the system flags it. • If a trunk port is not trunking and the mode is desirable, the system flags it. • If a trunk port negotiates to half duplex, the system flags it. Channeling Checks • If a port has channeling mode set to on, the system flags it. • If a port is not channeling and the mode is set to desirable, the system flags it. • If a VLAN has a Spanning-Tree root of 32K (root is not set), the system flags it. Spanning-Tree VLAN Checks • If a VLAN has a max age on the Spanning-Tree root that is different than the default, the system flags it. • If a VLAN has a fwd delay on the Spanning-Tree root that is different than the default, the system flags it. • If a VLAN has a fwd delay on the bridge that is different than the default, the system flags it. Release Modification 12.2(18)SXE Support for this command was introduced on the Supervisor Engine 720. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show diagnostic sanity CF-653 Cisco IOS Configuration Fundamentals Command Reference April 2010 • If a VLAN has a fwd delay on the bridge that is different than the default, the system flags it. • If a VLAN has a hello time on the bridge that is different than the default, the system flags it. Spanning-Tree Port Checks • If a port has a port cost that is different than the default, the system flags it. • If a port has a port priority that is different than the default, the system flags it. UDLD Checks • If a port has UDLD disabled, the system flags it. • If a port had UDLD shut down, the system flags it. • If a port had a UDLD undetermined state, the system flags it. Assorted Port Checks • If a port had receive flow control disabled, the system flags it. • If a trunk port had PortFast enabled, the system flags it. • If a inline power port has any of the following states: – denied – faulty – other – off The system flags it. • If a port has a native VLAN mismatch, the system flags it. • If a port has a duplex mismatch, the system flags it. Bootstring and Config Register Checks • The config register on the primary supervisor engine (and on the secondary supervisor engine if present) must be one of the following values: 0x2 , 0x102, or 0x2102. • The system verifies the bootstring on the primary supervisor engine (and on the secondary supervisor engine if present). The system displays a message if the bootstring is empty. • The system verifies that every file is specified in the bootstring. The system displays a message if the file is absent or shows up with a wrong checksum. If only device: is specified as a filename, then the system verifies that the first file is on the device. Assorted Checks • The system displays a message if IGMP snooping is disabled. • The system displays a message if any of the values of the snmp community access strings {RO,RW,RW-ALL} is the same as the default. • The system displays a message if any of the modules are in states other than “Ok.” • The system displays a message that lists all the tests that failed (displayed as an “F”) in the show test all command. • The system displays a message if *fast is not configured on the switch anywhere. • The system displays a message if there is enough room for the crashinfo file on the bootflash:. • The system displays a message if multicast routing is enabled globally but is not applied to all interfaces. show diagnostic sanity CF-654 Cisco IOS Configuration Fundamentals Command Reference April 2010 • The system displays a message if IGMP snooping is disabled and RGMP is enabled. Examples This example displays samples of the messages that could be displayed with the show diagnostic sanity command: Router# show diagnostic sanity Pinging default gateway 10.6.141.1 .... Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.6.141.1, timeout is 2 seconds: ..!!. Success rate is 0 percent (0/5) IGMP snooping disabled please enable it for optimum config. IGMP snooping disabled but RGMP enabled on the following interfaces, please enable IGMP for proper config : Vlan1, Vlan2, GigabitEthernet1/1 Multicast routing is enabled globally but not enabled on the following interfaces: GigabitEthernet1/1, GigabitEthernet1/2 A programming algorithm mismatch was found on the device bootflash: Formatting the device is recommended. The bootflash: does not have enough free space to accomodate the crashinfo file. Please check your confreg value : 0x0. Please check your confreg value on standby: 0x0. The boot string is empty. Please enter a valid boot string . Could not verify boot image "disk0:" specified in the boot string on the slave. Invalid boot image "bootflash:asdasd" specified in the boot string on the slave. Please check your boot string on the slave. UDLD has been disabled globally - port-level UDLD sanity checks are being bypassed. OR [ The following ports have UDLD disabled. Please enable UDLD for optimum config: Fa9/45 The following ports have an unknown UDLD link state. Please enable UDLD on both sides of the link: Fa9/45 ] The following ports have portfast enabled: Fa9/35, Fa9/45 The following ports have trunk mode set to on: Fa4/1, Fa4/13 The following trunks have mode set to auto: Fa4/2, Fa4/3 show diagnostic sanity CF-655 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following ports with mode set to desirable are not trunking: Fa4/3, Fa4/4 The following trunk ports have negotiated to half-duplex: Fa4/3, Fa4/4 The following ports are configured for channel mode on: Fa4/1, Fa4/2, Fa4/3, Fa4/4 The following ports, not channeling are configured for channel mode desirable: Fa4/14 The following vlan(s) have a spanning tree root of 32768: 1 The following vlan(s) have max age on the spanning tree root different from the default: 1-2 The following vlan(s) have forward delay on the spanning tree root different from the default: 1-2 The following vlan(s) have hello time on the spanning tree root different from the default: 1-2 The following vlan(s) have max age on the bridge different from the default: 1-2 The following vlan(s) have fwd delay on the bridge different from the default: 1-2 The following vlan(s) have hello time on the bridge different from the default: 1-2 The following vlan(s) have a different port priority than the default on the port FastEthernet4/1 1-2 The following ports have recieve flow control disabled: Fa9/35, Fa9/45 The following inline power ports have power-deny/faulty status: Gi7/1, Gi7/2 The following ports have negotiated to half-duplex: Fa9/45 The following vlans have a duplex mismatch: Fas 9/45 The following interafaces have a native vlan mismatch: interface (native vlan - neighbor vlan) Fas 9/45 (1 - 64) The value for Community-Access on read-only operations for SNMP is the same as default. Please verify that this is the best value from a security point of view. show diagnostic sanity CF-656 Cisco IOS Configuration Fundamentals Command Reference April 2010 The value for Community-Access on write-only operations for SNMP is the same as default. Please verify that this is the best value from a security point of view. The value for Community-Access on read-write operations for SNMP is the same as default. Please verify that this is the best value from a security point of view. Please check the status of the following modules: 8,9 Module 2 had a MINOR_ERROR. The Module 2 failed the following tests: TestIngressSpan The following ports from Module2 failed test1: 1,2,4,48 show disk CF-657 Cisco IOS Configuration Fundamentals Command Reference April 2010 show disk To display flash or file system information for a disk, use the show disk command in user or privileged EXEC mode. show {disk0 | disk1} [all | filesys] Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines The show disk command is supported only on platforms that have a disk file system. Note The name of the ATA monlib file may contain a platform name that does not match the platform that you are using. Different platforms may have a similar or the same name for their ATA monlib file. Examples The following example displays information about disk 0. The output is self-explanatory. Router# show disk0 all -#- --length-- -----date/time------ path 1 19539160 Jan 27 2004 23:08:40 c7200-is-mz.123-5.7.PI3a 1011679232 bytes available (19546112 bytes used) ******** ATA Flash Card Geometry/Format Info ******** ATA CARD GEOMETRY Number of Heads: 16 Number of Cylinders 1999 Sectors per Track 63 disk0 Selects disk 0 as the disk to display information about. disk1 Selects disk 1 as the disk to display information about. all (Optional) Specifies that all flash information will be displayed for the selected disk. filesys (Optional) Specifies that file system information will be displayed for the selected disk. Release Modification 12.2 This command was introduced in a release prior to Cisco IOS Release 12.2. 12.3(7)T This command was enhanced to display information about the ATA ROM monitor library (monlib) file. 12.2(25)S This command was integrated into the Cisco IOS Release 12.2(25)S. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show disk CF-658 Cisco IOS Configuration Fundamentals Command Reference April 2010 Sector Size 512 Total Sectors 2014992 ATA CARD FORMAT Number of FAT Sectors 246 Sectors Per Cluster 32 Number of Clusters 62941 Number of Data Sectors 2014789 Base Root Sector 632 Base FAT Sector 140 Base Data Sector 664 ATA MONLIB INFO Image Monlib size = 67256 Disk monlib size = 71680 Name = c7200-atafslib-m Monlib Start sector = 2 Monlib End sector = 133 Monlib updated by = C7200-IS-M12.3(5.7)PI3a Monlib version = 1 show disk0: CF-659 Cisco IOS Configuration Fundamentals Command Reference April 2010 show disk0: To display flash or file system information for a disk located in slot 0, use the show disk command in user EXEC or privileged EXEC mode. show disk0: [all | filesys] Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines The show disk0: command is supported only on platforms that have a disk file system located in slot 0. Use the show disk0: command to display details about the files in a particular ATA PCMCIA flash disk memory card. For more information regarding file systems and flash cards, access the PCMCIA Filesystem Compatibility Matrix and Filesystem Information document at the following URL: http://www.cisco.com/en/US/partner/products/hw/routers/ps341/products_tech_note09186a00800a751 5.shtml Note The name of the ATA monlib file may contain a platform name that does not match the platform that you are using. Different platforms may have a similar name or the same name for their ATA monlib file. Examples The following examples show displays of information about the flash disks or file system information for a disk. The output is self-explanatory. c7200# show disk0: -#- --length-- -----date/time------ path all (Optional) The all keyword displays complete information about flash memory, including information about the individual devices in flash memory and the names and sizes of all system image files stored in flash memory, including those that are invalid. filesys (Optional) Displays the device information block, the status information, and the usage information. Release Modification 11.3AA This command was introduced. 12.2 This command was incorporated into Cisco IOS Release 12.2. 12.3(7)T This command was enhanced to display information about the ATA ROM monitor library (monlib) file. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show disk0: CF-660 Cisco IOS Configuration Fundamentals Command Reference April 2010 1 29505176 Feb 27 2006 17:56:52 +00:00 c7200-jk9o3s-mz.124-6.T 2 32768 Feb 24 2006 13:30:30 +00:00 file1.log 34738176 bytes available (29540352 bytes used) c7200# show disk0: all -#- --length-- -----date/time------ path 1 29505176 Feb 27 2006 17:56:52 +00:00 c7200-jk9o3s-mz.124-6.T 2 32768 Feb 24 2006 13:30:30 +00:00 file1.log 34738176 bytes available (29540352 bytes used) ******** ATA Flash Card Geometry/Format Info ******** ATA CARD GEOMETRY Number of Heads: 4 Number of Cylinders 984 Sectors per Cylinder 32 Sector Size 512 Total Sectors 125952 ATA CARD FORMAT Number of FAT Sectors 62 Sectors Per Cluster 8 Number of Clusters 15693 Number of Data Sectors 125812 Base Root Sector 232 Base FAT Sector 108 Base Data Sector 264 ATA MONLIB INFO Image Monlib size = 73048 Disk monlib size = 55296 Name = NA Monlib end sector = NA Monlib Start sector = NA Monlib updated by = NA Monlib version = NA c7200# show disk0: filesys ******** ATA Flash Card Geometry/Format Info ******** ATA CARD GEOMETRY Number of Heads: 4 Number of Cylinders 984 Sectors per Cylinder 32 Sector Size 512 Total Sectors 125952 ATA CARD FORMAT Number of FAT Sectors 62 Sectors Per Cluster 8 Number of Clusters 15693 Number of Data Sectors 125812 Base Root Sector 232 Base FAT Sector 108 Base Data Sector 264 ATA MONLIB INFO Image Monlib size = 73048 Disk monlib size = 55296 Name = NA show disk0: CF-661 Cisco IOS Configuration Fundamentals Command Reference April 2010 Monlib end sector = NA Monlib Start sector = NA Monlib updated by = NA Monlib version = NA Related Commands Command Description dir disk0: Displays a directory listing of files on an ATA PCMCIA flash disk card located in slot 0. dir disk1: Displays a directory listing of files on an ATA PCMCIA flash disk card located in slot 1. show disk1: Displays flash or file system information for a disk located in slot 1. show disk1: CF-662 Cisco IOS Configuration Fundamentals Command Reference April 2010 show disk1: To display flash or file system information for a disk located in slot 1, use the show disk1: command in user EXEC or privileged EXEC mode. show disk1: [all | filesys] Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines The show disk1: command is supported only on platforms that have a disk file system. Use the show disk01: command to display details about the files in a particular ATA PCMCIA flash disk memory card located in slot 1. For more information regarding file systems and flash cards, access the PCMCIA Filesystem Compatibility Matrix and Filesystem Information document at the following URL: http://www.cisco.com/en/US/partner/products/hw/routers/ps341/products_tech_note09186a00800a751 5.shtml Note The name of the ATA monlib file may contain a platform name that does not match the platform that you are using. Different platforms may have a similar name or the same name for their ATA monlib file. Examples The following examples show displays of information about the flash disks or file system information for a disk. The output is self-explanatory. c7200# show disk1: -#- --length-- -----date/time------ path all (Optional) The all keyword displays complete information about flash memory, including information about the individual devices in flash memory and the names and sizes of all system image files stored in flash memory, including those that are invalid. filesys (Optional) Displays the device information block, the status information, and the usage information. Release Modification 11.3AA This command was introduced. 12.2 This command was incorporated into Cisco IOS Release 12.2. 12.3(7)T This command was enhanced to display information about the ATA ROM monitor library (monlib) file. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show disk1: CF-663 Cisco IOS Configuration Fundamentals Command Reference April 2010 1 29505176 Feb 27 2006 17:56:52 +00:00 c7200-jk9o3s-mz.124-6.T 2 32768 Feb 24 2006 13:30:30 +00:00 file1.log 34738176 bytes available (29540352 bytes used) c7200# show disk1: all -#- --length-- -----date/time------ path 1 29505176 Feb 27 2006 17:56:52 +00:00 c7200-jk9o3s-mz.124-6.T 2 32768 Feb 24 2006 13:30:30 +00:00 file1.log 34738176 bytes available (29540352 bytes used) ******** ATA Flash Card Geometry/Format Info ******** ATA CARD GEOMETRY Number of Heads: 4 Number of Cylinders 984 Sectors per Cylinder 32 Sector Size 512 Total Sectors 125952 ATA CARD FORMAT Number of FAT Sectors 62 Sectors Per Cluster 8 Number of Clusters 15693 Number of Data Sectors 125812 Base Root Sector 232 Base FAT Sector 108 Base Data Sector 264 ATA MONLIB INFO Image Monlib size = 73048 Disk monlib size = 55296 Name = NA Monlib end sector = NA Monlib Start sector = NA Monlib updated by = NA Monlib version = NA c7200# show disk1: filesys ******** ATA Flash Card Geometry/Format Info ******** ATA CARD GEOMETRY Number of Heads: 4 Number of Cylinders 984 Sectors per Cylinder 32 Sector Size 512 Total Sectors 125952 ATA CARD FORMAT Number of FAT Sectors 62 Sectors Per Cluster 8 Number of Clusters 15693 Number of Data Sectors 125812 Base Root Sector 232 Base FAT Sector 108 Base Data Sector 264 ATA MONLIB INFO Image Monlib size = 73048 Disk monlib size = 55296 Name = NA show disk1: CF-664 Cisco IOS Configuration Fundamentals Command Reference April 2010 Monlib end sector = NA Monlib Start sector = NA Monlib updated by = NA Monlib version = NA Related Commands Command Description dir disk0: Displays a directory listing of files on an ATA PCMCIA flash disk card located in slot 0. dir disk1: Displays a directory listing of files on an ATA PCMCIA flash disk card located in slot 1. show disk0: Displays flash or file system information for a disk located in slot 0. show environment CF-665 Cisco IOS Configuration Fundamentals Command Reference April 2010 show environment To display temperature, voltage, fan, and power supply information, use the show environment command in user EXEC or privileged EXEC mode. show environment [alarms | all | fans | hardware | last | leds | power-supply | table | temperature | voltages] Cisco 7000 Series, Cisco 7200 Series, Cisco 7304, and Cisco 7500 Series show environment [all | last | table] Cisco ASR 1000 Series show environment {all | counters | history sensor | location sensor | sensor sensor | table sensor} Syntax Description Command Default If no options are specified, the default is all. alarms (Optional) Displays the alarm contact information. all (Optional) Displays a detailed listing of all environmental monitor parameters (for example, the power supplies, temperature readings, voltage readings, and blower speeds). This is the default. fans (Optional) Displays blower and fan information. hardware (Optional) Displays hardware-specific information. last (Optional) Displays information on the last measurement made. leds (Optional) Displays the status of the MBus LEDs on the clock and scheduler cards and switch fabric cards. power-supply (Optional) Displays power supply voltage and current information. If applicable, displays the status of the redundant power supply. table (Optional) Displays the temperature, voltage, and blower ranges and thresholds. On the Cisco 7200 series, including the NPE-G2 in the Cisco 7200 VXR, the Cisco 7304 routers, and the Cisco 7500 series routers, the table keyword displays only the temperature and voltage thresholds. temperature (Optional) Displays temperature information. voltages (Optional) Displays voltage information. counters Displays operational counters. history Displays sensor state change history. location Displays sensors by location. sensor Displays sensor summary. sensor Sensor name. show environment CF-666 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Modes User EXEC (>) Privileged EXEC (#) Command History Usage Guidelines The availability of keywords depends on your system and platform. The command does not support SPAs on the Cisco 7200 series and on the NPE-G2 in the Cisco 7200 VXR routers. A routine runs once a minute that reads environmental measurements from sensors and stores the output into a buffer. For shared port adapters (SPAs), the temperature and voltage sensors are read every few seconds to get environmental data. The environmental buffer is displayed on the console when you use the show environment command. If a measurement exceeds desired margins, but has not exceeded fatal margins, a warning message is printed to the system console. The system software queries the sensors for measurements once a minute, but warnings for a given test point are printed at most once every hour for sensor readings in the warning range and once every 5 minutes for sensor readings in the critical range. If a measurement is out of line within these time segments, an automatic warning message appears on the console. As noted, you can query the environmental status with the show environment command at any time to determine whether a measurement is at the warning or critical tolerance. A SPA is shut down when any of the SPA environment readings exceed the shutdown threshold. If a shutdown occurs because of detection of fatal environmental margins, the last measured value from each sensor is stored in internal nonvolatile memory. For environmental specifications, refer to the hardware installation and configuration publication for your individual chassis. For network processor engines (NPEs), network services engines (NSEs), line cards, and modular services cards (MSCs), environmental information is recorded in the CISCO-ENVMON-MIB. SPAs are not supported by the CISCO-ENVMON-MIB. In Cisco IOS Release 12.2(20)S2 and later, the CISCO-ENTITY-SENSOR-MIB supports environmental information for SPAs, as well as NPEs, NSEs, line cards, and MSCs. Release Modification 10.0 This command was introduced. 11.2 GS The alarms, fans, hardware, leds, power-supply, table, temperature, and voltages keywords were added for the Cisco 12000 series GSRs. 11.3(6)AA This command was expanded to monitor the RPS and board temperature for the Cisco AS5300 platform, Cisco 3600 series routers, Cisco 7200 series routers, and the Cisco 12000 series GSRs. 12.2(20)S This command was integrated into Cisco IOS Release 12.2(20)S. 12.2(20)S2 This command was integrated into Cisco IOS Release 12.2(20)S2 to support MSCs and SPAs on the Cisco 7304 router using the all, last, and table keywords. 12.4(4)XD This command was integrated into Cisco IOS Release 12.4(4)XD to support the NPE-G2 on the Cisco 7200 VXR using the all, last, and table keywords. Command output was modified for the NPE-G2. 12.2(31)SB2 This command was integrated into Cisco IOS Release 12.2(31)SB2. Cisco IOS XE Release 2.1 This command was integrated into Cisco IOS XE Release 2.1 on the Cisco ASR 1000 Series Routers. show environment CF-667 Cisco IOS Configuration Fundamentals Command Reference April 2010 If the Cisco 12000 series GSR exceeds environmental conditions, a message similar to the following is displayed on the console: %GSR_ENV-2-WARNING: Slot 3 Hot Sensor Temperature exceeds 40 deg C; Check cooling systems Note Blower temperatures that exceed environmental conditions do not generate a warning message. You can also enable Simple Network Management Protocol (SNMP) notifications (traps or informs) to alert a network management system (NMS) when environmental thresholds are reached using the snmp-server enable traps envmon and snmp-server host global configuration commands. Whenever Cisco IOS software detects a failure or recovery event from the DRPS unit, it sends an SNMP trap to the configured SNMP server. Unlike console messages, only one SNMP trap is sent when the failure event is first detected. Another trap is sent when the recovery is detected. Cisco AS5300 DRPS software reuses the MIB attributes and traps defined in CISCO-ENVMON-MIB and CISCO-ACCESS-ENVMON-MIB. CISCO-ENVMON-MIB is supported by all Cisco routers with RPS units, and CISCO-ACCESS-ENVMON-MIB is supported by the Cisco 3600 series routers. A power supply trap defined in CISCO-ENVMON-MIB is sent when a failure is detected and when a failure recovery occurs for the following events: input voltage fail, DC output voltage fail, thermal fail, and multiple failure events. A fan failure trap defined in CISCO-ENVMON-MIB is sent when a fan failure or recovery event is detected by Cisco IOS software. A temperature trap defined in CISCO-ACCESS-ENVMON-MIB is sent when a board over-temperature condition is detected by Cisco IOS software. CISCO-ACCESS-ENVMON-MIB also defines an over-voltage trap. A similar trap is defined in CISCO-ENVMON-MIB, but it requires the ciscoEnvMonVoltageStatusValue in varbinds. This value indicates the current value of the voltage in the RPS. With Cisco AS5300 RPS units, the current voltage value is not sent to the motherboard. CISCO-ENVMON-MIB is extended to add a new enumerated value, internalRedundant(5), for MIB attribute ciscoEnvMonSupplySource. This is used to identify a RPS unit. Examples Cisco ASR 1000 Series Routers In the following example, the show environment all command displays system temperature, voltage, fan, and power supply conditions. (It does not display environmental information for SPAs.) The State column in show environment all output should show “Normal” except for fans where it indicates fan speed. A fan speed of 65% is normal. Router# show environment all Sensor List: Environmental Monitoring Sensor Location State Reading V1: VMA F0 Normal 1801 mV V1: VMB F0 Normal 1206 mV V1: VMC F0 Normal 1206 mV V1: VMD F0 Normal 1103 mV V1: VME F0 Normal 1005 mV V1: 12v F0 Normal 11967 mV V1: VDD F0 Normal 3295 mV V1: GP1 F0 Normal 905 mV V2: VMA F0 Normal 3295 mV V2: VMB F0 Normal 2495 mV V2: VMC F0 Normal 1499 mV V2: VMD F0 Normal 1098 mV show environment CF-668 Cisco IOS Configuration Fundamentals Command Reference April 2010 V2: VME F0 Normal 1000 mV V2: VMF F0 Normal 1000 mV V2: 12v F0 Normal 11923 mV V2: VDD F0 Normal 3295 mV V2: GP1 F0 Normal 751 mV Temp: Inlet F0 Normal 27 Celsius Temp: Asic1 F0 Normal 44 Celsius Temp: Exhaust1 F0 Normal 36 Celsius Temp: Exhaust2 F0 Normal 34 Celsius Temp: Asic2 F0 Normal 40 Celsius V1: VMA 0 Normal 1103 mV V1: VMB 0 Normal 1201 mV V1: VMC 0 Normal 1503 mV V1: VMD 0 Normal 1801 mV V1: VME 0 Normal 2495 mV V1: VMF 0 Normal 3295 mV V1: 12v 0 Normal 11967 mV V1: VDD 0 Normal 3295 mV V1: GP1 0 Normal 751 mV V1: GP2 0 Normal 903 mV V2: VMB 0 Normal 1201 mV V2: 12v 0 Normal 11967 mV V2: VDD 0 Normal 3291 mV V2: GP2 0 Normal 903 mV Temp: Left 0 Normal 28 Celsius Temp: Center 0 Normal 29 Celsius Temp: Asic1 0 Normal 42 Celsius Temp: Right 0 Normal 27 Celsius V1: VMA 1 Normal 1103 mV V1: VMB 1 Normal 1201 mV V1: VMC 1 Normal 1503 mV V1: VMD 1 Normal 1801 mV V1: VME 1 Normal 2495 mV V1: VMF 1 Normal 3295 mV V1: 12v 1 Normal 11953 mV V1: VDD 1 Normal 3291 mV V1: GP1 1 Normal 754 mV V1: GP2 1 Normal 903 mV V2: VMB 1 Normal 1206 mV V2: 12v 1 Normal 11967 mV V2: VDD 1 Normal 3291 mV V2: GP2 1 Normal 905 mV Temp: Left 1 Normal 28 Celsius Temp: Center 1 Normal 30 Celsius Temp: Asic1 1 Normal 44 Celsius Temp: Right 1 Normal 28 Celsius PEM Iout P0 Normal 37 A PEM Vout P0 Normal 12 V AC PEM Vin P0 Normal 116 V AC Temp: PEM P0 Normal 28 Celsius Temp: FC P0 Fan Speed 65% 25 Celsius Temp: FM P1 Normal 1 Celsius Temp: FC P1 Fan Speed 65% 25 Celsius V1: VMA R0 Normal 1118 mV V1: VMB R0 Normal 3315 mV V1: VMC R0 Normal 2519 mV V1: VMD R0 Normal 1811 mV V1: VME R0 Normal 1513 mV V1: VMF R0 Normal 1220 mV V1: 12v R0 Normal 12011 mV V1: VDD R0 Normal 3300 mV V1: GP1 R0 Normal 913 mV V1: GP2 R0 Normal 1247 mV Temp: CPU R0 Normal 29 Celsius show environment CF-669 Cisco IOS Configuration Fundamentals Command Reference April 2010 Temp: Outlet R0 Normal 30 Celsius Temp: Inlet R0 Normal 25 Celsius Temp: Asic1 R0 Normal 30 Celsius Table 69 describes the significant fields shown in the display. Cisco 7000 Series Routers, Cisco 7200 Series Routers In the following example, the typical show environment display is shown when no warning conditions are in the system for the Cisco 7000 series and Cisco 7200 series routers. This information may vary slightly depending on the platform you are using. The date and time of the query are displayed, along with the data refresh information and a message indicating that there are no warning conditions. Router> show environment Environmental Statistics Environmental status as of 13:17:39 UTC Thu Jun 6 1996 Data is 7 second(s) old, refresh in 53 second(s) All Environmental Measurements are within specifications Table 70 describes the significant fields shown in the display. Table 69 show environment all Field Descriptions Field Description Sensor Sensor name. Location Chassis slot. State State description. One of the following values: • Critical—Critical alarm indicating a service-affecting condition. • Fan Speed—Fan speed (65% is normal). • Major—Major alarm indicating immediate action is needed. • Minor—Minor alarm indicating warning conditions. • Normal—Sensor reading is in acceptable range. • Shutdown—If automatic shutdown is enabled, indicates that the router will shut down. Reading Voltage or temperature detected by the sensor. Table 70 show environment Field Descriptions Field Description Environmental status as of... Current date and time. Data is..., refresh in... Environmental measurements are output into a buffer every 60 seconds, unless other higher-priority processes are running. Status message If environmental measurements are not within specification, warning messages are displayed. show environment CF-670 Cisco IOS Configuration Fundamentals Command Reference April 2010 NPE-G2 in Cisco 7200 VXR Routers In the following example, additional temperature and voltage readings for the NPE-G2 in the Cisco 7200 VXR router are displayed by the show environment all command. Power supplies 1 and 2 are on, and all monitored variables are within the normal operating range. Router_npe-g2# show environment all Power Supplies: Power Supply 1 is Zytek AC Power Supply. Unit is on. Power Supply 2 is Zytek AC Power Supply. Unit is on. Temperature readings: NPE Inlet measured at 25C/77F NPE Outlet measured at 28C/82F CPU Die measured at 56C/132F =======> additional temperature reading on NPE-G2 Voltage readings: +3.30 V measured at +3.32 V =======> additional voltage reading on NPE-G2 +1.50 V measured at +1.48 V =======> additional voltage reading on NPE-G2 +2.50 V measured at +2.46 V =======> additional voltage reading on NPE-G2 +1.80 V measured at +1.75 V =======> additional voltage reading on NPE-G2 +1.20 V measured at +1.17 V =======> additional voltage reading on NPE-G2 VDD_CPU measured at +1.28 V =======> additional voltage reading on NPE-G2 VDD_MEM measured at +2.50 V =======> additional voltage reading on NPE-G2 VTT measured at +1.25 V =======> additional voltage reading on NPE-G2 +3.45 V measured at +3.39 V -11.95 measured at -11.93 V +5.15 V measured at +4.96 V +12.15 V measured at +12.18 V Envm stats saved 0 time(s) since reload Table 71 show environment all Field Descriptions for NPE-G2 in Cisco 7200 VXR Router Field Description Power Supply x is present. Specifies whether the indicated (x) power supply slot is populated. If a power supply slot is populated, the manufacturer name and whether it is an AC or DC power supply is displayed. Unit is ... Indicates whether the power supply status is on or off. Temperature readings Indicates the temperature of air coming in and going out of the NPE Inlet, NPE Outlet, and CPU Die areas. NPE Inlet measured at 25C/77F Indicates that the temperature measurements at the inlet area of the chassis is 25C/77F, which is within normal operating range. System shutdown for NPE Inlet is 80C/176F. NPE Outlet measured at 28C/82F Indicates that the temperature measurements at the outlet area of the chassis is 28C/82F, which is within normal operating range. System shutdown for NPE Outlet is 84C/183F. CPU Die measured at 56C/132F Indicates that the temperature measurement at the CPU Die (internal silicon of the CPU) area of the chassis is 56C/132F, which is within normal operating range. System shutdown for CPU Die is 100C/212F. show environment CF-671 Cisco IOS Configuration Fundamentals Command Reference April 2010 In the following example, the show environment last command displays the previously saved measurements (readings) from the last environmental reading before the router was shut down. The command also displays the reason why the router was shut down, which was “power supply shutdown” in this case. Router_npe-g2# show environment last NPE Inlet previously measured at 26C/78F NPE Outlet previously measured at 28C/82F CPU Die previously measured at 56C/132F +3.30 V previously measured at +3.32 +1.50 V previously measured at +1.48 +2.50 V previously measured at +2.46 +1.80 V previously measured at +1.75 +1.20 V previously measured at +1.17 VDD_CPU previously measured at +1.28 VDD_MEM previously measured at +2.50 VTT previously measured at +1.25 +3.45 V previously measured at +3.39 -11.95 previously measured at -11.93 +5.15 V previously measured at +4.96 +12.15 V previously measured at +12.18 last shutdown reason - power supply shutdown Voltage readings: +3.30 V measured at +3.32 V +1.50 V measured at +1.48 V System voltage measurements that indicate the actual measured value for the specified power rail, which is named after the expected target value. For example, the +3.30 V rail, with an expected value of +3.30 V, actually measures at +3.32 V. This is within the target range. For example, the +1.50 V rail, with an expected value of +1.50 V, actually measures at +1.48 V. This is within the target range. VDD_CPU measured at +1.28 V Indicates +1.28 V is the measured voltage of the VDD_CPU power rail, which is within normal operating range. The expected value is 1.3 V. VDD_MEM measured at +2.50 V Indicates +2.50 V is the measured voltage of the VDD_MEM power rail, which is within normal operating range. The expected value is 2.5 V. VTT measured at +1.25 V Indicates +1.25 V is the measured voltage of the VTT power rail, which is within normal operating range. The expected value is 1.25 V. Table 71 show environment all Field Descriptions for NPE-G2 in Cisco 7200 VXR Router Field Description Table 72 show environment last Field Descriptions for NPE-G2 in Cisco 7200 VXR Router Field Description NPE Inlet previously measured at 26C/78F The last measured temperature of the inlet air of the router prior to shutdown. NPE Outlet previously measured at 28C/82F The last measured temperature of the outlet air of the router prior to shutdown. CPU Die previously measured at 56C/132F The last measured temperature of the CPU Die prior to shutdown. show environment CF-672 Cisco IOS Configuration Fundamentals Command Reference April 2010 In the following example, the show environment table command displays threshold levels in a table format of the environmental monitor parameters. It displays the high warning, high critical, and high shutdown temperature thresholds of the NPE inlet, NPE outlet, and CPU Die. It also displays the low and high critical voltage thresholds, and low and high shut down voltage thresholds for the power rails on the NPE-G2 in the Cisco 7200 VXR. Note The low range temperatures, such as the LowShut, LowCrit, and LowWarn temperature thresholds, are not checked and are not displayed on the NPE-G2. Also the warning voltage thresholds, such as LowWarn and HighWarn, are not checked and are not displayed on the NPE-G2. Router_npe-g2# show environment table Sample Point LowShut LowCrit LowWarn HighWarn HighCrit HighShut NPE Inlet 44C/111F 59C/138F NPE Outlet 49C/120F 64C/147F CPU Die 75C/167F 85C/185F System shutdown for NPE Inlet is 80C/176F System shutdown for NPE Outlet is 84C/183F System shutdown for CPU Die is 100C/212F +3.30 V +2.30 +3.12 +3.47 +4.29 +1.50 V +1.05 +1.40 +1.56 +1.95 +2.50 V +1.71 +2.34 +2.61 +3.28 +1.80 V +1.25 +1.67 +1.91 +2.34 +1.20 V +0.82 +1.13 +1.28 +1.56 VDD_CPU +0.89 +1.21 +1.36 +1.71 VDD_MEM +1.71 +2.34 +2.61 +3.28 VTT +0.85 +1.17 +1.32 +1.64 +3.45 V +2.38 +3.28 +3.63 +4.49 -11.95 V -8.44 -11.56 -12.84 -15.78 +5.15 V +3.59 +4.88 +5.42 +6.71 +12.15 V +8.55 +11.48 +12.77 +15.82 +3.30 V previously measured at +3.32 The last measured voltage of the 3.30 V power rail prior to shutdown. VDD_CPU previously measured at +1.28 The last measured voltage of the VDD_CPU power rail prior to shutdown. VDD_MEM previously measured at +2.50 The last measured voltage of the VDD_MEM power rail prior to shutdown. VTT previously measured at +1.25 The last measured voltage of the VTT power rail prior to shutdown. last shutdown reason Indicates the reason for the shutdown. Table 72 show environment last Field Descriptions for NPE-G2 in Cisco 7200 VXR Router Field Description show environment CF-673 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 73 show environment table Field Descriptions for NPE-G2 in Cisco 7200 VXR Router Field Description Sample Point This is the area for which temperature or system voltage thresholds are displayed. LowShut This is the LowShut voltage threshold. If the voltage value is below the LowShut threshold, the router shuts down. Note The LowShut temperature value is not checked and its threshold is not displayed on the NPE-G2. LowCrit This is the low critical voltage threshold. If the voltage value is below the LowCrit threshold, a critical message is issued for an out-of-tolerance voltage value. The system continues to operate. However, the system is approaching shutdown. Note The LowCrit temperature value is not checked and its threshold is not displayed on the NPE-G2. LowWarn The LowWarn temperature threshold and LowWarn voltage threshold are not checked and the threshold information is not displayed on the NPE-G2. HighWarn This is the HighWarn temperature threshold. If the temperature reaches the HighWarn threshold, a warning message is issued for an out-of-tolerance temperature value. The system continues to operate, but operator action is recommended to bring the system back to a normal state. Note The HighWarn voltage threshold is not checked and its threshold is not displayed on the NPE-G2. HighCrit This is the HighCrit temperature or voltage threshold. If the temperature or voltage reaches the HighCrit level, a critical message is issued. The system continues to operate. However, the system is approaching shutdown. Note Beware that if the temperature reaches or exceeds the HighShut value, a Shutdown message is issued and the router shuts down. HighShut This is the HighShut temperature or voltage threshold. If the temperature or voltage level reaches or exceeds the HighShut value, a Shutdown message is issued and the router shuts down. show environment CF-674 Cisco IOS Configuration Fundamentals Command Reference April 2010 NPE Inlet 44C/111F 59C/138F These are the HighWarn and HighCrit temperature thresholds, respectively, for the NPE Inlet. If the NPE Inlet temperature value reaches the HighWarn (44C/111F) and HighCrit (59C/138F) levels, warning and critical messages, respectively, are issued. If the value reaches 44C/111F or greater, you receive a warning message indicating HighWarn. The system continues to operate, but operator action is recommended to bring the system back to a normal state. If the value reaches 59C/138F or greater, you receive a critical (HighCrit) message instead, that indicates the system continues to operate, but the system is approaching shutdown. Note Beware if the temperature reaches or exceeds 80C/176F, which is the HighShut value, a Shutdown message is issued, and the NPE Inlet area shuts down. NPE Outlet 49C/120F 64C/147F These are the HighWarn and HighCrit temperature thresholds, respectively, for the NPE Outlet. If the NPE Outlet temperature value reaches the HighWarn (49C/120F) and HighCrit (64C/147F) levels, warning and critical messages, respectively, are issued. If the value reaches 49C/120F or greater, you receive a warning message indicating HighWarn. The system continues to operate, but operator action is recommended to bring the system back to a normal state. If the value reaches 64C/147F or greater, you receive a critical (HighCrit) message instead that indicates the system continues to operate, but the system is approaching shutdown. Note Beware if the temperature reaches or exceeds 84C/183F, which is the HighShut value, a Shutdown message is issued, and the NPE Outlet area shuts down. Table 73 show environment table Field Descriptions for NPE-G2 in Cisco 7200 VXR Router Field Description show environment CF-675 Cisco IOS Configuration Fundamentals Command Reference April 2010 CPU Die 75C/167F 85C/185F These are the HighWarn and HighCrit temperature thresholds, respectively, for the CPU Die. If the CPU Die temperature value reaches the HighWarn (75C/167F) and HighCrit (85C/185F) levels, warning and critical messages, respectively, are issued. If the value reaches 75C/167F or greater, you receive a warning message indicating HighWarn. The system continues to operate, but operator action is recommended to bring the system back to a normal state. If the value reaches 85C/185F or greater, you receive a critical (HighCrit) message instead, that indicates the system continues to operate, but the system is approaching shutdown. Note Beware if the temperature reaches or exceeds 100C/212F, which is the HighShut value, a Shutdown message is issued and the CPU Die area shuts down. System shutdown for NPE Inlet is 80C/176F This is the HighShut temperature threshold for the NPE Inlet. If the temperature reaches or exceeds 80C/176F, a Shutdown message is issued and the NPE Inlet area is shut down. System shutdown for NPE Outlet is 84C/183F This is the HighShut temperature threshold for the NPE Outlet. If the temperature reaches or exceeds 84C/183F, a Shutdown message is issued and the NPE Outlet area is shut down. System shutdown for CPU Die is 100C/212F This is the HighShut temperature threshold for the CPU Die. If the temperature reaches or exceeds 100C/212F, a Shutdown message is issued and the CPU Die area is shut down. +3.30 V +2.30 +3.12 +3.47 +4.29 The voltage thresholds for the +3.30 V power rail are as follows: • +2.30 is the LowShut voltage threshold. • +3.12 is the LowCrit voltage threshold. • +3.47 is the HighCrit voltage threshold. • +4.29 is the HighShut voltage threshold. Note The LowWarn and HighWarn voltage levels are not checked and their thresholds are not displayed on the NPE-G2. Table 73 show environment table Field Descriptions for NPE-G2 in Cisco 7200 VXR Router Field Description show environment CF-676 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco 7000 Series Routers The following are examples of messages that display on the system console when a measurement has exceeded an acceptable margin: ENVIRONMENTAL WARNING: Air flow appears marginal. ENVIRONMENTAL WARNING: Internal temperature measured 41.3(C) ENVIRONMENTAL WARNING: +5 volt testpoint measured 5.310(V) The system displays the following message if voltage or temperature exceed maximum margins: SHUTDOWN: air flow problem VDD_CPU +0.89 +1.21 +1.36 +1.71 The voltage thresholds for the VDD_CPU power rail are as follows: • +0.89 is the LowShut voltage threshold. • +1.21 is the LowCrit voltage threshold. • +1.36 is the HighCrit voltage threshold. • +1.71 is the HighShut voltage threshold. Note The LowWarn and HighWarn voltage levels are not checked and their thresholds are not displayed on the NPE-G2. VDD_MEM +1.71 +2.34 +2.61 +3.28 The voltage thresholds for the VDD_MEM power rail are as follows: • +1.71 is the LowShut voltage threshold. • +2.34 is the LowCrit voltage threshold. • +2.61 is the HighCrit voltage threshold. • +3.28 is the HighShut voltage threshold. Note The LowWarn and HighWarn voltage levels are not checked and their thresholds are not displayed on the NPE-G2. VTT +0.85 +1.17 +1.32 +1.64 The voltage thresholds for the VTT power rail are as follows: • +0.85 is the LowShut voltage threshold. • +1.17 is the LowCrit voltage threshold. • +1.32 is the HighCrit voltage threshold. • +1.64 is the HighShut voltage threshold. Note The LowWarn and HighWarn voltage levels are not checked and their thresholds are not displayed on the NPE-G2. Table 73 show environment table Field Descriptions for NPE-G2 in Cisco 7200 VXR Router Field Description show environment CF-677 Cisco IOS Configuration Fundamentals Command Reference April 2010 In the following example, there have been two intermittent power failures since a router was turned on, and the lower power supply is not functioning. The last intermittent power failure occurred on Monday, June 10, 1996, at 11:07 p.m. 7000# show environment all Environmental Statistics Environmental status as of 23:19:47 UTC Wed Jun 12 1996 Data is 6 second(s) old, refresh in 54 second(s) WARNING: Lower Power Supply is NON-OPERATIONAL Lower Power Supply:700W, OFF Upper Power Supply: 700W, ON Intermittent Powerfail(s): 2 Last on 23:07:05 UTC Mon Jun 10 1996 +12 volts measured at 12.05(V) +5 volts measured at 4.96(V) -12 volts measured at -12.05(V) +24 volts measured at 23.80(V) Airflow temperature measured at 38(C) Inlet temperature measured at 25(C) Table 74 describes the significant fields shown in the display. The following example is for the Cisco 7000 series routers. The router retrieves the environmental statistics at the time of the last shutdown. In this example, the last shutdown was Friday, May 19, 1995, at 12:40 p.m., so the environmental statistics at that time are displayed. Router# show environment last Environmental Statistics Environmental status as of 14:47:00 UTC Sun May 21 1995 Data is 6 second(s) old, refresh in 54 second(s) WARNING: Upper Power Supply is NON-OPERATIONAL LAST Environmental Statistics Environmental status as of 12:40:00 UTC Fri May 19 1995 Table 74 show environment all Field Descriptions for the Cisco 7000 Series Routers Field Description Environmental status as of... Date and time of last query. Data is..., refresh in... Environmental measurements are output into a buffer every 60 seconds, unless other higher-priority processes are running. WARNING: If environmental measurements are not within specification, warning messages are displayed. Lower Power Supply Type of power supply installed and its status (on or off). Upper Power Supply Type of power supply installed and its status (on or off). Intermittent Powerfail(s) Number of power hits (not resulting in shutdown) since the system was last booted. Voltage specifications System voltage measurements. Airflow and inlet temperature Temperature of air coming in and going out. show environment CF-678 Cisco IOS Configuration Fundamentals Command Reference April 2010 Lower Power Supply: 700W, ON Upper Power Supply: 700W, OFF No Intermittent Powerfails +12 volts measured at 12.05(V) +5 volts measured at 4.98(V) -12 volts measured at -12.00(V) +24 volts measured at 23.80(V) Airflow temperature measured at 30(C) Inlet temperature measured at 23(C) Table 75 describes the significant fields shown in the display. The following example shows sample output for the current environmental status in tables that list voltage and temperature parameters. There are three warning messages: one each about the lower power supply, the airflow temperature, and the inlet temperature. In this example, voltage parameters are shown to be in the normal range, airflow temperature is at a critical level, and inlet temperature is at the warning level. Router> show environment table Environmental Statistics Environmental status as of Mon 11-2-1992 17:43:36 Data is 52 second(s) old, refresh in 8 second(s) WARNING: Lower Power Supply is NON-OPERATIONAL WARNING: Airflow temperature has reached CRITICAL level at 73(C) WARNING: Inlet temperature has reached WARNING level at 41(C) Voltage Parameters: SENSE CRITICAL NORMAL CRITICAL -------|--------------------|------------------------|-------------------- +12(V) 10.20 12.05(V) 13.80 +5(V) 4.74 4.98(V) 5.26 -12(V) -10.20 -12.05(V) -13.80 +24(V) 20.00 24.00(V) 28.00 Table 75 show environment last Field Descriptions for the Cisco 7000 Series Routers Field Description Environmental status as of... Date and time of last query. Data is..., refresh in... Environmental measurements are output into a buffer every 60 seconds, unless other higher-priority processes are running. WARNING: If environmental measurements are not within specification, warning messages are displayed. LAST Environmental Statistics Displays test point values at time of the last environmental shutdown. Lower Power Supply Upper Power Supply For the Cisco 7000 router, indicates the status of the two 700W power supplies. For the Cisco 7010 router, indicates the status of the single 600W power supply. show environment CF-679 Cisco IOS Configuration Fundamentals Command Reference April 2010 Temperature Parameters: SENSE WARNING NORMAL WARNING CRITICAL SHUTDOWN -------|-------------|------------|-------------|--------------|----------- Airflow 10 60 70 73(C) 88 Inlet 10 39 41(C) 46 64 Table 76 describes the significant fields shown in the display. Cisco 7200 Series Routers The system displays the following message if the voltage or temperature enters the “Warning” range: %ENVM-4-ENVWARN: Chassis outlet 3 measured at 55C/131F The system displays the following message if the voltage or temperature enters the “Critical” range: %ENVM-2-ENVCRIT: +3.45 V measured at +3.65 V The system displays the following message if the voltage or temperature exceeds the maximum margins: %ENVM-0-SHUTDOWN: Environmental Monitor initiated shutdown The following message is sent to the console if a power supply has been inserted or removed from the system. This message relates only to systems that have two power supplies. %ENVM-6-PSCHANGE: Power Supply 1 changed from Zytek AC Power Supply to removed The following message is sent to the console if a power supply has been powered on or off. In the case of the power supply being shut off, this message can be due to the user shutting off the power supply or to a failed power supply. This message relates only to systems that have two power supplies. %ENVM-6-PSLEV: Power Supply 1 state changed from normal to shutdown The following is sample output from the show environment all command on the Cisco 7200 series routers when there is a voltage warning condition in the system: 7200# show environment all Power Supplies: Power supply 1 is unknown. Unit is off. Power supply 2 is Zytek AC Power Supply. Unit is on. Temperature readings: chassis inlet measured at 25C/77F chassis outlet 1 measured at 29C/84F Table 76 show environment table Field Descriptions for the Cisco 7000 Series Routers Field Description SENSE (Voltage Parameters) Voltage specification for a DC line. SENSE (Temperature Parameters) Air being measured. Inlet measures the air coming in, and Airflow measures the temperature of the air inside the chassis. WARNING System is approaching an out-of-tolerance condition. NORMAL All monitored conditions meet normal requirements. CRITICAL Out-of-tolerance condition exists. SHUTDOWN Processor has detected condition that could cause physical damage to the system. show environment CF-680 Cisco IOS Configuration Fundamentals Command Reference April 2010 chassis outlet 2 measured at 36C/96F chassis outlet 3 measured at 44C/111F Voltage readings: +3.45 V measured at +3.83 V:Voltage in Warning range! +5.15 V measured at +5.09 V +12.15 measured at +12.42 V -11.95 measured at -12.10 V Table 77 describes the significant fields shown in the display. The following example is for the Cisco 7200 series routers. This example shows the measurements immediately before the last shutdown and the reason for the last shutdown (if appropriate). 7200# show environment last chassis inlet previously measured at 27C/80F chassis outlet 1 previously measured at 31C/87F chassis outlet 2 previously measured at 37C/98F chassis outlet 3 previously measured at 45C/113F +3.3 V previously measured at 4.02 +5.0 V previously measured at 4.92 +12.0 V previously measured at 12.65 -12.0 V previously measured at 11.71 last shutdown reason - power supply shutdown Table 78 describes the significant fields shown in the display. The following example is for the Cisco 7200 series routers. This information lists the temperature and voltage shutdown thresholds for each sensor. 7200# show environment table Sample Point LowCritical LowWarning HighWarning HighCritical chassis inlet 40C/104F 50C/122F chassis outlet 1 43C/109F 53C/127F chassis outlet 2 75C/167F 75C/167F Table 77 show environment all Field Descriptions for the Cisco 7200 Series Router Field Description Power Supplies Current condition of the power supplies including the type and whether the power supply is on or off. Temperature readings Current measurements of the chassis temperature at the inlet and outlet locations. Voltage readings Current measurement of the power supply test points. Table 78 show environment last Field Descriptions for the Cisco 7200 Series Router Field Description chassis inlet Temperature measurements at the inlet area of the chassis. chassis outlet Temperature measurements at the outlet areas of the chassis. voltages Power supply test point measurements. last shutdown reason Possible shutdown reasons are power supply shutdown, critical temperature, and critical voltage. show environment CF-681 Cisco IOS Configuration Fundamentals Command Reference April 2010 chassis outlet 3 55C/131F 65C/149F +3.45 V +2.76 +3.10 +3.80 +4.14 +5.15 V +4.10 +4.61 +5.67 +6.17 +12.15 V +9.72 +10.91 +13.37 +14.60 -11.95 V -8.37 -9.57 -14.34 -15.53 Shutdown system at 70C/158F Table 79 describes the significant fields shown in the display. Cisco 7500 Series Routers The sample output for the Cisco 7500 series routers may vary depending on the specific model (for example, the Cisco 7513 router). The following is sample output from the show environment all command on the Cisco 7500 series routers: 7500# show environment all Arbiter type 1, backplane type 7513 (id 2) Power supply #1 is 1200W AC (id 1), power supply #2 is removed (id 7) Active fault conditions: none Fan transfer point: 100% Active trip points: Restart_Inhibit 15 of 15 soft shutdowns remaining before hard shutdown 1 0123456789012 Dbus slots: X XX X card inlet hotpoint exhaust RSP(6) 35C/95F 47C/116F 40C/104F RSP(7) 35C/95F 43C/109F 39C/102F Shutdown temperature source is ‘hotpoint’ on RSP(6), requested RSP(6) +12V measured at 12.31 +5V measured at 5.21 -12V measured at -12.07 +24V measured at 22.08 Table 79 show environment table Field Descriptions for the Cisco 7200 Series Router Field Description Sample Point Area for which measurements are taken. LowCritical Level at which a critical message is issued for an out-of-tolerance voltage condition. The system continues to operate; however, the system is approaching shutdown. LowWarning Level at which a warning message is issued for an out-of-tolerance voltage condition. The system continues to operate, but operator action is recommended to bring the system back to a normal state. HighWarning Level at which a warning message is issued. The system continues to operate, but operator action is recommended to bring the system back to a normal state. HighCritical Level at which a critical message is issued. For the chassis, the router is shut down. For the power supply, the power supply is shut down. Shutdown system at The system is shut down if the specified temperature is met. show environment CF-682 Cisco IOS Configuration Fundamentals Command Reference April 2010 +2.5 reference is 2.49 PS1 +5V Current measured at 59.61 A (capacity 200 A) PS1 +12V Current measured at 5.08 A (capacity 35 A) PS1 -12V Current measured at 0.42 A (capacity 3 A) PS1 output is 378 W Table 80 describes the significant fields shown in the display. The following example is for the Cisco 7500 series routers. This example shows the measurements immediately before the last shutdown. 7500# show environment last RSP(4) Inlet previously measured at 37C/98F RSP(4) Hotpoint previously measured at 46C/114F Table 80 show environment all Field Descriptions for the Cisco 7500 Series Routers Field Description Arbiter type 1 Numbers indicating the arbiter type and backplane type. Power supply Number and type of power supply installed in the chassis. Active fault conditions: Lists any fault conditions that exist (such as power supply failure, fan failure, and temperature too high). Fan transfer point: Software-controlled fan speed. If the router is operating below its automatic restart temperature, the transfer point is reduced by 10 percent of the full range each minute. If the router is at or above its automatic restart temperature, the transfer point is increased in the same way. Active trip points: Compares temperature sensor against the values displayed at the bottom of the show environment table command output. 15 of 15 soft shutdowns remaining When the temperature increases above the “board shutdown” level, a soft shutdown occurs (that is, the cards are shut down, and the power supplies, fans, and CI continue to operate). When the system cools to the restart level, the system restarts. The system counts the number of times this occurs and keeps the up/down cycle from continuing forever. When the counter reaches zero, the system performs a hard shutdown, which requires a power cycle to recover. The soft shutdown counter is reset to its maximum value after the system has been up for 6 hours. Dbus slots: Indicates which chassis slots are occupied. card, inlet, hotpoint, exhaust Temperature measurements at the inlet, hotpoint, and exhaust areas of the card. The (6) and (7) indicate the slot numbers. Dual Route Switch Processor (RSP) chassis can show two RSPs. Shutdown temperature source Indicates which of the three temperature sources is selected for comparison against the “shutdown” levels listed with the show environment table command. Voltages (+12V, +5V, -12V, +24V, +2.5) Voltages measured on the backplane. PS1 Current measured on the power supply. show environment CF-683 Cisco IOS Configuration Fundamentals Command Reference April 2010 RSP(4) Exhaust previously measured at 52C/125F +12 Voltage previously measured at 12.26 +5 Voltage previously measured at 5.17 -12 Voltage previously measured at -12.03 +24 Voltage previously measured at 23.78 Table 81 describes the significant fields shown in the display. The following example is for the Cisco 7500 series router. This information lists the temperature and voltage thresholds for each sensor. These thresholds indicate when error messages occur. There are two level of messages: warning and critical. 7500# show environment table Sample Point LowCritical LowWarning HighWarning HighCritical RSP(4) Inlet 44C/111F 50C/122F RSP(4) Hotpoint 54C/129F 60C/140F RSP(4) Exhaust +12 Voltage 10.90 11.61 12.82 13.38 +5 Voltage 4.61 4.94 5.46 5.70 -12 Voltage -10.15 -10.76 -13.25 -13.86 +24 Voltage 20.38 21.51 26.42 27.65 2.5 Reference 2.43 2.51 Shutdown boards at 70C/158F Shutdown power supplies at 76C/168F Restart after shutdown below 40C/104F Table 82 describes the significant fields shown in the display. Table 81 show environment last Field Descriptions for the Cisco 7500 Series Routers Field Description RSP(4) Inlet, Hotpoint, Exhaust Temperature measurements at the inlet, hotpoint, and exhaust areas of the card. Voltages Voltages measured on the backplane. Table 82 show environment table Field Descriptions for the Cisco 7500 Series Routers Field Description Sample Point Area for which measurements are taken. LowCritical Level at which a critical message is issued for an out-of-tolerance voltage condition. The system continues to operate; however, the system is approaching shutdown. LowWarning Level at which a warning message is issued for an out-of-tolerance voltage condition. The system continues to operate, but operator action is recommended to bring the system back to a normal state. HighWarning Level at which a warning message is issued. The system continues to operate, but operator action is recommended to bring the system back to a normal state. HighCritical Level at which a critical message is issued. For the chassis, the router is shut down. For the power supply, the power supply is shut down. show environment CF-684 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco AS5300 Series Access Servers In the following example, keywords and options are limited according to the physical characteristics of the system is shown: as5300# show environment ? all All environmental monitor parameters last Last environmental monitor parameters table Temperature and voltage ranges | Output modifiers as5300# show environment table %This option not available on this platform Cisco 12000 Series GSRs The following examples are for the Cisco 12000 series GSRs. The following is sample output from the show environment command for a Cisco 12012 router. Slots 0 through 11 are the line cards, slots 16 and 17 are the clock and scheduler cards, slots 18 through 20 are the switch fabric cards, slots 24 through 26 are the power supplies, and slots 28 and 29 are the blowers. An “NA” in the table means that no values were returned. In some cases it is because the equipment is not supported for that environmental parameter (for example, the power supply and blowers in slots 24, 26, 28, and 29 do not have a 3V power supply, so an NA is displayed). Router# show environment Slot # 3V 5V MBUS 5V Hot Sensor Inlet Sensor (mv) (mv) (mv) (deg C) (deg C) 0 3300 4992 5040 42.0 37.0 2 3296 4976 5136 40.0 33.0 4 3280 4992 5120 38.5 31.5 7 3280 4984 5136 42.0 32.0 9 3292 4968 5160 39.5 31.5 11 3288 4992 5152 40.0 30.5 16 3308 NA 5056 42.5 38.0 17 3292 NA 5056 40.5 36.5 18 3304 NA 5176 36.5 35.0 19 3300 NA 5184 37.5 33.5 20 3304 NA 5168 36.5 34.0 24 NA 5536 5120 NA 31.5 26 NA 5544 5128 NA 31.5 28 NA NA 5128 NA NA 29 NA NA 5104 NA NA Slot # 48V AMP_48 (Volt) (Amp) 24 46 12 26 46 19 Shutdown boards at The card is shut down if the specified temperature is met. Shutdown power supplies at The system is shut down if the specified temperature is met. Restart after shutdown The system will restart when the specified temperature is met. Table 82 show environment table Field Descriptions for the Cisco 7500 (continued)Series Field Description show environment CF-685 Cisco IOS Configuration Fundamentals Command Reference April 2010 Slot # Fan 0 Fan 1 Fan 2 (RPM) (RPM) (RPM) 28 2160 2190 2160 29 2130 2190 2070 Table 83 describes the significant fields shown and lists the equipment supported by each environmental parameter. “NA” indicates that the reading could not be obtained, so the command should be run again. The following is sample output from the show environment all command for the Cisco 12008 router. Slots 0 through 7 are the line cards, slots 16 and 17 are the clock scheduler cards (the clock scheduler cards control the fans), slots 18 through 20 are the switch fabric cards, and slots 24 and 26 are the power supplies. The Cisco 12008 router does not support slots 25, 27, 28, and 29. An “NA” in the table means that no values were returned. In some cases it is because the equipment is not supported for that environmental parameter (for example, the power supplies in slots 24 and 26 do not have a hot sensor, so an NA is displayed). Router# show environment all Slot # Hot Sensor Inlet Sensor (deg C) (deg C) 2 31.0 22.0 5 33.5 26.5 16 25.5 21.5 18 22.0 21.0 19 22.5 21.0 24 NA 29.5 26 NA 24.5 Table 83 show environment Field Descriptions for the Cisco 12000 Series Routers Field Description Slot # Slot number of the equipment. On the Cisco 12012 router, slots 0 through 11 are the line cards, slots 16 and 17 are the clock and scheduler cards, slots 18 through 20 are the switch fabric cards, slots 24 through 27 are the power supplies, and slots 28 and 29 are the blowers. 3V (mv) Measures the 3V power supply on the card. The 3V power supply is on the line cards, GRP card, clock and scheduler cards, and switch fabric cards. 5V (mv) Measures the 5V power supply on the card. The 5V power supply is on the line cards, GRP card, and power supplies. MBUS 5V (mv) Measures the 5V MBus on the card. The 5V MBus is on all equipment. Hot Sensor (deg C) Measures the temperature at the hot sensor on the card. The hot sensor is on the line cards, GRP card, clock and scheduler cards, switch fabric cards, and blowers. Inlet Sensor (deg C) Measures the current inlet temperature on the card. The inlet sensor is on the line cards, GRP card, clock and scheduler cards, switch fabric cards, and power supplies. 48V (Volt) Measures the DC power supplies. AMP_48 (Amp) Measures the AC power supplies. Fan 0, Fan 1, Fan 2 (RPM) Measures the fan speed in rotations per minute. show environment CF-686 Cisco IOS Configuration Fundamentals Command Reference April 2010 Slot # 3V 5V MBUS 5V (mv) (mv) (mv) 2 3292 5008 5136 5 3292 5000 5128 16 3272 NA 5128 18 3300 NA 5128 19 3316 NA 5128 Slot # 5V MBUS 5V 48V AMP_48 (mv) (mv) (Volt) (Amp) 24 0 5096 3 0 26 5544 5144 47 3 Slot # Fan Information 16 Voltage 16V Speed slow: Main Fans Ok Power Supply fans Ok Alarm Indicators No alarms Slot # Card Specific Leds 16 Mbus OK SFCs Failed 18 Mbus OK 19 Mbus OK 24 Input Failed 26 Input Ok The following is sample output from the show environment table command for a Cisco 12012 router. The show environment table command lists the warning, critical, and shutdown limits on your system and includes the GRP card and line cards (slots 0 to 15), clock and scheduler cards (slots 16 and 17), switch fabric cards (slots 18 to 20), and blowers. Router# show environment table Hot Sensor Temperature Limits (deg C): Warning Critical Shutdown GRP/GLC (Slots 0-15) 40 46 57 CSC (Slots 16-17) 46 51 65 SFC (Slots 18-20) 41 46 60 Inlet Sensor Temperature Limits (deg C): Warning Critical Shutdown GRP/GLC (Slots 0-15) 35 40 52 CSC (Slots 16-17) 40 45 59 SFC (Slots 18-20) 37 42 54 3V Ranges (mv): Warning Critical Shutdown Below Above Below Above Below Above GRP/GLC (Slots 0-15) 3200 3400 3100 3500 3050 3550 CSC (Slots 16-17) 3200 3400 3100 3500 3050 3550 SFC (Slots 18-20) 3200 3400 3100 3500 3050 3550 5V Ranges (mv): Warning Critical Shutdown Below Above Below Above Below Above GRP/GLC (Slots 0-15) 4850 5150 4750 5250 4680 5320 MBUS_5V Ranges (mv): Warning Critical Shutdown Below Above Below Above Below Above GRP/GLC (Slots 0-15) 5000 5250 4900 5350 4750 5450 CSC (Slots 16-17) 4820 5150 4720 5250 4750 5450 SFC (Slots 17-20) 5000 5250 4900 5350 4750 5450 show environment CF-687 Cisco IOS Configuration Fundamentals Command Reference April 2010 Blower Operational Range (RPM): Top Blower: Warning Critical Below Below Fan 0 1000 750 Fan 1 1000 750 Fan 2 1000 750 Bottom Blower: Warning Critical Below Below Fan 0 1000 750 Fan 1 1000 750 Fan 2 1000 750 The following is sample output from the show environment leds command for a Cisco 12012 router. The show environment leds command lists the status of the MBus LEDs on the clock, scheduler, and the switch fabric cards. Router# show environment leds 16 leds Mbus OK 18 leds Mbus OK 19 leds Mbus OK 20 leds Mbus OK Cisco 7304 Router The following is sample output from the show environment all command on a Cisco 7304 router with modular services cards (MSCs) and shared port adapters (SPAs) installed: Router# show environment all Power Supplies: Power supply 1 is AC power supply. Unit is on. Power supply 2 is empty. Fans: Fan 1 is on. Fan 2 is on. Temperature readings: Active RP (NPEG100, slot 0): npeg100 outlet measured at 29C/84F npeg100 inlet measured at 34C/93F npeg100 hotspot measured at 35C/95F Line card (7304-MSC-100, slot 4): 7304-MSC-100 measured at 32C/89F Card in subslot 4/0: SPA-4FE-7304 inlet measured at 31C/87F SPA-4FE-7304 outlet measured at 32C/89F Voltage readings: Active RP (NPEG100, slot 0): npe outlet 2.5 V measured at 2.496 V npe outlet 3.3 V measured at 3.302 V npe outlet 5.0 V measured at 4.992 V npe outlet 12.0 V measured at 11.812 V npe outlet 3.3c V measured at 3.199 V npe inlet 1.5 V measured at 1.494 V npe outlet 1.8 V measured at 1.790 V npe outlet 1.2 V measured at 1.198 V npe outlet 1.2c V measured at 1.198 V show environment CF-688 Cisco IOS Configuration Fundamentals Command Reference April 2010 Line card (7304-MSC-100, slot 4): 7304-MSC-100 0.75 V measured at 0.733 V 7304-MSC-100 1.5 V measured at 1.494 V 7304-MSC-100 2.5 V measured at 2.483 V 7304-MSC-100 3.3 V measured at 3.250 V 7304-MSC-100 12 V measured at 11.937 V Card in subslot 4/0: SPA-4FE-7304 1.8V measured at 1.802 V SPA-4FE-7304 1.5V measured at 1.503 V SPA-4FE-7304 2.5V measured at 2.474 V SPA-4FE-7304 3.3V measured at 3.252 V SPA-4FE-7304 1.0V measured at 1.015 V Envm stats saved 13 time(s) since reload The following is sample output from the show environment last command on a Cisco 7304 router with MSCs and SPAs installed and an NSE-100: Router# show environment last Temperature information: NSE board: nse outlet is unmeasured nse inlet is unmeasured nse hotspot is unmeasured nse db is unmeasured Line card slot 4: 7304-MSC-100 is unmeasured Card in subslot 4/1: SPA-4FE-7304 inlet previously measured at 30C/86F SPA-4FE-7304 outlet previously measured at 32C/89F Voltage information: NSE board: nse outlet 1.8 V is unmeasured nse outlet 2.5 V is unmeasured nse outlet 3.3 V is unmeasured nse outlet 5 V is unmeasured nse outlet 12 V is unmeasured nse inlet 1.8 V is unmeasured nse inlet 3.3 V is unmeasured nse inlet 1.5 V is unmeasured nse hotspot 1.8 V is unmeasured nse db 1.65 V is unmeasured nse db 1.8 V is unmeasured Line card slot 4: 7304-MSC-100 0.75 V is unmeasured 7304-MSC-100 1.5 V is unmeasured 7304-MSC-100 2.5 V is unmeasured 7304-MSC-100 3.3 V is unmeasured 7304-MSC-100 12 V is unmeasured Card in subslot 4/1: SPA-4FE-7304 1.8V previously measured at 1.823 V SPA-4FE-7304 1.5V previously measured at 1.512 V SPA-4FE-7304 2.5V previously measured at 2.504 V SPA-4FE-7304 3.3V previously measured at 3.258 V SPA-4FE-7304 1.0V previously measured at 1.014 V Last shutdown reason: shutdown undefined show environment CF-689 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following is sample output from the show environment table command on a Cisco 7304 router with MSCs and SPAs installed: Router# show environment table Temperature tables: Active RP (NPEG100, slot 0): Sample Point HighWarning HighCritical HighShutdown npeg100 outlet 53C/127F 68C/154F 73C/163F npeg100 inlet 53C/127F 68C/154F 73C/163F npeg100 hotspot 53C/127F 68C/154F 73C/163F Line card (7304-MSC-100, slot 4): Sample Point HighWarning HighCritical HighShutdown 7304-MSC-100 48C/118F 63C/145F 68C/154F Card in subslot 4/0: Sample Point HighWarning HighCritical HighShutdown SPA-4FE-7304 inlet 52C/125F 67C/152F 72C/161F SPA-4FE-7304 outlet 52C/125F 67C/152F 72C/161F Voltage tables: Active RP (NPEG100, slot 0): Sample Point LowShut LowCrit LowWarn HighWarn HighCrit HighShut npe outlet 2.5 V 2.275 V 2.375 V 2.400 V 2.600 V 2.625 V 2.725 V npe outlet 3.3 V 3.003 V 3.135 V 3.185 V 3.415 V 3.465 V 3.597 V npe outlet 5.0 V 4.500 V 4.750 V 4.800 V 5.200 V 5.250 V 5.500 V npe outlet 12.0 V 9.960 V 10.440 V 10.800 V 13.200 V 13.560 V 14.040 V npe outlet 3.3c V 3.003 V 3.135 V 3.185 V 3.415 V 3.465 V 3.597 V npe inlet 1.5 V 1.350 V 1.425 V 1.455 V 1.545 V 1.575 V 1.650 V npe outlet 1.8 V 1.620 V 1.710 V 1.728 V 1.872 V 1.890 V 1.980 V npe outlet 1.2 V 1.128 V 1.164 V 1.167 V 1.233 V 1.236 V 1.272 V npe outlet 1.2c V 1.128 V 1.164 V 1.167 V 1.233 V 1.236 V 1.272 V Line card (7304-MSC-100, slot 4): Sample Point LowShut LowCrit LowWarn HighWarn HighCrit HighShut 7304-MSC-100 0.75 0.559 V 0.600 V 0.600 V 0.900 V 0.900 V 0.941 V 7304-MSC-100 1.5 V 1.350 V 1.440 V 1.455 V 1.545 V 1.560 V 1.650 V 7304-MSC-100 2.5 V 2.250 V 2.375 V 2.400 V 2.600 V 2.625 V 2.750 V 7304-MSC-100 3.3 V 2.970 V 3.135 V 3.168 V 3.432 V 3.465 V 3.630 V 7304-MSC-100 12 V 9.960 V 10.440 V 10.800 V 13.200 V 13.560 V 14.040 V Card in subslot 4/0: Sample Point LowShut LowCrit LowWarn HighWarn HighCrit HighShut SPA-4FE-7304 1.8V 1.620 V 1.710 V 1.728 V 1.872 V 1.890 V 1.980 V SPA-4FE-7304 1.5V 1.350 V 1.425 V 1.440 V 1.560 V 1.575 V 1.650 V SPA-4FE-7304 2.5V 2.250 V 2.375 V 2.400 V 2.600 V 2.625 V 2.750 V SPA-4FE-7304 3.3V 2.970 V 3.135 V 3.168 V 3.432 V 3.465 V 3.630 V SPA-4FE-7304 1.0V 0.900 V 0.950 V 0.960 V 1.040 V 1.050 V 1.100 V Table 84 describes the significant fields shown in the display. Table 84 show environment table Field Descriptions for the Cisco 7304 Router Field Description Sample Point Area for which measurements are taken. LowShut Lowest level for an out-of-tolerance condition at which the system shuts itself down. For out-of-tolerance conditions with SPA environment variables, only the SPA is shut down. LowCrit/LowCritical Level at which a critical message is issued for an out-of-tolerance voltage condition. The system continues to operate; however, the system is approaching shutdown. show environment CF-690 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands LowWarn/LowWarning Level at which a warning message is issued for an out-of-tolerance voltage condition. The system continues to operate, but operator action is recommended to bring the system back to a normal state. HighWarn/HighWarning Level at which a warning message is issued for an out-of-tolerance voltage condition. The system continues to operate, but operator action is recommended to bring the system back to a normal state. HighCrit/HighCritical Level at which a critical message is issued for an out-of-tolerance voltage condition. The system continues to operate; however, the system is approaching shutdown. HighShut/HighShutdown Highest level for an out-of-tolerance condition at which the system shuts itself down. For out-of-tolerance conditions with SPA environment variables, only the SPA is shut down. Table 84 show environment table Field Descriptions for the Cisco 7304 Router (continued) Field Description Command Description snmp-server enable traps envmon Controls (enables or disables) environmental monitoring SNMP notifications. snmp-server host Specifies how SNMP notifications should be sent (as traps or informs), the version of SNMP to use, the security level of the notifications (for SNMPv3), and the recipient (host) of the notifications. show environment alarm CF-691 Cisco IOS Configuration Fundamentals Command Reference April 2010 show environment alarm To display the information about the environmental alarm, use the show environment alarm command in user EXEC or privileged EXEC mode. show environment alarm [{status | threshold} [frutype]] Syntax Description Defaults If you do not enter a frutype, all the information about the environmental alarm status is displayed. Command Modes User EXEC Privileged EXEC Command History Usage Guidelines Valid values for the frutype are as follows: • clock number—1 and 2. • earl slot—See the Note for valid values. • module slot—See the Note for valid values. • rp slot—See the Note for valid values. • power-supply number—1 and 2. • supervisor slot—See the Note for valid values. • vtt number—1 to 3. Note The slot argument designates the module and port number. Valid values for slot depend on the chassis and module that are used. For example, if you have a 48-port 10/100BASE-T Ethernet module that is installed in a 13-slot chassis, valid values for the slot number are from 1 to 13 and valid values for the port number are from 1 to 48. status (Optional) Displays the operational FRU status. threshold (Optional) Displays the preprogrammed alarm thresholds. frutype (Optional) Alarm type; valid values are all, backplane, clock number, earl slot, fan-tray, module slot, rp slot, power-supply number, supervisor slot, and vtt number. See the Note for a list of valid values for number and slot. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show environment alarm CF-692 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples This example shows how to display all the information about the status of the environmental alarm: Router> show environment alarm threshold environmental alarm thresholds: power-supply 1 fan-fail: OK threshold #1 for power-supply 1 fan-fail: (sensor value != 0) is system minor alarm power-supply 1 power-output-fail: OK threshold #1 for power-supply 1 power-output-fail: (sensor value != 0) is system minor alarm fantray fan operation sensor: OK threshold #1 for fantray fan operation sensor: (sensor value != 0) is system minor alarm operating clock count: 2 threshold #1 for operating clock count: (sensor value < 2) is system minor alarm threshold #2 for operating clock count: (sensor value < 1) is system major alarm operating VTT count: 3 threshold #1 for operating VTT count: (sensor value < 3) is system minor alarm threshold #2 for operating VTT count: (sensor value < 2) is system major alarm VTT 1 OK: OK threshold #1 for VTT 1 OK: (sensor value != 0) is system minor alarm VTT 2 OK: OK threshold #1 for VTT 2 OK: (sensor value != 0) is system minor alarm VTT 3 OK: OK threshold #1 for VTT 3 OK: (sensor value != 0) is system minor alarm clock 1 OK: OK threshold #1 for clock 1 OK: (sensor value != 0) is system minor alarm clock 2 OK: OK threshold #1 for clock 2 OK: (sensor value != 0) is system minor alarm module 1 power-output-fail: OK threshold #1 for module 1 power-output-fail: (sensor value != 0) is system major alarm module 1 outlet temperature: 21C threshold #1 for module 1 outlet temperature: (sensor value > 60) is system minor alarm threshold #2 for module 1 outlet temperature: (sensor value > 70) is system major alarm module 1 inlet temperature: 25C threshold #1 for module 1 inlet temperature: (sensor value > 60) is system minor alarm threshold #2 for module 1 inlet temperature: (sensor value > 70) is system major alarm module 1 device-1 temperature: 30C threshold #1 for module 1 device-1 temperature: (sensor value > 60) is system minor alarm threshold #2 for module 1 device-1 temperature: (sensor value > 70) is system major alarm module 1 device-2 temperature: 29C threshold #1 for module 1 device-2 temperature: (sensor value > 60) is system minor alarm threshold #2 for module 1 device-2 temperature: (sensor value > 70) is system major alarm module 5 power-output-fail: OK show environment alarm CF-693 Cisco IOS Configuration Fundamentals Command Reference April 2010 threshold #1 for module 5 power-output-fail: (sensor value != 0) is system major alarm module 5 outlet temperature: 26C threshold #1 for module 5 outlet temperature: (sensor value > 60) is system minor alarm threshold #2 for module 5 outlet temperature: (sensor value > 75) is system major alarm module 5 inlet temperature: 23C threshold #1 for module 5 inlet temperature: (sensor value > 50) is system minor alarm threshold #2 for module 5 inlet temperature: (sensor value > 65) is system major alarm EARL 1 outlet temperature: N/O threshold #1 for EARL 1 outlet temperature: (sensor value > 60) is system minor alarm threshold #2 for EARL 1 outlet temperature: (sensor value > 75) is system major alarm EARL 1 inlet temperature: N/O threshold #1 for EARL 1 inlet temperature: (sensor value > 50) is system minor alarm threshold #2 for EARL 1 inlet temperature: (sensor value > 65) is system major alarm Router> Related Commands Command Description show environment status Displays the information about the operational FRU status. show environment temperature Displays the current temperature readings. show environment cooling CF-694 Cisco IOS Configuration Fundamentals Command Reference April 2010 show environment cooling To display the information about the cooling parameter, use the show environment cooling command in user EXEC or privileged EXEC mode. show environment cooling Syntax Description This command has no arguments or keywords. Defaults This command has no default settings. Command Modes User EXEC Privileged EXEC Command History Usage Guidelines This command is not supported in Cisco 7600 series routers that are configured with a Supervisor Engine 2. Examples This example shows how to display the information about the cooling parameter: Router> show environment cooling fan-tray 1: fan-tray 1 fan-fail: failed fan-tray 2: fan 2 type: FAN-MOD-9 fan-tray 2 fan-fail: OK chassis cooling capacity: 690 cfm ambient temperature: 55C chassis per slot cooling capacity: 75 cfm module 1 cooling requirement: 70 cfm module 2 cooling requirement: 70 cfm module 5 cooling requirement: 30 cfm module 6 cooling requirement: 70 cfm module 8 cooling requirement: 70 cfm module 9 cooling requirement: 30 cfm Router> Related Commands Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description hw-module fan-tray version Sets the fan-type (high or low power) version. show environment status CF-695 Cisco IOS Configuration Fundamentals Command Reference April 2010 show environment status To display the information about the operational FRU status, use the show environment status command in user EXEC or privileged EXEC mode. show environment status [frutype] Syntax Description Defaults If you do not enter a frutype, all FRU status information is displayed. Command Modes User EXEC Privileged EXEC Command History Usage Guidelines Valid values for the frutype are as follows: • all—No arguments. • backplane—No arguments. • clock number—1 and 2. • earl slot—See the Note for valid values. • fan-tray—No arguments. • module slot—See the Note for valid values. • power-supply number—1 and 2. • rp slot—See the Note for valid values. • supervisor slot—See the Note for valid values. • vtt number—1 to 3. Note The slot argument designates the module and port number. Valid values for slot depend on the chassis and module that are used. For example, if you have a 48-port 10/100BASE-T Ethernet module that is installed in a 13-slot chassis, valid values for the slot number are from 1 to 13 and valid values for the port number are from 1 to 48. frutype (Optional) FRU type; see the Note for a list of valid values. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(18)SXF The output of the show environment status power-supply command was changed to include information about the high-capacity power supplies. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show environment status CF-696 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples This example shows how to display the information about the environmental status: Router> show environment status backplane: operating clock count: 2 operating VTT count: 3 fan-tray: fantray fan operation sensor: OK VTT 1: VTT 1 OK: OK VTT 2: VTT 2 OK: OK VTT 3: VTT 3 OK: OK clock 1: clock 1 OK: OK, clock 1 clock-inuse: not-in-use clock 2: clock 2 OK: OK, clock 2 clock-inuse: in-use power-supply 1: power-supply 1 fan-fail: OK power-supply 1 power-output-fail: OK module 1: module 1 power-output-fail: OK module 1 outlet temperature: 21C module 1 inlet temperature: 25C module 1 device-1 temperature: 30C module 1 device-2 temperature: 29C EARL 1 outlet temperature: N/O EARL 1 inlet temperature: N/O module 5: module 5 power-output-fail: OK module 5 outlet temperature: 26C module 5 inlet temperature: 23C module 5 device-1 temperature: 26C module 5 device-2 temperature: 27C Router> This example shows how to display the information about the high-capacity power supplies: Route># show environment status power-supply 2 power-supply 2: power-supply 2 fan-fail: OK power-supply 2 power-input 1: none power-supply 2 power-input 2: AC low power-supply 2 power-input 3: AC high power-supply 2 power-input 4: AC high power-supply 2 power-output: low (mode 1) power-supply 2 power-output-fail: OK Table 85 describes the fields that are shown in the example. Table 85 show environment status Command Output Fields Field Description operating clock count Physical clock count. operating VTT count Physical VTT count. fan tray fan operation sensor System fan tray failure status. The failure of the system fan tray is indicated as a minor alarm. show environment status CF-697 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands VTT 1, VTT2, and VTT3 Status of the chassis backplane power monitors that are located on the rear of the chassis, under the rear cover. Operation of at least two VTTs is required for the system to function properly. A minor system alarm is signaled when one of the three VTTs fails. A major alarm is signaled when two or more VTTs fail and the supervisor engine is accessible through the console port. clock # clock-inuse Clock status. Failure of either clock is considered to be a minor alarm. power-supply # fan-fail Fan failure. Fan failures on either or both (if any) power supplies are considered minor alarms. power-input-fail Power input failure status (none, AC high, AC low). power-output-fail Power output failure status (high, low). outlet temperature Exhaust temperature value. inlet temperature Intake temperature value. device-1 and device-2 temperature Two devices that measure the internal temperature on each indicated module. The temperature shown indicates the temperature that the device is recording. The devices are not placed at an inlet or an exit but are additional reference points. Table 85 show environment status Command Output Fields (continued) Field Description Command Description show environment alarm Displays the information about the environmental alarm. show environment temperature Displays the current temperature readings. show environment temperature CF-698 Cisco IOS Configuration Fundamentals Command Reference April 2010 show environment temperature To display the current temperature readings, use the show environment temperature command in user EXEC or privileged EXEC mode. show environment temperature [frutype] Syntax Description Defaults If you do not enter a frutype, the module and EARL temperature readings are displayed. Command Modes User EXEC Privileged EXEC Command History Usage Guidelines Valid values for the frutype are as follows: • earl slot—See the Note below for valid values. • module slot—See the Note below for valid values. • rp slot—See the the Note below for valid values. • vtt number—1 to 3. • clock number—1 and 2. frutype (Optional) Field replaceable unit (FRU) type; see the “Usage Guidelines” section for a list of valid values. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17a)SX The show environment temperature module command output was updated to include the following information: • The name of the ASIC of this sensor. • The names of the ASIC are listed if there is more than one ASIC. • The type of sensor is listed if there is more than one sensor on the ASIC. • Current temperature. • Major/minor threshold as read in the IDPROM. • Status of whether the current temperature has exceeded any temperature thresholds. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show environment temperature CF-699 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note The slot argument designates the module and port number. Valid values for slot depend on the chassis and module that are used. For example, if you have a 48-port 10/100BASE-T Ethernet module that is installed in a 13-slot chassis, valid values for the slot number are from 1 to 13 and valid values for the port number are from 1 to 48. The show environment temperature module command output includes the updated information after an SCP response is received. In the output display, the following applies: • N/O means not operational—The sensor is broken, returning impossible values. • N/A means not available—The sensor value is presently not available; try again later. • VTT 1, 2, and 3 refer to the power monitors that are located on the chassis backplane under the rear cover. Examples This example shows how to display the temperature information for a specific module: Router> show environment temperature module 5 module 5 outlet temperature: 34C module 5 inlet temperature: 27C module 5 device-1 temperature: 42C module 5 device-2 temperature: 41C module 5 asic-1 (SSO-1) temp: 29C module 5 asic-2 (SSO-2) temp: 29C module 5 asic-3 (SSO-3) temp: 29C module 5 asic-4 (SSO-4) temp: 28C module 5 asic-5 (SSA-1) temp: 29C module 5 asic-6 (HYPERION-1) temp: 29C Router> This example shows how to display the temperature readings for all modules: Router> show environment temperature VTT 1 outlet temperature: 25C VTT 2 outlet temperature: 24C VTT 3 outlet temperature: 28C module 1 outlet temperature: 24C module 1 device-2 temperature: 29C RP 1 outlet temperature: 25C RP 1 inlet temperature: 29C EARL 1 outlet temperature: 25C EARL 1 inlet temperature: 22C module 5 outlet temperature: 27C module 5 inlet temperature: 22C Router> Table 86 describes the fields that are shown in the example. Table 86 show environment temperature Command Output Fields Field Description outlet temperature Exhaust temperature value. show environment temperature CF-700 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands inlet temperature Intake temperature value. device-1 and device-2 temperature Two devices that measure the internal temperature on the indicated module. The temperature shown indicates the temperature that the device is recording. The devices are not placed at an inlet or an exit but are additional reference points. Table 86 show environment temperature Command Output Fields Field Description Command Description show environment alarm Displays the information about the environmental alarm. show environment status Displays the information about the operational FRU status. show errdisable detect CF-701 Cisco IOS Configuration Fundamentals Command Reference April 2010 show errdisable detect To display the error-disable detection status, use the show errdisable detect command in user EXEC or privileged EXEC mode. show errdisable detect Syntax Description This command has no arguments or keywords. Defaults This command has no default settings. Command Modes User EXEC Privileged EXEC Command History Examples This example shows how to display the error-disable detection status: Router> show errdisable detect ErrDisable Reason Detection status ----------------- ---------------- udld Enabled bpduguard Enabled rootguard Enabled packet-buffer-err Enabled pagp-flap Enabled dtp-flap Enabled link-flap Enabled Router# Related Commands Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17b)SXA This command was changed to include packet-buffer error status information. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description errdisable detect cause Enables the error-disable detection. show errdisable recovery CF-702 Cisco IOS Configuration Fundamentals Command Reference April 2010 show errdisable recovery To display the information about the error-disable recovery timer, use the show errdisable recovery command in EXEC mode. show errdisable recovery Syntax Description This command has no arguments or keywords. Defaults This command has no default settings. Command Modes EXEC Command History Examples This example shows how to display the information about the error-disable recovery timer: Router# show errdisable recovery ErrDisable Reason Timer Status ----------------- -------------- udld Enabled bpduguard Enabled rootguard Enabled pagp-flap Enabled dtp-flap Enabled link-flap Enabled Timer interval:300 seconds Interfaces that will be enabled at the next timeout: Interface Errdisable reason Time left(sec) --------- ----------------- -------------- Fa9/4 link-flap 279 Related Commands Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description errdisable recovery Configures the recovery mechanism variables. show interfaces status Displays the interface status or a list of interfaces in an error-disabled state on LAN ports only. show fastblk CF-703 Cisco IOS Configuration Fundamentals Command Reference April 2010 show fastblk To display fast block memory information, use the show fastblk command in privileged EXEC mode. show fastblk [detailed] Syntax Description Command Modes Privileged EXEC (#) Command History Usage Guidelines Use this command to display allocated fast block memory pool details. When no memory pools are allocated, the “no fastblk memory pools allocated” message is displayed. Examples The following is sample output from the show fastblk command using the detailed keyword. The fields are self-explanatory. Router# show fastblk detailed Pool name: SCTP ApplReq flags:DYN_POOL total = 400 inuse = 0, free = 400, max = 0 increment = 200, threshold = 100, hist max = 400 alloc failures = 0, sub-pool creation failures = 0 subpool: blks = 0x62968A2C, total = 400, inuse= 0, free = 400 delete count = 0, flags: Pool name: SCTP BufSegHdr flags:DYN_POOL total = 9000 inuse = 0, free = 9000, max = 0 increment = 4500, threshold = 6750, hist max = 9000 alloc failures = 0, sub-pool creation failures = 0 subpool: blks = 0x62B8E2F4, total = 9000, inuse= 0, free = 9000 delete count = 0, flags: Pool name: SCTP DestAddr flags:DYN_POOL total = 80 inuse = 0, free = 80, max = 0 increment = 40, threshold = 20, hist max = 80 alloc failures = 0, sub-pool creation failures = 0 subpool: blks = 0x62972534, total = 80, inuse= 0, free = 80 delete count = 0, flags: Pool name: SCTP Addr flags:DYN_POOL POOL_HAS_GRWN total = 200 inuse = 100, free = 100, max = 0 increment = 50, threshold = 50, hist max = 200 alloc failures = 31, sub-pool creation failures = 0 subpool: blks = 0x6271B6D0, total = 50, inuse= 0, free = 50 delete count = 0, flags: DYN_SUBPOOL subpool: blks = 0x6271D730, total = 50, inuse= 0, free = 50 delete count = 0, flags: DYN_SUBPOOL subpool: blks = 0x6297680C, total = 100, inuse= 100, free = 0 delete count = 0, flags: Pool name: SCTP ChunkDesc flags:DYN_POOL detailed (Optional) Displays detailed allocated fast block memory pool information. Release Modification 12.4(22)T This command was introduced. show fastblk CF-704 Cisco IOS Configuration Fundamentals Command Reference April 2010 total = 9000 inuse = 0, free = 9000, max = 0 increment = 4500, threshold = 6750, hist max = 9000 alloc failures = 0, sub-pool creation failures = 0 subpool: blks = 0x62BE6160, total = 1471, inuse= 0, free = 1471 delete count = 0, flags: subpool: blks = 0x62D8D768, total = 7529, inuse= 0, free = 7529 delete count = 0, flags: Pool name: SCTP DgramHdr flags:DYN_POOL total = 9000 inuse = 0, free = 9000, max = 0 increment = 4500, threshold = 6750, hist max = 9000 alloc failures = 0, sub-pool creation failures = 0 subpool: blks = 0x62BFE848, total = 9000, inuse= 0, free = 9000 delete count = 0, flags: Pool name: SCTP Assoc flags:DYN_POOL total = 100 inuse = 0, free = 100, max = 0 increment = 50, threshold = 25, hist max = 100 alloc failures = 0, sub-pool creation failures = 0 subpool: blks = 0x62E0A778, total = 100, inuse= 0, free = 100 delete count = 0, flags: Pool name: SCTP Instance flags:DYN_POOL total = 200 inuse = 50, free = 150, max = 0 increment = 100, threshold = 50, hist max = 200 alloc failures = 0, sub-pool creation failures = 0 subpool: blks = 0x62C33434, total = 200, inuse= 50, free = 150 delete count = 0, flags: Pool name: SCTP Assoc Stats flags:DYN_POOL total = 100 inuse = 0, free = 100, max = 0 increment = 50, threshold = 25, hist max = 100 alloc failures = 0, sub-pool creation failures = 0 subpool: blks = 0x62C39EA0, total = 100, inus show file descriptors CF-705 Cisco IOS Configuration Fundamentals Command Reference April 2010 show file descriptors To display a list of open file descriptors, use the show file descriptors command in EXEC mode. show file descriptors Syntax Description This command has no arguments or keywords. Command Modes EXEC Command History Usage Guidelines File descriptors are the internal representations of open files. You can use this command to learn if another user has a file open. Examples The following is sample output from the show file descriptors command: Router# show file descriptors File Descriptors: FD Position Open PID Path 0 187392 0001 2 tftp://dirt/hampton/c4000-i-m.a 1 184320 030A 2 flash:c4000-i-m.a Table 87 describes the fields shown in the display. Release Modification 11.3 AA This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 87 show file descriptors Field Descriptions Field Description FD File descriptor. The file descriptor is a small integer used to specify the file once it has been opened. Position Byte offset from the start of the file. Open Flags supplied when opening the file. PID Process ID of the process that opened the file. Path Location of the file. show file information CF-706 Cisco IOS Configuration Fundamentals Command Reference April 2010 show file information To display information about a file, use the show file information command in EXEC mode. show file information file-url Syntax Description Command Modes EXEC Command History Examples The following is sample output from the show file information command: Router# show file information tftp://dirt/hampton/c2500-j-l.a tftp://dirt/hampton/c2500-j-l.a: type is image (a.out) [relocatable, run from flash] file size is 8624596 bytes, run size is 9044940 bytes [8512316+112248+420344] Foreign image Router# show file information slot0:c7200-js-mz slot0:c7200-js-mz: type is image (elf) [] file size is 4770316 bytes, run size is 4935324 bytes Runnable image, entry point 0x80008000, run from ram Router1# show file information nvram:startup-config nvram:startup-config: type is ascii text Table 88 describes the possible file types. file-url The URL of the file to display. Release Modification 11.3 AA This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 88 Possible File Types Types Description image (a.out) Runnable image in a.out format. image (elf) Runnable image in elf format. ascii text Configuration file or other text file. coff Runnable image in coff format. ebcdic Text generated on an IBM mainframe. show file information CF-707 Cisco IOS Configuration Fundamentals Command Reference April 2010 lzw compression Lzw compressed file. tar Text archive file used by the Channel Interface Processor (CIP). Table 88 Possible File Types (continued) Types Description show file systems CF-708 Cisco IOS Configuration Fundamentals Command Reference April 2010 show file systems To list available file systems, use the show file systems command in privileged EXEC mode. show file systems Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Usage Guidelines Use this command to learn the alias names, the Prefixes column in the output of the file systems that your router supports. Examples The following is sample output from the show file systems command: Router# show file systems File Systems: Size(b) Free(b) Type Flags Prefixes - - ram rw tmp: - - opaque rw system: 42541056 42541056 disk rw disk1: disk1:0:# * 512065536 30834688 disk rw disk0:# 65536000 19811932 flash rw bootflash: sup-bootflash: - - opaque ro ivfs: 129004 102228 nvram rw const_nvram: 125802334 0 opaque ro microcode: sup-microcode: 0 609689428 opaque rw image: sup-image: - - opaque rw null: - - opaque ro tar: 1964024 1949453 nvram rw nvram: - - network rw rcp: - - network rw tftp: - - network rw http: - - network rw ftp: Release Modification 11.3AA This command was introduced. 12.3(7)T This command was enhanced to display information about the ATA ROM monitor library (monlib) file. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI and the output was modified. 12.4(24)T This command was integrated into Cisco IOS Release 12.4(24)T and the output was modified. show file systems CF-709 Cisco IOS Configuration Fundamentals Command Reference April 2010 - - disk rw disk1:1: - - disk rw disk1:2: 512065536 30842880 disk rw slavedisk0:# - - disk rw slavedisk1: slavedisk1:0: 65536000 19328264 flash rw slavesup-bootflash: 1964024 1919757 nvram rw slavenvram: 129004 102228 nvram rw slaveconst_nvram: 65536000 65536000 flash rw slavebootflash: - - nvram rw slavercsf: - - opaque rw slavesystem: - - disk rw slavedisk1:1: - - disk rw slavedisk1:2: - - disk rw slavedisk1:3: Table 89 describes the significant fields shown in the display. Table 89 show file systems Field Descriptions Field Description Size(b) Amount of memory in the file system (in bytes). Free(b) Amount of free memory in the file system (in bytes). Type Type of file system. The file system can be one of the following types: • disk—The file system is for a rotating medium. • flash—The file system is for a flash memory device. • network—The file system is a network file system (TFTP, rcp, FTP, and so on). • nvram—The file system is for an NVRAM device. • opaque—The file system is a locally generated “pseudo” file system (for example, the “system”) or a download interface, such as brimux. • ram—The file system is for a RAM or EPROM device. • tty—The file system is for a collection of terminal devices. • unknown—The file system is of unknown type. Flags Permissions for the file system. The file system can have one of the following permission states: • ro—The file system is Read Only. • wo—The file system is Write Only. • rw—The file system is Read/Write. Prefixes Alias for the file system. Prefixes marked with a pound symbol (#) indicate a bootable disk. show flh-log CF-710 Cisco IOS Configuration Fundamentals Command Reference April 2010 show flh-log The show flh-log command has been replaced by the more flh:logfile command. See the description of the more flh:logfile command for more information. show fm inspect CF-711 Cisco IOS Configuration Fundamentals Command Reference April 2010 show fm inspect To display the list and status of the access control lists (ACLs) and ports on which context based access control (CBAC) is configured, use the show fm inspect command in user EXEC or privileged EXEC mode. show fm inspect [detail | interface type mod/port] Syntax Description Defaults This command has no default settings. Command Modes User EXEC Privileged EXEC Command History Usage Guidelines If you can configure a VLAN access control list (VACL) on the port before you configure CBAC, the status displayed is INACTIVE; otherwise, it is ACTIVE. If policy feature card (PFC) resources are exhausted, the command displays BRIDGE and is followed by the number of failed currently active NetFlow requests that have been sent to the MSFC2 for processing. The show fm inspect command output includes this information: • interface:—Interface on which the internet protocol (IP) inspect feature is enabled • (direction)—Direction in which the IP inspect feature is enabled (IN or OUT) • acl name:—Name that is used to identify packets being inspected • status:—(ACTIVE or INACTIVE) displays if HW-assist is provided for this interface+direction (ACTIVE=hardware assisted or INACTIVE) The optional detail keyword displays the ACEs that are part of the ACL that is used for IP inspect on the given interface direction. Examples This example shows how to display the list and status of CBAC-configured ACLs and ports: Router> show fm inspect detail (Optional) Displays all of the flow information. interface type Interface type; possible valid values are ethernet, fastethernet, gigabitethernet, tengigabitethernet, port-channel, pos, atm, null, tunnel, and ge-wan. mod/port Module and port number. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show fm inspect CF-712 Cisco IOS Configuration Fundamentals Command Reference April 2010 interface:Vlan305(in) status :ACTIVE acl name:deny interfaces: Vlan305(out):status ACTIVE Related Commands Command Description show fm summary Displays a summary of FM Information. show fm interface CF-713 Cisco IOS Configuration Fundamentals Command Reference April 2010 show fm interface To display the detailed information about the feature manager on a per-interface basis, use the show fm interface command in user EXEC or privileged EXEC mode. show fm interface {interface type mod/port | null interface-number | port-channel number | vlan vlan-id} Syntax Description Defaults This command has no default settings. Command Modes User EXEC Privileged EXEC Command History Usage Guidelines The pos, atm, and ge-wan keywords are supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2. The interface-number argument designates the module and port number. Valid values for interface-number depend on the specified interface type and the chassis and module that are used. For example, if you specify a Gigabit Ethernet interface and have a 48-port 10/100BASE-T Ethernet module that is installed in a 13-slot chassis, valid values for the module number are from 1 to 13 and valid values for the port number are from 1 to 48. The port-channel number values from 257 to 282 are supported on the CSM and the FWSM only. type Interface type; possible valid values are ethernet, fastethernet, gigabitethernet, tengigabitethernet, port-channel, pos, atm, null, tunnel, and ge-wan. mod/port Module and port number. null interface-number Specifies the null interface; the valid value is 0. port-channel number Specifies the channel interface; valid values are a maximum of 64 values ranging from 1 to 282. vlan vlan-id Specifies the virtual local area network (VLAN); valid values are from 1 to 4094. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17a)SX The order of the information that is displayed in the show fm interface vlan command output was changed. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show fm interface CF-714 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples This example shows how to display the detailed information about the feature manager on a specified interface: Router> show fm interface fastethernet 2/26 Interface:FastEthernet2/26 IP is enabled hw[EGRESS] = 1, hw[INGRESS] = 0 hw_force_default[EGRESS] = 0, hw_force_default[INGRESS] = 1 mcast = 0 priority = 2 reflexive = 0 inbound label:24 protocol:ip feature #:1 feature id:FM_IP_ACCESS ACL:113 vmr IP value #1:0, 0, 0, 0, 0, 0, 0, 6 - 1 vmr IP mask #1:0, 0, FFFF, FFFF, 0, 0, 0, FF vmr IP value #2:642D4122, 0, 0, 0, 1, 0, 0, 6 - 1 vmr IP mask #2:FFFFFFFF, 0, 0, 0, 1, 0, 0, FF vmr IP value #3:0, 64020302, 0, 0, 6, 0, 0, 6 - 1 vmr IP mask #3:0, FFFFFFFF, 0, 0, 6, 0, 0, FF vmr IP value #4:0, 64020302, 0, 0, A, 0, 0, 6 - 1 vmr IP mask #4:0, FFFFFFFF, 0, 0, A, 0, 0, FF vmr IP value #5:0, 64020302, 0, 0, 12, 0, 0, 6 - 1 vmr IP mask #5:0, FFFFFFFF, 0, 0, 12, 0, 0, FF vmr IP value #6:0, 0, 0, 0, 0, 0, 0, 0 - 2 vmr IP mask #6:0, 0, 0, 0, 0, 0, 0, 0 outbound label:3 protocol:ip feature #:1 feature id:FM_IP_WCCP Service ID:0 Service Type:0 Router> This example shows how to display the detailed information about the feature manager on a specific VLAN: Router> show fm interface vlan 21 Interface: Vlan21 IP is disabled hw_state[INGRESS] = not reduced, hw_state[EGRESS] = not reduced mcast = 0 priority = 0 flags = 0x0 inbound label: 8 Feature IP_VACL: ----------------------------------------------------------------------------- FM_FEATURE_IP_VACL_INGRESS i/f: Vl21 map name: test ============================================================================= ------------------------------------------------------------ IP Seq. No: 10 Seq. Result : VACL_ACTION_FORWARD_CAPTURE ------------------------------------------------------------ DPort - Destination Port SPort - Source Port Pro - Protocol X - XTAG TOS - TOS Value Res - VMR Result RFM - R-Recirc. Flag MRTNP - M-Multicast Flag R - Reflexive flag - F-Fragment flag - T-Tcp Control N - Non-cachable - M-More Fragments - P-Mask Priority(H-High, L-Low) Adj. - Adj. Index T - M(Mask)/V(Value) FM - Flow Mask NULL - Null FM SAO - Source Only FM DAO - Dest. Only FM SADA - Sour.& Dest. Only VSADA - Vlan SADA Only FF - Full Flow VFF - Vlan Full Flow F-VFF - Either FF or VFF A-VSD - Atleast VSADA show fm interface CF-715 Cisco IOS Configuration Fundamentals Command Reference April 2010 A-FF - Atleast FF A-VFF - Atleast VFF A-SON - Atleast SAO A-DON - Atleast DAO A-SD - Atleast SADA SHORT - Shortest A-SFF - Any short than FF A-EFF - Any except FF A-EVFF- Any except VFF A-LVFF- Any less than VFF ERR - Flowmask Error +----+-+---------------+---------------+-----+-----+---+---+-+---+-----+----+------+ |Indx|T| Dest Ip Addr | Source Ip Addr|DPort|SPort|Pro|RFM|X|ToS|MRTNP|Adj.| FM | +----+-+---------------+---------------+-----+-----+---+---+-+---+-----+----+------+ 1 V 22.2.2.2 21.1.1.1 0 0 0 --- 0 0 ----L ---- SHORT M 255.255.255.255 255.255.255.255 0 0 0 000 0 0 TM_PERMIT_RESULT 2 V 32.2.2.2 31.1.1.1 0 0 0 --- 0 0 ----L ---- SHORT M 255.255.255.255 255.255.255.255 0 0 0 000 0 0 TM_PERMIT_RESULT 3 V 0.0.0.0 0.0.0.0 0 0 0 --- 0 0 ----L ---- SHORT M 0.0.0.0 0.0.0.0 0 0 0 000 0 0 TM_L3_DENY_RESULT ------------------------------------------------------------ IP Seq. No: 65536 Seq. Result : VACL_ACTION_DROP ------------------------------------------------------------ +----+-+---------------+---------------+-----+-----+---+---+-+---+-----+----+------+ |Indx|T| Dest Ip Addr | Source Ip Addr|DPort|SPort|Pro|RFM|X|ToS|MRTNP|Adj.| FM | +----+-+---------------+---------------+-----+-----+---+---+-+---+-----+----+------+ 1 V 0.0.0.0 0.0.0.0 0 0 0 --- 0 0 ----L ---- SHORT M 0.0.0.0 0.0.0.0 0 0 0 000 0 0 TM_PERMIT_RESULT Router> Related Commands Command Description show fm summary Displays a summary of FM Information. show fm reflexive CF-716 Cisco IOS Configuration Fundamentals Command Reference April 2010 show fm reflexive To display the information about the reflexive entry for the dynamic feature manager, use the show fm reflexive command in privileged EXEC mode. show fm reflexive Syntax Description This command has no arguments or keywords. Defaults This command has no default settings. Command Modes Privileged EXEC Command History Examples This example shows how to display the information about the reflexive entry for the dynamic feature manager: Router# show fm reflexive Reflexive hash table: Vlan613:refacl, OUT-REF, 64060E0A, 64060D0A, 0, 0, 7, 783, 6 Router# Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show fm summary CF-717 Cisco IOS Configuration Fundamentals Command Reference April 2010 show fm summary To display a summary of feature manager information, use the show fm summary command in user EXEC or privileged EXEC mode. show fm summary Syntax Description This command has no arguments or keywords. Defaults This command has no default settings. Command Modes User EXEC Privileged EXEC Command History Examples This example shows how to display a summary of feature manager information: Router> show fm summary Current global ACL merge algorithm:BDD Interface:FastEthernet2/10 ACL merge algorithm used: inbound direction: ODM outbound direction:BDD TCAM screening for features is ACTIVE outbound TCAM screening for features is ACTIVE inbound Interface:FastEthernet2/26 ACL merge algorithm used: inbound direction: ODM outbound direction:BDD TCAM screening for features is ACTIVE outbound TCAM screening for features is INACTIVE inbound . . . Router> Related Commands Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show fm interface Displays the detailed information about the feature manager on a per-interface basis. show funi CF-718 Cisco IOS Configuration Fundamentals Command Reference April 2010 show funi To display the frame-based user-network interface information, use the show funi command in user EXEC or privileged EXEC mode. show funi {arp-server [atm atm-interface-number] | class-links {vpi/vci-value | vci-value | connection-name} | ilmi-configuration | ilmi-status [atm atm-interface-number] | map | pvc [vpi/vci-value | vci-value | connection-name | dbs | ppp] | route | traffic | vp [atm-vpi-number] | vc [atm-vcd-number | connection-name | detail [prefix {interface | vc_name | vcd | vpi/vci}] | interface atm atm-interface-number [connection-name | detail [prefix {interface | vc_name | vcd | vpi/vci}]] | range lower-vcd-limit upper-vcd-limit [connection-name | detail [prefix {interface | vc_name | vcd | vpi/vci}]] | interface atm atm-interface-number [connection-name | detail [prefix {interface | vc_name | vcd | vpi/vci}]] | summary [atm atm-interface-number]]} Syntax Description arp-server Displays Asynchronous Transfer Mode (ATM) address resolution protocol server table information. atm atm-interface-number (Optional) Specifies the ATM interface and the ATM interface number. class-links Displays ATM VC-class links information. vpi/vci-value (Optional) Specifies the Virtual Path Identifier or Virtual Channel Identifier (VPI/VCI) value (slash is mandatory). vci-value (Optional) Specifies the virtual circuit interface value. connection-name (Optional) Specifies the connection name. ilmi-configuration Displays the top-level Integrated Local Management Interface (ILMI) information. ilmi-status Display ATM interface ILMI information. map Displays ATM static mapping information. pvc Displays ATM Permanent Virtual Circuits (PVC) information. dbs Displays the DBS information on a virtual circuit. ppp Displays the PPP over ATM information route Displays ATM route information. traffic Displays ATM statistics. vp Displays ATM virtual path information. atm-vpi-number (Optional) Specifies the VPI number. vc Displays ATM virtual circuit information. atm-vcd-number (Optional) Specifies the ATM Virtual Circuit Descriptor (VCD) number. detail Displays the detailed information of all VCs. prefix (Optional) Specifies the prefix for the output ordering. interface Specifies the type of interface. When this keyword is used along with the prefix keyword it displays the interface values in ascending order. vc_name Displays the VC names in the alphabetical order. vcd Displays the VCD value in the ascending order. vpi/vci Displays the VPI/VCI value in the ascending order. show funi CF-719 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Modes User EXEC (>) Privileged EXEC (#) Command History Usage Guidelines Use this command to display the frame-based user-network interface information with the available keywords and arguments. Examples The following is sample output from the show funi traffic command. The fields are self-explanatory: Router# show funi traffic Input OAM Queue: 0/4136 (size/max) 0 Input packets 0 Output packets 0 Broadcast packets 0 Packets received on non-existent VC 0 Packets attempted to send on non-existent VC 0 OAM cells received F5 InEndloop: 0, F5 InSegloop: 0, F5 InAIS: 0, F5 InRDI: 0 F5 InEndcc: 0, F5 InSegcc: 0, F4 InEndloop: 0, F4 InSegloop: 0, F4 InAIS: 0, F4 InRDI: 0 0 OAM cells sent F5 OutEndloop: 0, F5 OutSegloop: 0, F5 OutAIS: 0 F5 OutRDI: 0 F5 OutEndcc: 0, F5 OutSegcc: 0, F4 OutEndloop: 0, F4 OutSegloop: 0, F4 OutRDI: 0 F4 OutAIS: 0 0 OAM cell drops The following is sample out from the show funi vc detail prefix interface command. The fields are self-explanatory: Router# show funi vc detail prefix interface Description: N/A ATM2/0 ATM2/0: VCD: 1, VPI: 1, VCI: 100 ATM2/0 UBR, PeakRate: 0 (0 cps) ATM2/0 AAL5-LLC/SNAP, etype:0x0, Flags: 0xC20, VCmode: 0x0, Encapsize: 12 ATM2/0 OAM frequency: 0 second(s) ATM2/0 InARP frequency: 15 minutes(s) ATM2/0 Transmit priority 6 ATM2/0 InPkts: 0, OutPkts: 0, InBytes: 0, OutBytes: 0 InCells: 0, OutCells: 0 ATM2/0 InPRoc: 0, OutPRoc: 0, Broadcasts: 0 ATM2/0 InFast: 0, OutFast: 0, InAS: 0, OutAS: 0 range Displays the range of VCs. lower-vcd-limit Specifies the lower limit VCD value. upper-vcd-limit Specifies the upper limit VCD value. summary Display summary of VCs. Release Modification 12.4(24)T This command was introduced. Cisco IOS XE 2.3 This command was implemented on Cisco ASR 1000 series routers. show funi CF-720 Cisco IOS Configuration Fundamentals Command Reference April 2010 ATM2/0 InPktDrops: 0, OutPktDrops: 0 ATM2/0 CrcErrors: 0, SarTimeOuts: 0, OverSizedSDUs: 0, LengthViolation: 0, CPIE0 ATM2/0 Out CLP=1 Pkts: 0, Cells: 0 ATM2/0 OAM cells received: 0 ATM2/0 OAM cells sent: 0 ATM2/0 Status: INACTIVE Description: N/A ATM2/0 ATM2/0: VCD: 2, VPI: 1, VCI: 101 ATM2/0 UBR, PeakRate: 0 (0 cps) ATM2/0 AAL5-LLC/SNAP, etype:0x0, Flags: 0xC20, VCmode: 0x0, Encapsize: 12 ATM2/0 OAM frequency: 0 second(s) The following is sample out from the show funi vc detail prefix vc_name command. The fields are self-explanatory: Router# show funi vc detail prefix vc_name Description: N/A ATM2/0: VCD: 1, VPI: 1, VCI: 100 UBR, PeakRate: 0 (0 cps) AAL5-LLC/SNAP, etype:0x0, Flags: 0xC20, VCmode: 0x0, Encapsize: 12 OAM frequency: 0 second(s) InARP frequency: 15 minutes(s) Transmit priority 6 InPkts: 0, OutPkts: 0, InBytes: 0, OutBytes: 0 InCells: 0, OutCells: 0 InPRoc: 0, OutPRoc: 0, Broadcasts: 0 InFast: 0, OutFast: 0, InAS: 0, OutAS: 0 InPktDrops: 0, OutPktDrops: 0 CrcErrors: 0, SarTimeOuts: 0, OverSizedSDUs: 0, LengthViolation: 0, CPIErrors: 0 Out CLP=1 Pkts: 0, Cells: 0 OAM cells received: 0 OAM cells sent: 0 Status: INACTIVE Description: N/A ATM2/0: VCD: 2, VPI: 1, VCI: 101 UBR, PeakRate: 0 (0 cps) AAL5-LLC/SNAP, etype:0x0, Flags: 0xC20, VCmode: 0x0, Encapsize: 12 OAM frequency: 0 second(s) InARP frequency: 15 minutes(s) The following is sample out from the show funi vc detail prefix pvi/vci command. The fields are self-explanatory: Router# show funi vc detail prefix vpi/vci Description: N/A VPI/VCI: 1/100 ATM2/0: VCD: 1, VPI: 1, VCI: 100 VPI/VCI: 1/100 UBR, PeakRate: 0 (0 cps) VPI/VCI: 1/100 AAL5-LLC/SNAP, etype:0x0, Flags: 0xC20, VCmode: 0x0, Encapsize: 2 VPI/VCI: 1/100 OAM frequency: 0 second(s) VPI/VCI: 1/100 InARP frequency: 15 minutes(s) VPI/VCI: 1/100 Transmit priority 6 VPI/VCI: 1/100 InPkts: 0, OutPkts: 0, InBytes: 0, OutBytes: 0 InCells: 0, OutCells: 0 VPI/VCI: 1/100 InPRoc: 0, OutPRoc: 0, Broadcasts: 0 VPI/VCI: 1/100 InFast: 0, OutFast: 0, InAS: 0, OutAS: 0 VPI/VCI: 1/100 InPktDrops: 0, OutPktDrops: 0 VPI/VCI: 1/100 CrcErrors: 0, SarTimeOuts: 0, OverSizedSDUs: 0, LengthViolation:0 VPI/VCI: 1/100 Out CLP=1 Pkts: 0, Cells: 0 VPI/VCI: 1/100 OAM cells received: 0 VPI/VCI: 1/100 OAM cells sent: 0 VPI/VCI: 1/100 Status: INACTIVE Description: N/A show funi CF-721 Cisco IOS Configuration Fundamentals Command Reference April 2010 VPI/VCI: 1/101 ATM2/0: VCD: 2, VPI: 1, VCI: 101 VPI/VCI: 1/101 UBR, PeakRate: 0 (0 cps) VPI/VCI: 1/101 AAL5-LLC/SNAP, etype:0x0, Flags: 0xC20, VCmode: 0x0, Encapsize: 2 show identity policy CF-722 Cisco IOS Configuration Fundamentals Command Reference April 2010 show identity policy To display identity policy information in a tabular form, use the show identity policy command in privileged EXEC mode. show identity policy [name] Syntax Description Command Modes Privileged EXEC (#) Command History Examples The following is output from the show identity policy command: Router# show identity policy Policy Name ACL Redirect ACL Redirect URL =============================================================================== p1 some-acl NONE NONE p2 another-acl redirect-acl http://www.foo.com/bar.html Router# The following is output for the policy named p2: Router# show identity policy p2 Name: p2 Description: NONE Access-Group: another-acl URL-Redirect Match ACL: redirect-acl URL-Redirect URL: http://www.foo.com/bar.html Router# Related Commands name (Optional) Name of the identity policy. Release Modification 12.2(18)SX This command was introduced. Command Description show running-configuration Displays the running configuration for a router. show identity profile CF-723 Cisco IOS Configuration Fundamentals Command Reference April 2010 show identity profile To display identity profile information in a tabular form, use the show identity profile command in privileged EXEC mode. show identity profile [ default | dot1x | eapoudp] Syntax Description Command Modes Privileged EXEC (#) Command History Examples The following is output from the show identity profile command: Router# show running identity profile Service Type: default Default Authorized Device Policy: NONE Default Non-Authorized Device Policy: NONE Device / Address / Mask Allowed Policy ============================================================== Cisco IP Phone Authorized DEFAULT Service Type: dot1x Default Authorized Device Policy: NONE Default Non-Authorized Device Policy: NONE Device / Address / Mask Allowed Policy ============================================================== 0001.0203.0405 / ffff.ffff.ffff Authorized p2 Service Type: eapoudp Device / Address / Mask Allowed Policy ============================================================== 10.0.0.0 / 255.0.0.0 Authorized p1 Router# Related Commands default (Optional) Displays default identity profile information. dot1x (Optional) Displays 802.1x identity profile information. eapoudp (Optional) Displays EAPoUDP identity profile information. Release Modification 12.2(18)SX This command was introduced. Command Description show running-configuration Displays the running configuration for a router. show gsr CF-724 Cisco IOS Configuration Fundamentals Command Reference April 2010 show gsr To display hardware information on the Cisco 12000 series Gigabit Switch Routers (GSRs), use the show gsr command in EXEC mode. show gsr [chassis-info [details]] Syntax Description Command Modes EXEC Command History Usage Guidelines Use this command to determine the type of hardware installed in your Cisco 12000 series GSR router. Examples The following is sample output from the show gsr command for a Cisco 12012 router. This command shows the type and state of the card installed in the slot. Router# show gsr Slot 0 type = Route Processor state = IOS Running MASTER Slot 7 type = 1 Port Packet Over SONET OC-12c/STM-4c state = Card Powered Slot 16 type = Clock Scheduler Card state = Card Powered PRIMARY CLOCK The following is sample output from the show gsr chassis-info command for a Cisco 12012 router: Router# show gsr chassis-info Backplane NVRAM [version 0x20] Contents - Chassis: type 12012 Fab Ver: 1 Chassis S/N: ZQ24CS3WT86MGVHL PCA: 800-3015-1 rev: A0 dev: 257 HW ver: 1.0 Backplane S/N: A109EXPR75FUNYJK MAC Addr: base 0000.EAB2.34FF block size: 1024 RMA Number: 0x5F-0x2D-0x44 code: 0x01 hist: 0x1A chassis-info (Optional) Displays backplane NVRAM information. details (Optional) In addition to the information displayed, this option includes hexadecimal output of the backplane NVRAM information. Release Modification 11.2GS This command was introduced to support the Cisco 12000 series GSRs. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show gt64010 (7200) CF-725 Cisco IOS Configuration Fundamentals Command Reference April 2010 show gt64010 (7200) To display all GT64010 internal registers and interrupt status on the Cisco 7200 series routers, use the show gt64010 command in EXEC mode. show gt64010 Syntax Description This command has no arguments or keywords. Command Modes EXEC Command History Usage Guidelines This command displays information about the CPU interface, DRAM/device address space, device parameters, direct memory access (DMA) channels, timers and counters, and protocol control information (PCI) internal registers. The information is generally useful for diagnostic tasks performed by technical support only. Examples The following is a partial sample output for the show gt64010 command: Router# show gt64010 GT64010 Channel 0 DMA: dma_list=0x6088C3EC, dma_ring=0x4B018480, dma_entries=256 dma_free=0x6088CECC, dma_reqt=0x6088CECC, dma_done=0x6088CECC thread=0x6088CEAC, thread_end=0x6088CEAC backup_thread=0x0, backup_thread_end=0x0 dma_working=0, dma_complete=6231, post_coalesce_frames=6231 exhausted_dma_entries=0, post_coalesce_callback=6231 GT64010 Register Dump: Registers at 0xB4000000 CPU Interface: cpu_interface_conf : 0x80030000 (b/s 0x00000380) addr_decode_err : 0xFFFFFFFF (b/s 0xFFFFFFFF) Processor Address Space : ras10_low : 0x00000000 (b/s 0x00000000) ras10_high : 0x07000000 (b/s 0x00000007) ras32_low : 0x08000000 (b/s 0x00000008) ras32_high : 0x0F000000 (b/s 0x0000000F) cs20_low : 0xD0000000 (b/s 0x000000D0) cs20_high : 0x74000000 (b/s 0x00000074) cs3_boot_low : 0xF8000000 (b/s 0x000000F8) cs3_boot_high : 0x7E000000 (b/s 0x0000007E) pci_io_low : 0x00080000 (b/s 0x00000800) pci_io_high : 0x00000000 (b/s 0x00000000) pci_mem_low : 0x00020000 (b/s 0x00000200) pci_mem_high : 0x7F000000 (b/s 0x0000007F) Release Modification 11.2 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show gt64010 (7200) CF-726 Cisco IOS Configuration Fundamentals Command Reference April 2010 internal_spc_decode : 0xA0000000 (b/s 0x000000A0) bus_err_low : 0x00000000 (b/s 0x00000000) bus_err_high : 0x00000000 (b/s 0x00000000) . . . show hardware CF-727 Cisco IOS Configuration Fundamentals Command Reference April 2010 show hardware To display the hardware-specific information for a router, use the show hardware command in user EXEC or privileged EXEC mode. show hardware Syntax Description This command has no arguments or keywords. Command Modes User EXEC (>) Privileged EXEC (#) Command History Usage Guidelines Use the show hardware command to display the hardware specific information for a router. Examples The following is sample output from the show hardware command: Router# show hardware Cisco IOS Software, 7200 Software (C7200-ADVENTERPRISEK9-M), Version 12.4(22)T,) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by Cisco Systems, Inc. Compiled Fri 10-Oct-08 10:10 by prod_rel_team ROM: System Bootstrap, Version 12.2(4r)B2, RELEASE SOFTWARE (fc2) BOOTLDR: 7200 Software (C7200-KBOOT-M), Version 12.3(16), RELEASE SOFTWARE (fc4) Router uptime is 1 day, 16 hours, 32 minutes System returned to ROM by reload at 04:13:23 UTC Wed Aug 12 2009 System image file is "disk0:Default-IOS-Image-Do-Not-Delete" Last reload reason: Reload Command This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately. A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html If you require further assistance please contact us by sending email to export@cisco.com. Release Modification 12.4(22)T This command was introduced. show hardware CF-728 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco 7206VXR (NPE400) processor (revision A) with 491520K/32768K bytes of memo. Processor board ID 31410931 R7000 CPU at 350MHz, Implementation 39, Rev 3.3, 256KB L2 Cache 6 slot VXR midplane, Version 2.7 Last reset from power-on PCI bus mb0_mb1 (Slots 0, 1, 3 and 5) has a capacity of 600 bandwidth points. Current configuration on bus mb0_mb1 has a total of 600 bandwidth points. This configuration is within the PCI bus capacity and is supported. PCI bus mb2 (Slots 2, 4, 6) has a capacity of 600 bandwidth points. Current configuration on bus mb2 has a total of 180 bandwidth points This configuration is within the PCI bus capacity and is supported. Please refer to the following document "Cisco 7200 Series Port Adaptor Hardware Configuration Guidelines" on Cisco.com for c7200 bandwidth points oversubscription and usage guidelines. 2 FastEthernet interfaces 4 Serial interfaces 125K bytes of NVRAM. 62976K bytes of ATA PCMCIA card at slot 0 (Sector size 512 bytes). 125440K bytes of ATA PCMCIA card at slot 1 (Sector size 512 bytes). 8192K bytes of Flash internal SIMM (Sector size 256K). Configuration register is 0x2002 Related Commands Command Description show interfaces Displays statistics for all interfaces configured on the router or access server. show health-monitor CF-729 Cisco IOS Configuration Fundamentals Command Reference April 2010 show health-monitor To display the system Health Monitor status information, use the show health-monitor command in user EXEC or privileged EXEC mode. show health-monitor [summary] Syntax Description Command Modes User EXEC (>) Privileged EXEC (#) Command History Usage Guidelines Use this command to display the state of the hardware and software subsystem. Health Monitor is a Cisco IOS subsystem that monitors the state of the individual hardware and software subsystems. This monitoring helps in early detection and recovery of faults in the subsystem. Examples The following is sample output from show health-monitor command. The fields are self explanatory. Router# show health-monitor summary Chassis: Power Supply Failure Temperature OK Fans OK Memory: Free Memory processor OK Memory Fragmentation Processor OK Free Memory I/O OK Memory Fragmentation I/O OK DFC's: Slot 1 - Empty DFC Not in operation Slot 2 - Empty DFC Not in operation Slot 3 - AS5X-FC OK Slot 4 - Empty DFC Not in operation Slot 5 - Empty DFC Not in operation Slot 6 - Empty DFC Not in operation Slot 7 - Empty DFC Not in operation summary (Optional) Displays a summary of the status information. Release Modification 15.0(1)M This command was introduced in a release earlier than Cisco IOS Release 15.0(1)M. show history CF-730 Cisco IOS Configuration Fundamentals Command Reference April 2010 show history To list the commands you have entered in the current EXEC session, use the show history command in EXEC mode. show history Syntax Description This command has no arguments or keywords. Command Modes EXEC Command History Usage Guidelines The command history feature provides a record of EXEC commands you have entered. The number of commands that the history buffer will record is determined by the history size line configuration command or the terminal history size EXEC command. Table 90 lists the keys and functions you can use to recall commands from the command history buffer. Examples The following is sample output from the show history command, which lists the commands the user has entered in EXEC mode for this session: Router# show history help where show hosts show history Router# Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 90 History Keys Key Function Ctrl-P or Up Arrow1 1. The arrow keys function only with ANSI-compatible terminals. Recalls commands in the history buffer in a backward sequence, beginning with the most recent command. Repeat the key sequence to recall successively older commands. Ctrl-N or Down Arrow1 Returns to more recent commands in the history buffer after recalling commands with Ctrl-P or the Up Arrow. Repeat the key sequence to recall successively more recent commands. show history CF-731 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Description history size Enables the command history function, or changes the command history buffer size for a particular line. terminal history size Enables the command history feature for the current terminal session, or changes the size of the command history buffer for the current terminal session. show history all CF-732 Cisco IOS Configuration Fundamentals Command Reference April 2010 show history all To display command history and reload information of a router, use the show history all command in user EXEC or privileged EXEC mode. show history all Syntax Description This command has no arguments or keywords. Command Modes User EXEC (>) Privileged EXEC (#) Command History Usage Guidelines Use the show history all command to display command history and reload information of a router. Examples The following is sample output from the show history all command: Router# show history all This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately. A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html If you require further assistance please contact us by sending email to export@cisco.com. Cisco 7206VXR (NPE400) processor (revision A) with 491520K/32768K bytes of memo. Processor board ID 31410931 R7000 CPU at 350MHz, Implementation 39, Rev 3.3, 256KB L2, 4096KB L3 Cache 6 slot VXR midplane, Version 2.7 Last reset from power-on PCI bus mb0_mb1 (Slots 0, 1, 3 and 5) has a capacity of 600 bandwidth points. Current configuration on bus mb0_mb1 has a total of 600 bandwidth points. This configuration is within the PCI bus capacity and is supported. PCI bus mb2 (Slots 2, 4, 6) has a capacity of 600 bandwidth points. Current configuration on bus mb2 has a total of 180 bandwidth points This configuration is within the PCI bus capacity and is supported. Release Modification 12.4(22)T This command was introduced. show history all CF-733 Cisco IOS Configuration Fundamentals Command Reference April 2010 Please refer to the following document "Cisco 7200 Series Port Adaptor Hardware Configuration Guidelines" on Cisco.com for c7200 bandwidth points oversubscription and usage guidelines. 2 FastEthernet interfaces 4 Serial interfaces 125K bytes of NVRAM. Installed image archive *Aug 12 04:17:08.415: %LINEPROTO-5-UPDOWN: Line protocol on Interface VoIP-Nullp *Aug 12 04:17:08.419: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state p *Aug 12 04:17:08.419: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state p *Aug 12 04:17:08.419: %LINK-3-UPDOWN: Interface Serial2/0, changed state to down *Aug 12 04:17:08.419: %LINK-3-UPDOWN: Interface Serial2/1, changed state to down *Aug 12 04:17:08.419: %LINK-3-UPDOWN: Interface Serial3/0, changed state to up *Aug 12 04:17:08.419: %LINK-3-UPDOWN: Interface Serial3/1, changed state to up *Aug 12 04:17:08.419: %LINEPROTO-5-UPDOWN: Line protocol on Interface SSLVPN-VIp 62976K bytes of ATA PCMCIA card at slot 0 (Sector size 512 bytes). 125440K bytes of ATA PCMCIA card at slot 1 (Sector size 512 bytes). 8192K bytes of Flash internal SIMM (Sector size 256K). *Aug 12 04:17:09.419: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEtherp *Aug 12 04:17:09.419: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEtherp *Aug 12 04:17:09.419: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/0n *Aug 12 04:17:09.419: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/1n *Aug 12 04:17:09.419: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial3/0p *Aug 12 04:17:09.419: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial3/1p *Aug 12 04:17:12.411: %LINK-3-UPDOWN: Interface Serial3/0, changed state to down *Aug 12 04:17:12.411: %LINK-3-UPDOWN: Interface Serial3/1, changed state to down *Aug 12 04:17:13.411: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial3/0n *Aug 12 04:17:13.411: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial3/1n --- System Configuration Dialog --- Would you like to enter the initial configuration dialog? [yes/no]: % Please answer 'yes' or 'no'. Would you like to enter the initial configuration dialog? [yes/no]: no Would you like to terminate autoinstall? [yes]: yes CMD: 'access-list 199 permit icmp host 10.10.10.10 host 20.20.20.20' 04:18:15 U9 CMD: 'crypto map NiStTeSt1 10 ipsec-manual' 04:18:15 UTC Wed Aug 12 2009 CMD: 'match address 199 ' 04:18:15 UTC Wed Aug 12 2009 CMD: 'set peer 20.20.20.20 ' 04:18:15 UTC Wed Aug 12 2009 CMD: 'exit' 04:18:15 UTC Wed Aug 12 2009 CMD: 'no access-list 199' 04:18:15 UTC Wed Aug 12 2009 CMD: 'no crypto map NiStTeSt1' 04:18:15 UTC Wed Aug 12 2009 *Aug 12 04:18:15.403: %SYS-5-RESTART: System restarted -- Cisco IOS Software, 7200 Software (C7200-ADVENTERPRISEK9-M), Version 12.4(22)T,) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by Cisco Systems, Inc. Compiled Fri 10-Oct-08 10:10 by prod_rel_team *Aug 12 04:18:15.415: %ENTITY_ALARM-6-INFO: ASSERT INFO Fa0/0 Physical Port Adm *Aug 12 04:18:15.415: %ENTITY_ALARM-6-INFO: ASSERT INFO Fa0/1 Physical Port Adm *Aug 12 04:18:15.499: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is OFF *Aug 12 04:18:15.499: %CRYPTO-6-GDOI_ON_OFF: GDOI is OFF *Aug 12 04:18:15.599: %ENTITY_ALARM-6-INFO: ASSERT INFO Se2/0 Physical Port Adm *Aug 12 04:18:15.599: %ENTITY_ALARM-6-INFO: ASSERT INFO Se2/1 Physical Port Adm *Aug 12 04:18:15.599: %ENTITY_ALARM-6-INFO: ASSERT INFO Se3/0 Physical Port Adm show history all CF-734 Cisco IOS Configuration Fundamentals Command Reference April 2010 *Aug 12 04:18:15.599: %ENTITY_ALARM-6-INFO: ASSERT INFO Se3/1 Physical Port Adm *Aug 12 04:18:15.599: %SNMP-5-COLDSTART: SNMP agent on host Router is undergoint *Aug 12 04:18:15.823: %SYS-6-BOOTTIME: Time taken to reboot after reload = 314s *Aug 12 04:18:16.715: %LINK-5-CHANGED: Interface Serial2/0, changed state to adn *Aug 12 04:18:16.719: %LINK-5-CHANGED: Interface FastEthernet0/0, changed staten *Aug 12 04:18:16.723: %LINK-5-CHANGED: Interface FastEthernet0/1, changed staten *Aug 12 04:18:16.727: %LINK-5-CHANGED: Interface Serial2/1, changed state to adn *Aug 12 04:18:16.727: %LINK-5-CHANGED: Interface Serial3/0, changed state to adn *Aug 12 04:18:16.727: %LINK-5-CHANGED: Interface Serial3/1, changed state to adn *Aug 12 04:18:17.719: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthern *Aug 12 04:18:17.723: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEther9 CMD: 'conf t' 04:18:30 UTC Wed Aug 12 2009 CMD: 'hostname 7206-3' 04:19:02 UTC Wed Aug 12 2009 CMD: 'ip host sjc-tftp02 171.69.17.17' 04:19:02 UTC Wed Aug 12 2009 CMD: 'ip host sjc-tftp01 171.69.17.19' 04:19:03 UTC Wed Aug 12 2009 CMD: 'ip host dirt 171.69.1.129' 04:19:03 UTC Wed Aug 12 2009 CMD: 'interface FastEthernet0/0' 04:19:03 UTC Wed Aug 12 2009 CMD: 'no ip proxy-arp' 04:19:03 UTC Wed Aug 12 2009 CMD: 'ip address 10.4.9.80 255.255.255.0' 04:19:03 UTC Wed Aug 12 2009 CMD: 'no shutdown' 04:19:04 UTC Wed Aug 12 2009 CMD: 'exit' 04:19:04 UTC Wed Aug 12 2009 CMD: 'ip classless' 04:19:05 UTC Wed Aug 12 2009 *Aug 12 04:19:06.123: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state p *Aug 12 04:19:06.123: %ENTITY_ALARM-6-INFO: CLEAR INFO Fa0/0 Physical Port Admi9 CMD: 'ip default-network 0.0.0.0' 04:19:06 UTC Wed Aug 12 2009 CMD: 'ip default-gateway 10.4.9.1' 04:19:06 UTC Wed Aug 12 2009 CMD: 'config-register 0x2002' 04:19:07 UTC Wed Aug 12 2009 Related Commands Command Description show history Displays commands entered in the current EXEC session. show hosts CF-735 Cisco IOS Configuration Fundamentals Command Reference April 2010 show hosts To display the default domain name, the style of name lookup service, a list of name server hosts, and the cached list of hostnames and addresses specific to a particular Domain Name System (DNS) view or for all configured DNS views, use the show hosts command in privileged EXEC mode. show hosts [vrf vrf-name] [view [view-name | default] [all] [hostname | summary] Syntax Description Command Modes Privileged EXEC (#) Command History vrf vrf-name (Optional) The vrf-name argument specifies the name of the Virtual Private Network (VPN) routing and forwarding (VRF) instance associated with the DNS view whose hostname cache entries are to be displayed. Default is the global VRF (that is, the VRF whose name is a NULL string) with the specified or default DNS view. Note More than one DNS view can be associated with a VRF. To uniquely identify a DNS view, specify both the view name and the VRF with which it is associated. view view-name (Optional) The view-name argument specifies the DNS view whose hostname cache information is to be displayed. Default is the default (unnamed) DNS view associated with the specified or global VRF. Note More than one DNS view can be associated with a VRF. To uniquely identify a DNS view, specify both the view name and the VRF with which it is associated. default (Optional) Displays the default view. all (Optional) Display all the host tables. hostname (Optional) The specified hostname cache information displayed is to be limited to entries for a particular hostname. Default is the hostname cache information for all hostname entries in the cache. summary (Optional) The specified hostname cache information is to be displayed in brief summary format. Disabled by default. Release Modification 10.0 This command was introduced. 12.2T Support was added for Cisco modem user interface feature. 12.4(4)T The vrf, all, and summary keywords and vrf-name and hostname arguments were added. 12.4(9)T The view keyword and view-name argument were added. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware. show hosts CF-736 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines This command displays the default domain name, the style of name lookup service, a list of name server hosts, and the cached list of hostnames and addresses specific to a particular DNS view or for all configured DNS views. If you specify the show hosts command without any optional keywords or arguments, only the entries in the global hostname cache will be displayed. If the output from this command extends beyond the bottom of the screen, press the Space bar to continue or press the Q key to terminate command output. Examples The following is sample output from the show hosts command with no parameters specified: Router# show hosts Default domain is CISCO.COM Name/address lookup uses domain service Name servers are 192.0.2.220 Host Flag Age Type Address(es) EXAMPLE1.CISCO.COM (temp, OK) 1 IP 192.0.2.10 EXAMPLE2.CISCO.COM (temp, OK) 8 IP 192.0.2.50 EXAMPLE3.CISCO.COM (temp, OK) 8 IP 192.0.2.115 EXAMPLE4.CISCO.COM (temp, EX) 8 IP 192.0.2.111 EXAMPLE5.CISCO.COM (temp, EX) 0 IP 192.0.2.27 EXAMPLE6.CISCO.COM (temp, EX) 24 IP 192.0.2.30 The following is sample output from the show hosts command that specifies the VRF vpn101: Router# show hosts vrf vpn101 Default domain is example.com Domain list: example1.com, example2.com, example3.com Name/address lookup uses domain service Name servers are 192.0.2.204, 192.0.2.205, 192.0.2.206 Codes: UN - unknown, EX - expired, OK - OK, ?? - revalidate temp - temporary, perm - permanent NA - Not Applicable None - Not defined Host Port Flags Age Type Address(es) user None (perm, OK) 0 IP 192.0.2.001 www.example.com None (perm, OK) 0 IP 192.0.2.111 192.0.2.112 Table 91 describes the significant fields shown in the display. Table 91 show hosts Field Descriptions Field Description Default domain Default domain name to be used to complete unqualified names if no domain list is defined. Domain list List of default domain names to be tried in turn to complete unqualified names. Name/address lookup Style of name lookup service. Name servers List of name server hosts. show hosts CF-737 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Host Learned or statically defined hostname. Statically defined hostname-to-address mappings can be added to the DNS hostname cache for a DNS view by using the ip hosts command. Port TCP port number to connect to when using the defined hostname in conjunction with an EXEC connect or Telnet command. Flags Indicates additional information about the hostname-to-IP address mapping. Possible values are as follows: • EX—Entries marked EX are expired. • OK—Entries marked OK are believed to be valid. • perm—A permanent entry is entered by a configuration command and is not timed out. • temp—A temporary entry is entered by a name server; the Cisco IOS software removes the entry after 72 hours of inactivity. • ??—Entries marked ?? are considered suspect and subject to revalidation. Age Number of hours since the software last referred to the cache entry. Type Type of address. For example, IP, Connectionless Network Service (CLNS), or X.121. If you have used the ip hp-host global configuration command, the show hosts command will display these hostnames as type HP-IP. Address(es) IP address of the host. One host may have up to eight addresses. Table 91 show hosts Field Descriptions (continued) Field Description Command Description clear host Removes static hostname-to-address mappings from the hostname cache for the specified DNS view or all DNS views. ip host Defines static hostname-to-address mappings in the DNS hostname cache for a DNS view. show html CF-738 Cisco IOS Configuration Fundamentals Command Reference April 2010 show html To display module and port information, use the show html command in privileged EXEC mode. show html {module [ports [l2]] | port [all | l2 | l3] [shortnames]} {command line | count | names | options} Syntax Description Command Modes Privileged EXEC (#) Command History Usage Guidelines Use the show html command to display module and port information. Examples The following is sample output from the show html command using the port and names keywords. The field descriptions are self-explanatory. Router# show html port names this[0] = "FastEthernet0/0"; this[1] = "FastEthernet0/1"; this[2] = "Serial2/0"; this[3] = "Serial2/1"; module Displays module information. ports (Optional) Displays the number of ports on the module. l2 (Optional) Displays information about the Layer2 (l2) module. port Displays port information. all (Optional)Displays information about the Layer 2 and Layer 3 modules. l2 (Optional) Displays information about the Layer2 (l2) module. l3 (Optional) Displays information about the Layer3 (l3) module. shortnames (Optional) Displays port short names. command Displays execute command over ports information. line Displays command to execute over modules information. count Displays the module count. names Displays the module names. options Displays the module options. Release Modification 12.4(24)T This command was introduced in a release earlier than Cisco IOS Release 12.4(24)T. 12.2(33)SXI This command was integrated into a release earlier than Cisco IOS Release 12.2(33)SXI. 12.2(33)SRC This command was integrated into a release earlier than Cisco IOS Release 12.2(33)SRC. show html CF-739 Cisco IOS Configuration Fundamentals Command Reference April 2010 this[4] = "Serial3/0"; this[5] = "Serial3/0.1"; this[6] = "Serial3/1"; this[7] = "Tunnel0"; this[8] = "Tunnel1"; this[9] = "Tunnel2"; this[10] = "Tunnel3"; this[11] = "Virtual-Access1"; this[12] = "Virtual-Template1"; this[13] = "vmi1"; this[14] = "vmi2"; The following is sample output from the show html command using the port, all, and options keywords. The ouput is self-explanatory. Router# show html port all options FastEthernet0/0 FastEthernet0/1 Serial2/0 Serial2/1 Serial3/0 Serial3/0.1 Serial3/1 Tunnel0 Tunnel1 Tunnel2 Tunnel3 Virtual-Access1 Virtual-Template1 VoIP-Null0 vmi1 vmi2 show idb CF-740 Cisco IOS Configuration Fundamentals Command Reference April 2010 show idb To display information about the status of interface descriptor blocks (IDBs), use the show idb command in privileged EXEC mode. show idb Syntax Description This command has nor arguments or keywords. Command Modes Privileged EXEC Command History Examples The following is sample output from the show idb command: Router# show idb Maximum number of Software IDBs 8192. In use 17. HWIDBs SWIDBs Active 5 14 Inactive 10 3 Total IDBs 15 17 Size each (bytes) 5784 2576 Total bytes 86760 43792 HWIDB#1 1 2 GigabitEthernet0/0 0 5, HW IFINDEX, Ether) HWIDB#2 2 3 GigabitEthernet9/0 0 5, HW IFINDEX, Ether) HWIDB#3 3 4 GigabitEthernet9/1 6 5, HW IFINDEX, Ether) HWIDB#4 4 5 GigabitEthernet9/2 6 5, HW IFINDEX, Ether) HWIDB#5 13 1 Ethernet0 4 5, HW IFINDEX, Ether) Table 92 describes the significant fields shown in the display. Release Modification 12.1 This command was introduced. 12.2(15)T The output of this command was changed to show additional information. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 92 show idb Field Descriptions Field Description In use Total number of software IDBs (SWIDBs) that have been allocated. This number never decreases. SWIDBs are never deallocated. Active Total number of hardware IDBs (HWIDBs) and SWIDBs that are allocated and in use. Inactive Total number of HWIDBs and SWIDBs that are allocated but not in use. Total Total number of HWIDBs and SWIDBs that are allocated. show idprom CF-741 Cisco IOS Configuration Fundamentals Command Reference April 2010 show idprom To display the identification programmable read-only memory (IDPROM) information for field-replaceable units (FRUs), use the show idprom command in privileged EXEC mode. show idprom {all | frutype} [detail] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Valid entries for frutype are as follows: • backplane • clock number—1 and 2. • earl slot—See the following paragraph for valid slot values. • module slot/port | {slot | slot/subslot [clei] }—See the following paragraphs for valid values and descriptions. • rp slot—See the following paragraph for valid slot values. • power-supply—1 and 2. • supervisor slot—See the following paragraph for valid slot values. • transceiver {slot/subslot/port | slot/subslot [GigabitEthernet | GigabitEthernetWAN]} • vtt number—1 to 3. The module slot/port argument designates the module slot location and port number. Valid values for slot depend on the specified interface type and the chassis and module that are used. For example, if you specify a Gigabit Ethernet interface and have a 48-port 10/100BASE-T Ethernet module that is installed in a 13-slot chassis, valid values for the module number are from 1 to 13 and valid values for the port number are from 1 to 48. all Displays the information for all FRU types. frutype Type of FRU for information to be displayed; see the “Usage Guidelines” section for valid values. detail (Optional) Displays the detailed display of IDPROM data (verbose). Release Modification 12.2(14)SX This command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was integrated into Release 12.2(17d)SXB. 12.2(18)SXE The module keyword was modified to support slot/subslot addressing for shared port adapters (SPAs) and SPA interface processors (SIPs), and the optional clei keyword was added. The interface keyword was replaced by the transceiver keyword. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show idprom CF-742 Cisco IOS Configuration Fundamentals Command Reference April 2010 The module {slot | slot/subslot [clei]} syntax designates either the slot location alone of the SIP in the chassis (to show information for the SIP only), or the slot location of the SIP and the subslot location of a SPA installed within the SIP (to display information for a SPA only). Valid values for slot depend on the chassis model (2–13), and valid values for subslot depend on the SIP type (such as 0–3 for a Cisco 7600 SIP-200 and Cisco 7600 SIP-400). The optional clei keyword specifies display of the Common Language Equipment Identification (CLEI) information for the specified SIP or SPA. Use the show idprom backplane command to display the chassis serial number. Use the transceiver slot/subslot/port form of the command to display information for transceivers installed in a SPA, where slot designates the location of the SIP, subslot designates the location of the SPA, and port designates the interface number. The interface interface slot keyword and arguments supported on GBIC security-enabled interfaces have been replaced by the transceiver keyword option. To specify LAN Gigabit Ethernet interfaces, use the show idprom transceiver slot/subslot GigabitEthernet form of the command. • To specify WAN Gigabit Ethernet interfaces, use the show idprom transceiver slot/subslot GigabitEthernetWAN form of the command. Examples This example shows how to display IDPROM information for clock 1: Router# show idprom clock 1 IDPROM for clock #1 (FRU is 'Clock FRU') OEM String = 'Cisco Systems' Product Number = 'WS-C6000-CL' Serial Number = 'SMT03073115' Manufacturing Assembly Number = '73-3047-04' Manufacturing Assembly Revision = 'A0' Hardware Revision = 1.0 Current supplied (+) or consumed (-) = 0.000A Table 93 describes the significant fields shown in the display. Table 93 show idprom Field Descriptions Field Description FRU is Indicates the type of the field-replacement unit (FRU) to which the information that follows applies. OEM String Names the original equipment manufacturer (OEM). Product Number A number that identifies a product line. Serial Number A number that uniquely identifies the product itself. Manufacturing Assembly Number A number that identifies the hardware identification number. Manufacturing Assembly Revision A number that identifies the manufacturing assembly number. Hardware Revision A number that represents the hardware upgrade. Current supplied (+) or consumed (-) Indicated the amount of electrical current that the device supples or uses. show idprom CF-743 Cisco IOS Configuration Fundamentals Command Reference April 2010 This example shows how to display IDPROM information for power supply 1: Router# show idprom power-supply 1 IDPROM for power-supply #1 (FRU is '110/220v AC power supply, 1360 watt') OEM String = 'Cisco Systems, Inc.' Product Number = 'WS-CAC-1300W' Serial Number = 'ACP03020001' Manufacturing Assembly Number = '34-0918-01' Manufacturing Assembly Revision = 'A0' Hardware Revision = 1.0 Current supplied (+) or consumed (-) = 27.460A This example shows how to display detailed IDPROM information for power supply 1: Router# show idprom power-supply 1 detail IDPROM for power-supply #1 IDPROM image: (FRU is '110/220v AC power supply, 1360 watt') IDPROM image block #0: hexadecimal contents of block: 00: AB AB 01 90 11 BE 01 00 00 02 AB 01 00 01 43 69 ..............Ci 10: 73 63 6F 20 53 79 73 74 65 6D 73 2C 20 49 6E 63 sco Systems, Inc 20: 2E 00 57 53 2D 43 41 43 2D 31 33 30 30 57 00 00 ..WS-CAC-1300W.. 30: 00 00 00 00 00 00 41 43 50 30 33 30 32 30 30 30 ......ACP0302000 40: 31 00 00 00 00 00 00 00 00 00 33 34 2D 30 39 31 1.........34-091 50: 38 2D 30 31 00 00 00 00 00 00 41 30 00 00 00 00 8-01......A0.... 60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 70: 00 00 00 01 00 00 00 00 00 00 00 09 00 0C 00 03 ................ 80: 00 01 00 06 00 01 00 00 00 00 0A BA 00 00 00 00 ................ block-signature = 0xABAB, block-version = 1, block-length = 144, block-checksum = 4542 *** common-block *** IDPROM capacity (bytes) = 256 IDPROM block-count = 2 FRU type = (0xAB01,1) OEM String = 'Cisco Systems, Inc.' Product Number = 'WS-CAC-1300W' Serial Number = 'ACP03020001' Manufacturing Assembly Number = '34-0918-01' Manufacturing Assembly Revision = 'A0' Hardware Revision = 1.0 Manufacturing bits = 0x0 Engineering bits = 0x0 SNMP OID = 9.12.3.1.6.1.0 Power Consumption = 2746 centiamperes RMA failure code = 0-0-0-0 *** end of common block *** IDPROM image block #1: hexadecimal contents of block: 00: AB 01 01 14 02 5F 00 00 00 00 00 00 00 00 0A BA ....._.......... 10: 0A BA 00 16 .... block-signature = 0xAB01, block-version = 1, block-length = 20, block-checksum = 607 *** power supply block *** feature-bits: 00000000 00000000 rated current at 110v: 2746 rated current at 220v: 2746 (centiamperes) show idprom CF-744 Cisco IOS Configuration Fundamentals Command Reference April 2010 CISCO-STACK-MIB SNMP OID = 22 *** end of power supply block *** End of IDPROM image This example shows how to display IDPROM information for the backplane: Router# show idprom backplane IDPROM for backplane #0 (FRU is 'Catalyst 6000 9-slot backplane') OEM String = 'Cisco Systems' Product Number = 'WS-C6009' Serial Number = 'SCA030900JA' Manufacturing Assembly Number = '73-3046-04' Manufacturing Assembly Revision = 'A0' Hardware Revision = 1.0 Current supplied (+) or consumed (-) = 0.000A The following example shows sample output for a Cisco 7600 SIP-400 installed in slot 3 of the router: Router# show idprom module 3 IDPROM for module #3 (FRU is '4-subslot SPA Interface Processor-400') OEM String = 'Cisco Systems' Product Number = '7600-SIP-400' Serial Number = 'JAB0851042X' Manufacturing Assembly Number = '73-8404-10' Manufacturing Assembly Revision = '09' Hardware Revision = 0.95 Current supplied (+) or consumed (-) = -6.31A The following example shows sample output for the clei form of the command on a Cisco 7600 SIP-200 installed in slot 2 of the router: Router# show idprom module 2 clei FRU PID VID SN CLEI --------------- -------------------- --- ----------- ---------- module #2 7600-SIP-200 V01 The following example shows sample output for the detail form of the command on a Cisco 7600 SIP-400 installed in slot 3 of the router: Router# show idprom module 3 detail IDPROM for module #3 IDPROM image: (FRU is '4-subslot SPA Interface Processor-400') IDPROM image block #0: block-signature = 0xABAB, block-version = 3, block-length = 160, block-checksum = 4600 *** common-block *** IDPROM capacity (bytes) = 512 IDPROM block-count = 2 FRU type = (0x6003,1103) OEM String = 'Cisco Systems' Product Number = '7600-SIP-400' Serial Number = 'JAB0851042X' Manufacturing Assembly Number = '73-8404-10' Manufacturing Assembly Revision = '09' show idprom CF-745 Cisco IOS Configuration Fundamentals Command Reference April 2010 Manufacturing Assembly Deviation = '00' Hardware Revision = 0.95 Manufacturing bits = 0x0 Engineering bits = 0x0 SNMP OID = 9.5.1.3.1.1.2.1103 Power Consumption = -631 centiamperes RMA failure code = 0-0-0-0 CLEI = VID = *** end of common block *** IDPROM image block #1: block-signature = 0x6003, block-version = 2, block-length = 103, block-checksum = 2556 *** linecard specific block *** feature-bits = 00000000 00000000 hardware-changes-bits = 00000000 00000000 card index = 158 mac base = 0012.4310.D840 mac_len = 128 num_processors = 1 epld_num = 0 epld_versions = 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 port numbers: pair #0: type=00, count=00 pair #1: type=00, count=00 pair #2: type=00, count=00 pair #3: type=00, count=00 pair #4: type=00, count=00 pair #5: type=00, count=00 pair #6: type=00, count=00 pair #7: type=00, count=00 sram_size = 0 sensor_thresholds = sensor #0: critical = 75 oC, warning = 60 oC sensor #1: critical = 70 oC, warning = 55 oC sensor #2: critical = 80 oC, warning = 65 oC sensor #3: critical = 75 oC, warning = 60 oC sensor #4: critical = -128 oC (sensor not present), warning = -128 oC (sensor not present) sensor #5: critical = -128 oC (sensor not present), warning = -128 oC (sensor not present) sensor #6: critical = -128 oC (sensor not present), warning = -128 oC (sensor not present) sensor #7: critical = -128 oC (sensor not present), warning = -128 oC (sensor not present) max_connector_power = 3600 cooling_requirement = 35 ambient_temp = 55 *** end of linecard specific block *** End of IDPROM image The following example shows sample output for a 4-Port OC-3c/STM-1 ATM SPA installed in subslot 0 of the SIP installed in slot 5 of the router: Router# show idprom module 5/0 IDPROM for SPA module #5/0 (FRU is '4-port OC3/STM1 ATM Shared Port Adapter') Product Identifier (PID) : SPA-4XOC3-ATM Version Identifier (VID) : V01 PCB Serial Number : PRTA2604138 show idprom CF-746 Cisco IOS Configuration Fundamentals Command Reference April 2010 Top Assy. Part Number : 68-2177-01 73/68 Board Revision : 05 73/68 Board Revision : 01 Hardware Revision : 0.224 CLEI Code : UNASSIGNED The following example shows sample output for the clei form of the command for a 4-Port OC-3c/STM-1 POS SPA installed in subslot 3 of the SIP installed in slot 2 of the router: Router# show idprom module 2/3 clei FRU PID VID SN CLEI --------------- -------------------- --- ----------- ---------- SPA module #2/3 SPA-4XOC3-POS V01 PRTA0304155 UNASSIGNED The following example shows sample output for the detail form of the command for a 4-Port OC-3c/STM-1 POS SPA installed in subslot 3 of the SIP installed in slot 2 of the router: Router# show idprom module 2/3 detail IDPROM for SPA module #2/3 (FRU is '4-port OC3/STM1 POS Shared Port Adapter') EEPROM version : 4 Compatible Type : 0xFF Controller Type : 1088 Hardware Revision : 0.230 Boot Timeout : 0 msecs PCB Serial Number : PRTA0304155 Part Number : 73-9313-02 73/68 Board Revision : 04 Fab Version : 02 RMA Test History : 00 RMA Number : 0-0-0-0 RMA History : 00 Deviation Number : 0 Product Identifier (PID) : SPA-4XOC3-POS Version Identifier (VID) : V01 Top Assy. Part Number : 68-2169-01 73/68 Board Revision : 10 System Clock Frequency : 00 00 00 00 00 00 00 00 00 00 00 00 00 CLEI Code : UNASSIGNED Base MAC Address : 00 00 00 00 00 00 MAC Address block size : 0 Manufacturing Test Data : 00 00 00 00 00 00 00 00 Field Diagnostics Data : 00 00 00 00 00 00 00 00 Calibration Data : Minimum: 0 dBmV, Maximum: 0 dBmV Calibration values : Power Consumption : 16200 mWatts (Maximum) Environment Monitor Data : 01 08 F6 48 43 34 F6 48 43 34 02 31 0C E4 46 32 28 13 07 09 C4 46 32 28 13 07 00 00 00 00 00 00 00 05 DC 46 32 28 13 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FE 02 00 00 Asset ID : Asset Alias : show inventory CF-747 Cisco IOS Configuration Fundamentals Command Reference April 2010 show inventory To display the product inventory listing of all Cisco products installed in the networking device, use the show inventory command in user EXEC or privileged EXEC mode. show inventory [raw] [entity] Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines The show inventory command retrieves and displays inventory information about each Cisco product in the form of a UDI. The UDI is a combination of three separate data elements: a product identifier (PID), a version identifier (VID), and the serial number (SN). The PID is the name by which the product can be ordered; it has been historically called the “Product Name” or “Part Number.” This is the identifier that one would use to order an exact replacement part. The VID is the version of the product. Whenever a product has been revised, the VID will be incremented. The VID is incremented according to a rigorous process derived from Telcordia GR-209-CORE, an industry guideline that governs product change notices. The SN is the vendor-unique serialization of the product. Each manufactured product will carry a unique serial number assigned at the factory, which cannot be changed in the field. This is the means by which to identify an individual, specific instance of a product. The UDI refers to each product as an entity. Some entities, such as a chassis, will have subentities like slots. Each entity will display on a separate line in a logically ordered presentation that is arranged hierarchically by Cisco entities. Use the show inventory command without options to display a list of Cisco entities installed in the networking device that are assigned a PID. raw (Optional) Retrieves information about all of the Cisco products—referred to as entities—installed in the Cisco networking device, even if the entities do not have a product ID (PID) value, a unique device identifier (UDI), or other physical identification. entity (Optional) Name of a Cisco entity (for example, chassis, backplane, module, or slot). A quoted string may be used to display very specific UDI information; for example “sfslot 1” will display the UDI information for slot 1 of an entity named sfslot. Release Modification 12.3(4)T This command was introduced. 12.0(27)S This command was integrated into Cisco IOS Release 12.0(27)S. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(27)SBC This command was integrated into Cisco IOS Release 12.2(27)SBC. 12.2(18)SXE5 This command was integrated into Cisco IOS Release 12.2(18)SXE5. show inventory CF-748 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following is sample output from the show inventory command without any keywords or arguments. This sample output displays a list of Cisco entities installed in a router that are assigned a PID. Router# show inventory NAME: “Chassis”, DESCR: “12008/GRP chassis” PID: GSR8/40 , VID: V01, SN: 63915640 NAME: “slot 0”, DESCR: “GRP” PID: GRP-B , VID: V01, SN: CAB021300R5 NAME: “slot 1”, DESCR: “4 port ATM OC3 multimode” PID: 4OC3/ATM-MM-SC , VID: V01, SN: CAB04036GT1 NAME: “slot 3”, DESCR: “4 port 0C3 POS multimode” PID: LC-4OC3/POS-MM , VID: V01, SN: CAB014900GU NAME: “slot 5”, DESCR: “1 port Gigabit Ethernet” PID: GE-GBIC-SC-B , VID: V01, SN: CAB034251NX NAME: “slot 7”, DESCR: “GRP” PID: GRP-B , VID: V01, SN: CAB0428AN4O NAME: “slot 16”, DESCR: “GSR 12008 Clock Scheduler Card” PID: GSR8-CSC/ALRM , VID: V01, SN: CAB0429AUYH NAME: “sfslot 1”, DESCR: “GSR 12008 Switch Fabric Card” PID: GSR8-SFC , VID: V01, SN: CAB0428ALOS NAME: “sfslot 2”, DESCR: “GSR 12008 Switch Fabric Card” PID: GSR8-SFC , VID: V01, SN: CAB0429AU0M NAME: “sfslot 3”, DESCR: “GSR 12008 Switch Fabric Card” PID: GSR8-SFC , VID: V01, SN: CAB0429ARD7 NAME: “PSslot 1”, DESCR: “GSR 12008 AC Power Supply” PID: FWR-GSR8-AC-B , VID: V01, SN: CAB041999CW Table 94 describes the fields shown in the display. Table 94 show inventory Field Descriptions Field Description NAME Physical name (text string) assigned to the Cisco entity. For example, console or a simple component number (port or module number), such as “1,” depending on the physical component naming syntax of the device. DESCR Physical description of the Cisco entity that characterizes the object. The physical description includes the hardware serial number and the hardware revision. PID Entity product identifier. Equivalent to the entPhysicalModelName MIB variable in RFC 2737. VID Entity version identifier. Equivalent to the entPhysicalHardwareRev MIB variable in RFC 2737. SN Entity serial number. Equivalent to the entPhysicalSerialNum MIB variable in RFC 2737. show inventory CF-749 Cisco IOS Configuration Fundamentals Command Reference April 2010 For diagnostic purposes, the show inventory command can be used with the raw keyword to display every RFC 2737 entity including those without a PID, UDI, or other physical identification. Note The raw keyword option is primarily intended for troubleshooting problems with the show inventory command itself. Router# show inventory raw NAME: “Chassis”, DESCR: “12008/GRP chassis” PID: , VID: V01, SN: 63915640 NAME: “slot 0”, DESCR: “GRP” PID: , VID: V01, SN: CAB021300R5 NAME: “slot 1”, DESCR: “4 port ATM OC3 multimode” PID: 4OC3/ATM-MM-SC , VID: V01, SN: CAB04036GT1 NAME: “slot 3”, DESCR: “4 port 0C3 POS multimode” PID: LC-4OC3/POS-MM , VID: V01, SN: CAB014900GU Enter the show inventory command with an entity argument value to display the UDI information for a specific type of Cisco entity installed in the networking device. In this example, a list of Cisco entities that match the sfslot argument string is displayed. Router# show inventory sfslot NAME: “sfslot 1”, DESCR: “GSR 12008 Switch Fabric Card” PID: GSR8-SFC , VID: V01, SN: CAB0428ALOS NAME: “sfslot 2”, DESCR: “GSR 12008 Switch Fabric Card” PID: GSR8-SFC , VID: V01, SN: CAB0429AU0M NAME: “sfslot 3”, DESCR: “GSR 12008 Switch Fabric Card” PID: GSR8-SFC , VID: V01, SN: CAB0429ARD7 You can request even more specific UDI information using the show inventory command with an entity argument value that is enclosed in quotation marks. In this example, only the details for the entity that exactly matches the sfslot 1 argument string are displayed. Router# show inventory “sfslot 1” NAME: “sfslot 1”, DESCR: “GSR 12008 Switch Fabric Card” PID: GSR8-SFC , VID: V01, SN: CAB0428ALOS Related Commands Command Description show diag Displays diagnostic information about the controller, interface processor, and port adapters for a networking device. show tech-support Displays general information about the router when it reports a problem. show logging CF-750 Cisco IOS Configuration Fundamentals Command Reference April 2010 show logging To display the state of system logging (syslog) and the contents of the standard system logging buffer, use the show logging command in privileged EXEC mode. show logging [slot slot-number | summary] Syntax Description Command Modes Privileged EXEC (#) Command History Usage Guidelines This command runs on the privileged EXEC mode. To enter the privileged EXEC mode, type enable in the user EXEC mode and press Enter. Provide a password, if prompted. slot slot-number (Optional) Displays information in the syslog history table for a specific line card. Slot numbers range from 0 to 11 for the Cisco 12012 Internet router and 0 to 7 for the Cisco 12008 Internet router. summary (Optional) Displays counts of messages by type for each line card. Release Modification 10.0 This command was introduced. 11.2 GS This command was modified. The slot and summary keywords were added for the Cisco 12000. 12.2(8)T This command was modified. Command output was expanded to show the status of the logging count facility (“Count and time-stamp logging messages”). 12.2(15)T This command was modified. Command output was expanded to show the status of XML syslog formatting. 12.3(2)T This command was modified. Command output was expanded (on supported software images) to show details about the status of system logging processed through the Embedded Syslog Manager (ESM). These lines appear as references to “filtering” or “filter modules”. 12.3(2)XE This command was integrated into Cisco IOS Release 12.3(2)XE. 12.2(14)SX This command was integrated into Cisco IOS Release 12.2(14)SX. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.4(11)T This command was modified. Command-line interface (CLI) output was modified to show message discriminators defined at the router and syslog sessions associated with those message discriminators. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB. 12.2(33)SXI1 This command was modified. Support for the command in the user EXEC mode was removed. show logging CF-751 Cisco IOS Configuration Fundamentals Command Reference April 2010 This command displays the state of syslog error and event logging, including host addresses, and which logging destinations (console, monitor, buffer, or host) logging is enabled. This command also displays Simple Network Management Protocol (SNMP) logging configuration parameters and protocol activity. This command will also display the contents of the standard system logging buffer, if logging to the buffer is enabled. Logging to the buffer is enabled or disabled using the [no] logging buffered command. The number of system error and debugging messages in the system logging buffer is determined by the configured size of the syslog buffer. This size of the syslog buffer is also set using the logging buffered command. To enable and set the format for syslog message time stamping, use the service timestamps log command. If debugging is enabled (using any debug command), and the logging buffer is configured to include level 7 (debugging) messages, debug output will be included in the system log. Debugging output is not formatted like system error messages and will not be preceded by the percent symbol (%). Examples The following is sample output from the show logging command on a software image that supports the Embedded Syslog Manager (ESM) feature: Router> enable Router# show logging Syslog logging: enabled (10 messages dropped, 5 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled) Console logging: level debugging, 31 messages logged, xml disabled, filtering disabled Monitor logging: disabled Buffer logging: level errors, 36 messages logged, xml disabled, filtering disabled Logging Exception size (8192 bytes) Count and timestamp logging messages: disabled No active filter modules. Trap logging: level informational, 45 message lines logged Log Buffer (8192 bytes): The following example shows output from the show logging command after a message discriminator has been configured. Included in this example is the command to configure the message discriminator. Router(config)# logging discriminator ATTFLTR1 severity includes 1,2,5 rate-limit 100 Specified MD by the name ATTFLTR1 is not found. Adding new MD instance with specified MD attribute values. Router(config)# end Router# 000036: *Oct 20 16:26:04.570: %SYS-5-CONFIG_I: Configured from console by console Router> enable Router# show logging Syslog logging: enabled (11 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled) No Active Message Discriminator. show logging CF-752 Cisco IOS Configuration Fundamentals Command Reference April 2010 Inactive Message Discriminator: ATTFLTR1 severity group includes 1,2,5 rate-limit not to exceed 100 messages per second Console logging: level debugging, 25 messages logged, xml disabled, filtering disabled Monitor logging: level debugging, 0 messages logged, xml disabled, filtering disabled Buffer logging: level debugging, 25 messages logged, xml disabled, filtering disabled Logging Exception size (8192 bytes) Count and timestamp logging messages: disabled No active filter modules. Trap logging: level debugging, 28 message lines logged Logging to 172.25.126.15 (udp port 1300, audit disabled, authentication disabled, encryption disabled, link up), 28 message lines logged, 0 message lines rate-limited, 0 message lines dropped-by-MD, xml disabled, sequence number disabled filtering disabled Logging to 172.25.126.15 (tcp port 1307, audit disabled, authentication disabled, encryption disabled, link up), 28 message lines logged, 0 message lines rate-limited, 0 message lines dropped-by-MD, xml disabled, sequence number disabled, filtering disabled Logging to 172.20.1.1 (udp port 514, audit disabled, authentication disabled, encryption disabled, link up), 28 message lines logged, 0 message lines rate-limited, 0 message lines dropped-by-MD, xml disabled, sequence number disabled filtering disabled Log Buffer (1000000 bytes): Table 95 describes the significant fields shown in the output for the two preceding examples. Table 95 show logging Field Descriptions Field Description Syslog logging: Shows general state of system logging (enabled or disabled), the status of logged messages (number of messages dropped, rate-limited, or flushed), and whether XML formatting or ESM filtering is enabled. No Active Message Discriminator Indicates that a message discriminator is not being used. Inactive Message Discriminator: Identifies a configured message discriminator that has not been invoked. Console logging: Logging to the console port. Shows “disabled” or, if enabled, the severity level limit, number of messages logged, and whether XML formatting or ESM filtering is enabled. Corresponds to the configuration of the logging console, logging console xml, or logging console filtered command. show logging CF-753 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following example shows that syslog messages from the system buffer are included, with time stamps. In this example, the software image does not support XML formatting or ESM filtering of syslog messages. Router> enable Router# show logging Syslog logging:enabled (2 messages dropped, 0 flushes, 0 overruns) Monitor logging: Logging to the monitor (all TTY lines). Shows “disabled” or, if enabled, the severity level limit, number of messages logged, and whether XML formatting or ESM filtering is enabled. Corresponds to the configuration of the logging monitor, logging monitor xml, or logging monitor filtered command. Buffer logging: Logging to the standard syslog buffer. Shows “disabled” or, if enabled, the severity level limit, number of messages logged, and whether XML formatting or ESM filtering is enabled. Corresponds to the configuration of the logging buffered, logging buffered xml, or logging buffered filtered command. Trap logging: Logging to a remote host (syslog collector). Shows “disabled” or, if enabled, the severity level limit, number of messages logged, and whether XML formatting or ESM filtering is enabled. (The word “trap” means a trigger in the system software for sending error messages to a remote host.) Corresponds to the configuration of the logging host command. The severity level limit is set using the logging trap command. SNMP logging Displays whether SNMP logging is enabled, the number of messages logged, and the retransmission interval. If not shown on your platform, use the show logging history command. Logging Exception size (8192 bytes) Corresponds to the configuration of the logging exception command. Count and timestamp logging messages: Corresponds to the configuration of the logging count command. No active filter modules. Appears if no syslog filter modules are configured with the logging filter command. Syslog filter modules are Tcl script files used when the Embedded Syslog Manager (ESM) is enabled. ESM is enabled when any of the filtered keywords are used in the logging commands. If configured, the URL and filename of configured syslog filter modules will appear at this position in the output. Syslog filter modules are executed in the order in which they appear here. Log Buffer (8192 bytes): The value in parentheses corresponds to the configuration of the logging buffered buffer-size command. If no messages are currently in the buffer, the output ends with this line. If messages are stored in the syslog buffer, they appear after this line. Table 95 show logging Field Descriptions (continued) Field Description show logging CF-754 Cisco IOS Configuration Fundamentals Command Reference April 2010 Console logging:disabled Monitor logging:level debugging, 0 messages logged Buffer logging:level debugging, 4104 messages logged Trap logging:level debugging, 4119 message lines logged Logging to 192.168.111.14, 4119 message lines logged Log Buffer (262144 bytes): Jul 11 12:17:49 EDT:%BGP-4-MAXPFX:No. of prefix received from 209.165.200.225 (afi 0) reaches 24, max 24 ! THE FOLLOWING LINE IS A DEBUG MESSAGE FROM NTP. ! NOTE THAT IT IS NOT PRECEEDED BY THE % SYMBOL. Jul 11 12:17:48 EDT: NTP: Maxslew = 213866 Jul 11 15:15:41 EDT:%SYS-5-CONFIG:Configured from tftp://host.com/addc5505-rsm.nyiix .Jul 11 15:30:28 EDT:%BGP-5-ADJCHANGE:neighbor 209.165.200.226 Up .Jul 11 15:31:34 EDT:%BGP-3-MAXPFXEXCEED:No. of prefix received from 209.165.200.226 (afi 0):16444 exceed limit 375 .Jul 11 15:31:34 EDT:%BGP-5-ADJCHANGE:neighbor 209.165.200.226 Down BGP Notification sent .Jul 11 15:31:34 EDT:%BGP-3-NOTIFICATION:sent to neighbor 209.165.200.226 3/1 (update malformed) 0 bytes . . . The software clock keeps an “authoritative” flag that indicates whether the time is authoritative (believed to be accurate). If the software clock has been set by a timing source (for example, via NTP), the flag is set. If the time is not authoritative, it will be used only for display purposes. Until the clock is authoritative and the “authoritative” flag is set, the flag prevents peers from synchronizing to the software clock. Table 96 describes the symbols that precede the time stamp. The following is sample output from the show logging summary command for a Cisco 12012 router. A number in the column indicates that the syslog contains that many messages for the line card. For example, the line card in slot 9 has 1 error message, 4 warning messages, and 47 notification messages. Note For similar log counting on other platforms, use the show logging count command. Router> enable Router# show logging summary +-----+-------+-------+-------+-------+-------+-------+-------+-------+ SLOT | EMERG | ALERT | CRIT | ERROR |WARNING| NOTICE| INFO | DEBUG | Table 96 Time Stamping Symbols for syslog Messages Symbol Description Example * Time is not authoritative: the software clock is not in sync or has never been set. *15:29:03.158 UTC Tue Feb 25 2003: (blank) Time is authoritative: the software clock is in sync or has just been set manually. 15:29:03.158 UTC Tue Feb 25 2003: . Time is authoritative, but NTP is not synchronized: the software clock was in sync, but has since lost contact with all configured NTP servers. .15:29:03.158 UTC Tue Feb 25 2003: show logging CF-755 Cisco IOS Configuration Fundamentals Command Reference April 2010 +-----+-------+-------+-------+-------+-------+-------+-------+-------+ |* 0* | . | . | . | . | . | . | . | . | | 1 | | | | | | | | | | 2 | | | | 1 | 4 | 45 | | | | 3 | | | | | | | | | | 4 | | | | 5 | 4 | 54 | | | | 5 | | | | | | | | | | 6 | | | | | | | | | | 7 | | | | 17 | 4 | 48 | | | | 8 | | | | | | | | | | 9 | | | | 1 | 4 | 47 | | | | 10 | | | | | | | | | | 11 | | | | 12 | 4 | 65 | | | +-----+-------+-------+-------+-------+-------+-------+-------+-------+ Table 97 describes the logging level fields shown in the display. Related Commands Table 97 show logging summary Field Descriptions Field Description SLOT Indicates the slot number of the line card. An asterisk next to the slot number indicates the GRP card whose error message counts are not displayed. For information on the GRP card, use the show logging command. EMERG Indicates that the system is unusable. ALERT Indicates that immediate action is needed. CRIT Indicates a critical condition. ERROR Indicates an error condition. WARNING Indicates a warning condition. NOTICE Indicates a normal but significant condition. INFO Indicates an informational message only. DEBUG Indicates a debugging message. Command Description clear logging Clears messages from the logging buffer. logging count Enables the error log count capability. logging history size Changes the number of syslog messages stored in the history table of the router. logging linecard Logs messages to an internal buffer on a line card and limits the logging messages displayed on terminal lines other than the console line to messages with a level at or above level. service timestamps Configures the system to time-stamp debugging or logging messages. show logging count Displays a summary of system error messages (syslog messages) by facility and severity. show logging xml Displays the state of system logging and the contents of the XML-specific logging buffer. show logging count CF-756 Cisco IOS Configuration Fundamentals Command Reference April 2010 show logging count To display a summary of the number of times certain system error messages are occuring, use the show logging command in privileged EXEC mode. show logging count Syntax Description This command has no arguements or keywords. Command Modes Privileged EXEC Command History Usage Guidelines To enable the error log count capability (syslog counting feature), use the logging count command in global configuration mode. This feature works independently of the various settings of the other logging commands (such as [no] logging on, [no] logging buffered, and so on). In other words, turning off logging by other means does not stop the counting and timestamping from occuring. This command displays information such as the number of times a particular system error message occurs and the time stamp of the last occurrence of the specified message. System error messages are grouped into logical units called “Facilities” based on Cisco IOS software components. To determine if system error message counting is enabled, use the show logging command. The service timestamps command configuration determines the timestamp format (shown in the “Last Time” column) of show logging count command output. There is not quite enough space for all options of the possible options (datetime, milliseconds, and timezone) of the service timestamps datetime command to be displayed at the same time. As a result, if msec is selected, timezone will not be displayed. If show-timezone is selected but not msec, then the time zone will be displayed. Occasionally, the length of the message name plus the facility name contains too many characters to be printed on one line. The CLI attempts to keep the name and facility name on one line but, if necessary, the line will be wrapped, so that the first line contains the facility name and the second line contains the message name and the rest of the columns. Examples The following example shows the number of times syslog messages have occurred and the most recent time that each error message occurred. In this example, the show logging command is used to determine if the syslog counting feature is enabled: Router# show logging | include count Count and timestamp logging messages: enabled Router# show logging count Facility Message Name Sev Occur Last Time ============================================================================= Release Modification 12.2(8)T This command was introduced. show logging count CF-757 Cisco IOS Configuration Fundamentals Command Reference April 2010 SYS BOOTTIME 6 1 00:00:12 SYS RESTART 5 1 00:00:11 SYS CONFIG_I 5 1 00:00:05 ------------- ------------------------------- ----------------------------- SYS TOTAL 3 LINEPROTO UPDOWN 5 13 00:00:19 ------------- ------------------------------- ----------------------------- LINEPROTO TOTAL 13 LINK UPDOWN 3 1 00:00:18 LINK CHANGED 5 12 00:00:09 ------------- ------------------------------- ----------------------------- LINK TOTAL 13 SNMP COLDSTART 5 1 00:00:11 ------------- ------------------------------- ----------------------------- SNMP TOTAL 1 Table 98 describes the significant fields shown in the display. In the following example, the user is interested only in the totals: Router# show logging count | include total SYS TOTAL 3 LINEPROTO TOTAL 13 LINK TOTAL 13 SNMP TOTAL 1 Related Commands Table 98 show logging count Field Descriptions Field Description Facility The facility, such as syslog, from which these error messages are occurring. Message Name The name of this message. Sev The severity level of this message. Occur How many times this message has occurred. Last Time The last (most recent) time this message occurred. Timestamping is by default based on the system uptime (for example “3w1d” indicates 3 weeks and 1 day from the last system reboot.) Sys Total / Lineproto Total / Link Total / SNMP Total Total number of error messages that have occurred for the specified Facility. Command Description clear logging Clears messages from the logging buffer. logging count Enables the system error message log count capability. service timestamps Configures the system to time-stamp debugging or logging messages. show logging Displays general information about the state of system logging. show logging history CF-758 Cisco IOS Configuration Fundamentals Command Reference April 2010 show logging history To display information about the state of the syslog history table, use the show logging history command in privileged EXEC mode. show logging history Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Usage Guidelines This command displays information about the syslog history table, such as the table size, the status of messages, and text of messages stored in the table. Messages stored in the table are governed by the logging history global configuration command. Examples The following example shows sample output from the show logging history command. In this example, notifications of severity level 5 (notifications) through severity level 0 (emergencies) are configured to be written to the logging history table. Router# show logging history Syslog History Table: 1 maximum table entries, saving level notifications or higher 0 messages ignored, 0 dropped, 15 table entries flushed, SNMP notifications not enabled entry number 16: SYS-5-CONFIG_I Configured from console by console timestamp: 1110 Router# Table 99 describes the significant fields shown in the output. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 99 show logging history Field Descriptions Field Description maximum table entry Number of messages that can be stored in the history table. Set with the logging history size command. saving level notifications or higher Level of messages that are stored in the history table and sent to the SNMP server (if SNMP notification is enabled). The severity level can be configured with the logging history command. show logging history CF-759 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands messages ignored Number of messages not stored in the history table because the severity level is greater than that specified with the logging history command. dropped Number of messages that could not be processed due to lack of system resources. Dropped messages do not appear in the history table and are not sent to the SNMP server. table entries flushed Number of messages that have been removed from the history table to make room for newer messages. SNMP notifications Whether syslog traps of the appropriate level are sent to the SNMP server. The sending of syslog traps are enabled or disabled through the snmp-server enable traps syslog command. entry number: Number of the message entry in the history table. In the example above, the message "SYS-5-CONFIG_I Configured from console by console" indicates a syslog message consisting of the facility name (SYS), which indicates where the message came from, the severity level (5) of the message, the message name (CONFIG_I), and the message text. timestamp Time, based on the up time of the router, that the message was generated. Table 99 show logging history Field Descriptions (continued) Field Description Command Description clear logging Clears messages from the logging buffer. logging history Limits syslog messages sent to the router's history table to a specified severity level. logging history size Changes the number of syslog messages that can be stored in the history table. logging linecard Logs messages to an internal buffer on a line card. This command limits the logging messages displayed on terminal lines other than the console line to messages with a level at or above level. snmp-server enable traps The [no] snmp-server enable traps syslog form of this command controls (enables or disables) the sending of system-logging messages to a network management station. show logging system CF-760 Cisco IOS Configuration Fundamentals Command Reference April 2010 show logging system To display the System Event Archive (SEA) logs, use the show logging system command in user EXEC mode or privileged EXEC mode. show logging system [disk [file-location] | last [num-of-last-log-msgs]] Syntax Description Command Default This command has no default settings. Command Modes User EXEC (>) Privileged EXEC (#) Command History Usage Guidelines The show logging system command displays the latest messages first. Examples The following example shows a sample output of the show logging system command that displays the specified number of latest system log messages: Router# show logging system SEQ: MM/DD/YY HH:MM:SS MOD/SUB: SEV, COMP, MESSAGE ===================================================== 1: 01/24/07 15:38:40 6/-1 : MAJ, GOLD, syndiagSyncPinnacle failed in slot 6 2: 01/24/07 15:38:40 6/-1 : MAJ, GOLD, queryHyperionSynched[6]: Hyperion out of sync in sw_mode 1 3: 01/24/07 15:38:40 6/-1 : MAJ, GOLD, queryHyperionSynched[6]: Hyperion out of sync in sw_mode 1 4: 01/24/07 15:38:40 6/-1 : MAJ, GOLD, queryHyperionSynched[6]: Hyperion out of sync in sw_mode 1 5: 01/24/07 15:38:40 6/-1 : MAJ, GOLD, queryHyperionSynched[6]: Hyperion out of sync in sw_mode 1 6: 01/24/07 15:38:40 6/-1 : MAJ, GOLD, queryHyperionSynched[6]: Hyperion out of sync in sw_mode 1 disk (Optional) Displays SEA log disk, where the logs will be stored. disk file-location (Optional) Displays SEA logs from the specified file location. The disk keyword when used along with file-location argument displays SEA logs from the specified file location. last num-of-last-log-msgs (Optional) Displays the specified number of log messages. Release Modification 12.2(33)SXH This command was introduced. 12.2(33)SCC This command was introduced for the Cisco uBR10012 Router in the Cisco IOS Software Release 12.2(33)SCC. show logging system CF-761 Cisco IOS Configuration Fundamentals Command Reference April 2010 7: 01/24/07 15:38:39 6/-1 : MAJ, GOLD, queryHyperionSynched[6]: Hyperion out of sync in sw_mode 1 Table 100 describes the significant fields shown in the display. The following example shows a sample output of the show logging system command that displays SEA logs from the specified file location: Router# show logging system disk disk0:my_log.dat SEQ: MM/DD/YY HH:MM:SS MOD/SUB: SEV, COMP, MESSAGE ===================================================== 1: 02/01/95 00:35:51 2/3/-1: MAJ, GOLD, lc_ctrl_proc_obfl_info:test SEA log in DFC:Diagnostic OBFL testing 2: 02/01/95 00:35:09 2/5/-1: MAJ, GOLD, diag_hit_sys_limit[3/2]: sp_netint_thr[0] 3: 02/01/95 00:35:09 2/5/-1: MAJ, GOLD, diag_hit_sys_limit[3/2]: SP[81%],Tx_rate[408], Rx_rate[0] 4: 02/01/95 00:35:08 2/5/-1: MAJ, GOLD, diag_hit_sys_limit[3/2]: sp_netint_thr[0] 5: 02/01/95 00:35:08 2/5/-1: MAJ, GOLD, diag_hit_sys_limit[3/2]: SP[82%],Tx_rate[453], Rx_rate[0] 6: 02/01/95 00:35:08 2/5/-1: MAJ, GOLD, test_c2cot_hm_ch0_test[3]: port 13, chnl 0, Skipped Fabric Channel HM Test 7: 02/01/95 00:35:08 2/5/-1: MAJ, GOLD, fabric_hm_inband_loopback_test[3/13]:diag_hit_sys_limit!test skipped. 8: 02/01/95 00:35:08 2/5/-1: MAJ, GOLD, diag_hit_sys_limit[3/13]: sp_netint_thr[0] 9: 02/01/95 00:35:08 2/5/-1: MAJ, GOLD, diag_hit_sys_limit[3/13]: SP[83%], Tx_rate[453], Rx_rate[0] Cisco uBR10012 Universal Broadband Router The following example shows a sample output of the show logging system command on the Cisco uBR10012 Router: Router# show logging system SEQ: MM/DD/YY HH:MM:SS MOD/SUB: SEV, COMP, MESSAGE ===================================================== 1: 05/06/09 04:10:11 6/0: NON, SEATEST, "Test disk1":" The following command is used to identify the disk on PRE currently being used to store the sea_log.dat file. The following example shows a sample output of the show logging system disk command executed on the Cisco uBR10012 router: Router# show logging system disk SEA log disk: disk1: Table 100 show logging system Field Descriptions Field Description MOD/SUB Module or the submodule that generated the log message. SEV Severity level of the message. COMP Software component that has logged the message. show logging system CF-762 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following command is used to view the specified number of log messages stored in the sea_log.dat file. The following example shows a sample output of the show logging system last 10 command on the Cisco uBR10012 router: Router# show logging system last 10 SEQ: MM/DD/YY HH:MM:SS MOD/SUB: SEV, COMP, MESSAGE ===================================================== 1: 05/06/09 04:47:48 5/0: NON, SEATEST, "Second Message" 2: 05/06/09 04:47:31 6/0: NON, SEATEST, "First Message" Related Commands clear logging system Clears the event records stored in the SEA. copy logging system Copies the archived system events to another location. logging system Enables or disables the SEA logging system. show logging xml CF-763 Cisco IOS Configuration Fundamentals Command Reference April 2010 show logging xml To display the state of system message logging in an XML format, and to display the contents of the XML syslog buffer, use the show logging xml command in privileged EXEC mode. show logging xml Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Usage Guidelines This command displays the same syslog state information as the standard show logging command, but displays the information in XML format. This command also displays the content of the XML syslog buffer (if XML-formatted buffer logging is enabled). Examples The following example compares the output of the standard show logging command with the output of the show logging xml command so that you can see how the standard information is formatted in XML. Router# show logging Syslog logging: enabled (10 messages dropped, 6 messages rate-limited, 0 flushes, 0 overruns, xml enabled) Console logging: level debugging, 28 messages logged, xml enabled Monitor logging: level debugging, 0 messages logged, xml enabled Buffer logging: level debugging, 2 messages logged, xml enabled (2 messages logged) Logging Exception size (8192 bytes) Count and timestamp logging messages: disabled Trap logging: level informational, 35 message lines logged Logging to 10.2.3.4, 1 message lines logged, xml disabled Logging to 192.168.2.1, 1 message lines logged, xml enabled Log Buffer (8192 bytes): 00:04:20: %SYS-5-CONFIG_I: Configured from console by console 00:04:41: %SYS-5-CONFIG_I: Configured from console by console Router# show logging xml enabled enabled enabled Release Modification 12.2(15)T This command was introduced. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE. show logging xml CF-764 Cisco IOS Configuration Fundamentals Command Reference April 2010 enabled disabled enabled SYS5CONFIG_I 00:04:20consoleconsole SYS5CONFIG_I 00:04:41consoleconsole Router# Table 101 describes the significant fields shown in the displays. Related Commands Table 101 show logging and show logging xml Field Descriptions Field Description XML Tag Syslog logging The global state of system message logging (syslog); “enabled” or “disabled.” syslog-logging Console logging State of logging to console connections. console-logging Monitor logging State of logging to monitor (TTY and Telnet) connections. monitor-logging Buffer logging State of logging to the local system logging buffer. buffer-logging Count and timestamp logging messages: Indicates whether the logging count feature is enabled. Corresponds to the logging count command. count-and-timestamp-logging Trap logging State of logging to a remote host. trap-logging Command Description show logging Displays the contents of the standard syslog buffer. show logging count Displays counts of each system error message. show logging history Displays the contents of the SNMP syslog history table. show memory CF-765 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory To display statistics about memory when Cisco IOS or Cisco IOS software Modularity images are running, use the show memory command in user EXEC or privileged EXEC mode. Cisco IOS Software show memory [memory-type] [free] [overflow] [summary] Cisco IOS Software Modularity show memory Syntax Description Command Modes User EXEC (>) Privileged EXEC (#) Command History Usage Guidelines Cisco IOS Software The show memory command displays information about memory available after the system image decompresses and loads. memory-type (Optional) Memory type to display (processor, multibus, io, or sram). If memory-type is not specified, statistics for all memory types present are displayed. free (Optional) Displays free memory statistics. overflow (Optional) Displays details about memory block header corruption corrections when the exception memory ignore overflow global configuration command is configured. summary (Optional) Displays a summary of memory usage including the size and number of blocks allocated for each address of the system call that allocated the block. Release Modification 10.0 This command was introduced. 12.3(7)T This command was enhanced with the overflow keyword to display details about memory block header corruption corrections. 12.2(25)S The command output was updated to display information about transient memory pools. 12.3(14)T The command output was updated to display information about transient memory pools. 12.2(27)SBC This command was integrated into Cisco IOS Release 12.2(27)SBC. 12.2(18)SXF4 This command was implemented in Cisco IOS Software Modularity images. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show memory CF-766 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco IOS Software Modularity No optional keywords or arguments are supported for the show memory command when a Software Modularity image is running. To display details about PSOIX and Cisco IOS style system memory information when Software Modularity images are running, use the show memory detailed command. Examples Example output varies between Cisco IOS software images and Cisco IOS Software Modularity software images. To view the appropriate output, choose one of the following sections: • Cisco IOS Software • Cisco IOS Software Modularity Cisco IOS Software The following is sample output from the show memory command: Router# show memory Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor B0EE38 5181896 2210036 2971860 2692456 2845368 Processor memory Address Bytes Prev. Next Ref PrevF NextF Alloc PC What B0EE38 1056 0 B0F280 1 18F132 List Elements B0F280 2656 B0EE38 B0FD08 1 18F132 List Headers B0FD08 2520 B0F280 B10708 1 141384 TTY data B10708 2000 B0FD08 B10F00 1 14353C TTY Input Buf B10F00 512 B10708 B11128 1 14356C TTY Output Buf B11128 2000 B10F00 B11920 1 1A110E Interrupt Stack B11920 44 B11128 B11974 1 970DE8 *Init* B11974 1056 B11920 B11DBC 1 18F132 messages B11DBC 84 B11974 B11E38 1 19ABCE Watched Boolean B11E38 84 B11DBC B11EB4 1 19ABCE Watched Boolean B11EB4 84 B11E38 B11F30 1 19ABCE Watched Boolean B11F30 84 B11EB4 B11FAC 1 19ABCE Watched Boolean The following is sample output from the show memory free command: Router# show memory free Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor B0EE38 5181896 2210076 2971820 2692456 2845368 Processor memory Address Bytes Prev. Next Ref PrevF NextF Alloc PC What 24 Free list 1 CEB844 32 CEB7A4 CEB88C 0 0 0 96B894 SSE Manager 52 Free list 2 72 Free list 3 76 Free list 4 80 Free list 5 D35ED4 80 D35E30 D35F4C 0 0 D27AE8 96B894 SSE Manager D27AE8 80 D27A48 D27B60 0 D35ED4 0 22585E SSE Manager 88 Free list 6 100 Free list 7 D0A8F4 100 D0A8B0 D0A980 0 0 0 2258DA SSE Manager 104 Free list 8 B59EF0 108 B59E8C B59F84 0 0 0 2258DA (fragment) show memory CF-767 Cisco IOS Configuration Fundamentals Command Reference April 2010 The output of the show memory free command contains the same types of information as the show memory output, except that only free memory is displayed, and the information is ordered by free list. The first section of the display includes summary statistics about the activities of the system memory allocator. Table 102 describes the significant fields shown in the first section of the display. The second section of the display is a block-by-block listing of memory use. Table 103 describes the significant fields shown in the second section of the display. The show memory io command displays the free I/O memory blocks. On the Cisco 4000 router, this command quickly shows how much unused I/O memory is available. The following is sample output from the show memory io command: Router# show memory io Address Bytes Prev. Next Ref PrevF NextF Alloc PC What 6132DA0 59264 6132664 6141520 0 0 600DDEC 3FCF0 *Packet Buffer* 600DDEC 500 600DA4C 600DFE0 0 6132DA0 600FE68 0 600FE68 376 600FAC8 600FFE0 0 600DDEC 6011D54 0 6011D54 652 60119B4 6011FEO 0 600FE68 6013D54 0 614FCA0 832 614F564 614FFE0 0 601FD54 6177640 0 6177640 2657056 6172E90 0 0 614FCA0 0 0 Total: 2723244 Table 102 show memory Field Descriptions—First Section Field Description Head Hexadecimal address of the head of the memory allocation chain. Total(b) Sum of used bytes plus free bytes. Used(b) Amount of memory in use. Free(b) Amount of memory not in use. Lowest(b) Smallest amount of free memory since last boot. Largest(b) Size of largest available free block. Table 103 Characteristics of Each Block of Memory—Second Section Field Description Address Hexadecimal address of block. Bytes Size of block (in bytes). Prev. Address of previous block (should match the address on previous line). Next Address of next block (should match the address on next line). Ref Reference count for that memory block, indicating how many different processes are using that block of memory. PrevF Address of previous free block (if free). NextF Address of next free block (if free). Alloc PC Address of the system call that allocated the block. What Name of process that owns the block, or “(fragment)” if the block is a fragment, or “(coalesced)” if the block was coalesced from adjacent free blocks. show memory CF-768 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following example displays details of a memory block overflow correction when the exception memory ignore overflow global configuration command is configured: Router# show memory overflow Count Buffer Count Last corrected Crashinfo files 1 1 00:11:17 slot0:crashinfo_20030620-075755 Traceback 607D526C 608731A0 607172F8 607288E0 607A5688 607A566C The report includes the amount of time since the last correction was made and the name of the file that logged the memory block overflow details. The show memory sram command displays the free SRAM memory blocks. For the Cisco 4000 router, this command supports the high-speed static RAM memory pool to make it easier for you to debug or diagnose problems with allocation or freeing of such memory. The following is sample output from the show memory sram command: Router# show memory sram Address Bytes Prev. Next Ref PrevF NextF Alloc PC What 7AE0 38178 72F0 0 0 0 0 0 Total 38178 The following example of the show memory command used on the Cisco 4000 router includes information about SRAM memory and I/O memory: Router# show memory Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor 49C724 28719324 1510864 27208460 26511644 15513908 I/O 6000000 4194304 1297088 2897216 2869248 2896812 SRAM 1000 65536 63400 2136 2136 2136 Address Bytes Prev. Next Ref PrevF NextF Alloc PC What 1000 2032 0 17F0 1 3E73E *Init* 17F0 2032 1000 1FE0 1 3E73E *Init* 1FE0 544 17F0 2200 1 3276A *Init* 2200 52 1FE0 2234 1 31D68 *Init* 2234 52 2200 2268 1 31DAA *Init* 2268 52 2234 229C 1 31DF2 *Init* 72F0 2032 6E5C 7AE0 1 3E73E Init 7AE0 38178 72F0 0 0 0 0 0 The show memory summary command displays a summary of all memory pools and memory usage per Alloc PC (address of the system call that allocated the block). The following is a partial sample output from the show memory summary command. This output shows the size, blocks, and bytes allocated. Bytes equal the size multiplied by the blocks. For a description of the other fields, see Table 102 and Table 103. Router# show memory summary Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor B0EE38 5181896 2210216 2971680 2692456 2845368 Processor memory Alloc PC Size Blocks Bytes What 0x2AB2 192 1 192 IDB: Serial Info 0x70EC 92 2 184 Init 0xC916 128 50 6400 RIF Cache 0x76ADE 4500 1 4500 XDI data 0x76E84 4464 1 4464 XDI data show memory CF-769 Cisco IOS Configuration Fundamentals Command Reference April 2010 0x76EAC 692 1 692 XDI data 0x77764 408 1 408 Init 0x77776 116 1 116 Init 0x777A2 408 1 408 Init 0x777B2 116 1 116 Init 0xA4600 24 3 72 List 0xD9B5C 52 1 52 SSE Manager . . . 0x0 0 3413 2072576 Pool Summary 0x0 0 28 2971680 Pool Summary (Free Blocks) 0x0 40 3441 137640 Pool Summary (All Block Headers) 0x0 0 3413 2072576 Memory Summary 0x0 0 28 2971680 Memory Summary (Free Blocks) Cisco IOS Software Modularity The following is sample output from the show memory command when a Cisco IOS Software Modularity image is running. Router# show memory System Memory: 262144K total, 116148K used, 145996K free 4000K kernel reserved Table 104 describes the significant fields shown in the display. Related Commands Table 104 show memory (Software Modularity Image) Field Descriptions Field Description total Total amount of memory on the device, in kilobytes. used Amount of memory in use, in kilobytes. free Amount of memory not in use, in kilobytes. kernel reserved Amount of memory reserved by the kernel, in kilobytes. Command Description exception memory ignore overflow Configures the Cisco IOS software to correct corruptions in memory block headers and allow a router to continue its normal operation. show memory detailed Displays POSIX and Cisco IOS style system memory information. show processes memory Displays memory used per process. show memory allocating-process CF-770 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory allocating-process To display statistics on allocated memory with corresponding allocating processes, use the show memory allocating-process command in user EXEC or privileged EXEC mode. show memory allocating-process [totals] Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines The show memory allocating-process command displays information about memory available after the system image decompresses and loads. Examples The following is sample output from the show memory allocating-process command: Router# show memory allocating-process Head Total(b)Used(b)Free(b)Lowest(b)Largest(b) Processor 44E0356018663263626131896160500740160402052153078204 Fast 44DE356013107258280727927279272764 Processor memory Address Bytes Prev. Next Ref Alloc Proc Alloc PC What 6148EC40 1504 0 6148F24C 1 *Init* 602310FC List Elements 6148F24C 3004 6148EC40 6148FE34 1 *Init* 60231128 List Headers 6148FE34 9000 6148F24C 61492188 1 *Init* 6023C634 Interrupt Stack 61492188 44 6148FE34 614921E0 1 *Init* 60C17FD8 *Init* 614921E0 9000 61492188 61494534 1 *Init* 6023C634 Interrupt Stack 61494534 44 614921E0 6149458C 1 *Init* 60C17FD8 *Init* 6149458C 220 61494534 61494694 1 *Init* 602450F4 *Init* 61494694 4024 6149458C 61495678 1 *Init* 601CBD64 TTY data . . . Table 105 describes the significant fields shown in the display. totals (Optional) Displays allocating memory totals. Release Modification 12.0 This command was introduced. Table 105 show memory allocating-process Field Descriptions Field Description Head Hexadecimal address of the head of the memory allocation chain. Total(b) Sum of used bytes plus free bytes. show memory allocating-process CF-771 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following is sample output from the show memory allocating-process totals command: Router# show memory allocating-process totals Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor 44E03560 186632636 26142524 160490112 160402052 153078204 Fast 44DE3560 131072 58280 72792 72792 72764 Allocator PC Summary for: Processor PC Total Count Name 0x4041AF8C 5710616 3189 *Packet Data* 0x4041AF40 2845480 3190 *Packet Header* 0x404DBA28 1694556 203 Process Stack 0x4066EA68 1074080 56 Init 0x404B5F68 1049296 9 pak subblock chunk 0x41DCF230 523924 47 TCL Chunks 0x404E2488 448920 6 MallocLite 0x4066EA8C 402304 56 Init 0x40033878 397108 1 Init 0x41273E24 320052 1 CEF: table event ring 0x404B510C 253152 24 TW Buckets 0x42248F0C 229428 1 Init 0x42248F28 229428 1 Init 0x42248F48 229428 1 Init 0x423FF210 218048 5 Dn48oC!M 0x421CB530 208144 1 epa crypto blk 0x417A07F0 196764 3 L2TP Hash Table 0x403AFF50 187836 3 Init Used(b) Amount of memory in use in bytes. Free(b) Amount of memory not in use (in bytes). Lowest(b) Smallest amount of free memory since last boot (in bytes). Largest(b) Size of largest available free block (in bytes). Address Hexadecimal address of the block. Bytes Size of the block (in bytes). Prev. Address of the preceding block (should match the address on preceding row). Next Address of the following block (should match the address on following row). Ref Reference count for that memory block, indicating how many different processes are using that block of memory. Alloc PC Address of the system call that allocated the block. What Name of process that owns the block, or “(fragment)” if the block is a fragment, or “(coalesced)” if the block was coalesced from adjacent free blocks. Table 105 show memory allocating-process Field Descriptions (continued) Field Description show memory allocating-process CF-772 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 106 describes the significant fields shown in the display. Related Commands Table 106 show memory allocating-process totals Field Descriptions Field Description Head Hexadecimal address of the head of the memory allocation chain. Total(b) Sum of used bytes plus free bytes. Used(b) Amount of memory in use (in bytes). Free(b) Amount of memory not in use (in bytes). Lowest(b) Smallest amount of free memory since last boot (in bytes). Largest(b) Size of the largest available free block in bytes. PC Program counter Total Total memory allocated by the process (in bytes). Count Number of allocations. Name Name of the allocating process. Command Description show processes memory Displays memory used per process. show memory dead CF-773 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory dead To display statistics on memory allocated by processes that have terminated, use the show memory dead command in user EXEC or privileged EXEC mode. show memory dead [totals] Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines The show memory dead command displays information about processes that have been terminated. Terminated processes accounts for memory allocated under another process. Examples The following is sample output from the show memory dead command: Router# show memory dead Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) I/O 600000 2097152 461024 1636128 1635224 1635960 Processor memory Address Bytes Prev. Next Ref PrevF NextF Alloc PC What 1D8310 60 1D82C8 1D8378 1 3281FFE Router Init 2CA964 36 2CA914 2CA9B4 1 3281FFE Router Init 2CAA04 112 2CA9B4 2CAAA0 1 3A42144 OSPF Stub LSA RBTree 2CAAA0 68 2CAA04 2CAB10 1 3A420D4 Router Init 2ED714 52 2ED668 2ED774 1 3381C84 Router Init 2F12AC 44 2F124C 2F1304 1 3A50234 Router Init 2F1304 24 2F12AC 2F1348 1 3A420D4 Router Init 2F1348 68 2F1304 2F13B8 1 3381C84 Router Init 300C28 340 300A14 300DA8 1 3381B42 Router Init totals (Optional) Displays memory totals for processes that have been terminated. Release Modification 12.0 This command was introduced. 12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware. show memory dead CF-774 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 107 describes the significant fields shown in the display. Table 107 show memory dead Field Descriptions Field Description Head Hexadecimal address of the head of the memory allocation chain. Total(b) Sum of used bytes plus free bytes. Used(b) Amount of memory in use. Free(b) Amount of memory not in use (in bytes). Lowest(b) Smallest amount of free memory since last boot (in bytes). Largest(b) Size of the largest available free block (in bytes). Address Hexadecimal address of the block (in bytes). Bytes Size of the block (in bytes). Prev. Address of the preceding block. Next Address of the following block. Ref Reference count for that memory block, indicating how many different processes are using that block of memory. PrevF Address of the preceding free block (if free). NextF Address of the following free block (if free). Alloc PC Address of the program counter that allocated the block. What Name of the process that owns the block, or “(fragment)” if the block is a fragment, or “(coalesced)” if the block was coalesced from adjacent free blocks. show memory debug incremental CF-775 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory debug incremental To display information about memory leaks after a starting time has been established, use the show memory debug incremental command in privileged EXEC mode. show memory debug incremental {allocations | leaks [lowmem | summary] | status} Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines The show memory debug incremental allocations command displays all the memory blocks that were allocated after the set memory debug incremental starting-time command was entered. The displayed memory blocks are just memory allocations, they are not necessarily leaks. The show memory debug incremental leaks command provides output similar to the show memory debug leaks command, except that it displays only memory that was leaked after the set memory debug incremental starting-time command was entered. The show memory debug incremental leaks lowmem command forces memory leak detection to work in low memory mode. The amount of time taken for analysis is considerably greater than that of normal mode. The output for this command is similar to the show memory debug leaks command, except that it displays only memory that was leaked after the set memory debug incremental starting-time command was entered. You can use this command when you already know that normal mode memory leak detection will fail (perhaps by an unsuccessful previous attempt to invoke normal mode memory leak detection). The show memory debug incremental leaks summary command displays a summarized report of the memory that was leaked after the set memory debug incremental starting-time command was entered, ordered by allocator process call address (Alloc_pc) and by memory block size. The show memory debug incremental status command displays whether a starting point for incremental analysis has been set and the elapsed time since then. allocations Displays all memory blocks that were allocated after issuing the set memory debug incremental starting-time command. leaks Displays only memory that was leaked after issuing the set memory debug incremental starting-time command. lowmem (Optional) Forces the memory leak detector to work in low memory mode, making no memory allocations. summary (Optional) Reports summarized memory leaks based on allocator_pc and size of the memory block. status Displays all memory blocks that were allocated after issuing the set memory debug incremental starting-time command. Release Modification 12.3(7)T This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.4T The summary keyword was added. show memory debug incremental CF-776 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note All show memory debug commands must be used on customer networks only to diagnose the router for memory leaks when memory depletion is observed. These CLI’s will have high CPU utilization and might result in time sensitive protocols to flap. These CLI’s are recommended for customer use, only in the maintenance window when the router is not in a scaled condition. Note All memory leak detection commands invoke normal mode memory leak detection, except when the low memory option is specifically invoked by use of the lowmem keyword. In normal mode, if memory leak detection determines that there is insufficient memory to proceed in normal mode, it will display an appropriate message and switch to low memory mode. Examples show memory debug incremental allocations Command Example The following example shows output from the show memory debug incremental command when entered with the allocations keyword: Router# show memory debug incremental allocations Address Size Alloc_pc PID Name 62DA4E98 176 608CDC7C 44 CDP Protocol 62DA4F48 88 608CCCC8 44 CDP Protocol 62DA4FA0 88 606224A0 3 Exec 62DA4FF8 96 606224A0 3 Exec 635BF040 96 606224A0 3 Exec 63905E50 200 606A4DA4 69 Process Events show memory debug incremental leaks summary Command Example The following example shows output from the show memory debug incremental command when entered with the leaks and summary keywords: Router# show memory debug incremental leaks summary Adding blocks for GD... PCI memory Alloc PC Size Blocks Bytes What I/O memory Alloc PC Size Blocks Bytes What Processor memory Alloc PC Size Blocks Bytes What 0x60874198 0000000052 0000000001 0000000052 Exec 0x60874198 0000000060 0000000001 0000000060 Exec 0x60874198 0000000100 0000000001 0000000100 Exec 0x60874228 0000000052 0000000004 0000000208 Exec 0x60874228 0000000060 0000000002 0000000120 Exec 0x60874228 0000000100 0000000004 0000000400 Exec show memory debug incremental status Command Example The following example shows output from the show memory debug incremental command entered with the status keyword: Router# show memory debug incremental status Incremental debugging is enabled Time elapsed since start of incremental debugging: 00:00:10 show memory debug incremental CF-777 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description set memory debug incremental starting-time Sets the current time as the starting time for incremental analysis. show memory debug leaks Displays detected memory leaks. show memory debug leaks CF-778 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory debug leaks To display detected memory leaks, use the show memory debug leaks command in privileged EXEC mode. show memory debug leaks [chunks | largest | lowmem | summary] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines If no optional keywords are specified, the show memory debug leaks command invokes normal mode memory leak detection and does not look for memory leaks in chunks. The show memory debug leaks chunks command invokes normal mode memory leak detection and looks for leaks in chunks as well. The show memory debug leaks largest command displays the top ten leaking allocator_pcs and the total amount of memory that they have leaked. Additionally, each time this command is invoked it remembers the previous invocation's report and compares it to the current invocation's report. If there are new entries in the current report they are tagged as “inconclusive.” If the same entry appears in the previous invocation's report and the current invocation's report, the inconclusive tag is not added. It would be beneficial to run memory leak detection more than once and to consider only the consistently reported leaks. The show memory debug leaks lowmem command forces memory leak detection to work in low memory mode. The amount of time taken for analysis is considerably greater than that of normal mode. The output for this command is similar to the show memory debug leaks command. You can use this command when you already know that normal mode memory leak detection will fail (perhaps by an unsuccessful previous attempt to invoke normal mode memory leak detection). The show memory debug leaks summary command reports memory leaks based on allocator_pc and then on the size of the block. chunks (Optional) Displays the memory leaks in chunks. largest (Optional) Displays the top ten leaking allocator_pcs based on size, and the total amount of memory they have leaked. lowmem (Optional) Forces the memory leak detector to work in low memory mode, making no memory allocations. summary (Optional) Reports summarized memory leaks based on allocator_pc and size of the memory block. Release Modification 12.3(8)T1 This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show memory debug leaks CF-779 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note All show memory debug commands must be used on customer networks only to diagnose the router for memory leaks when memory depletion is observed. These CLI’s will have high CPU utilization and might result in time sensitive protocols to flap. These CLI’s are recommended for customer use, only in the maintenance window when the router is not in a scaled condition. Note All memory leak detection commands invoke normal mode memory leak detection, except when the low memory option is specifically invoked by use of the lowmem keyword. In normal mode, if memory leak detection determines that there is insufficient memory to proceed in normal mode, it will display an appropriate message and switch to low memory mode. Examples show memory debug leaks Command Example The following example shows output from the show memory debug leaks command: Router# show memory debug leaks Adding blocks for GD... PCI memory Address Size Alloc_pc PID Name I/O memory Address Size Alloc_pc PID Name Processor memory Address Size Alloc_pc PID Name 62DABD28 80 60616750 -2 Init 62DABD78 80 606167A0 -2 Init 62DCF240 88 605B7E70 -2 Init 62DCF298 96 605B7E98 -2 Init 62DCF2F8 88 605B7EB4 -2 Init 62DCF350 96 605B7EDC -2 Init 63336C28 104 60C67D74 -2 Init 63370D58 96 60C656AC -2 Init 633710A0 304 60C656AC -2 Init 63B2BF68 96 60C659D4 -2 Init 63BA3FE0 32832 608D2848 104 Audit Process 63BB4020 32832 608D2FD8 104 Audit Process Table 108 describes the significant fields shown in the display. Table 108 show memory debug leaks Field Descriptions Field Description Address Hexadecimal address of the leaked block. Size Size of the leaked block (in bytes). Alloc_pc Address of the system call that allocated the block. PID The process identifier of the process that allocated the block. Name The name of the process that allocated the block. show memory debug leaks CF-780 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory debug leaks chunks Command Example The following example shows output from the show memory debug leaks chunks command: Router# show memory debug leaks chunks Adding blocks for GD... PCI memory Address Size Alloc_pc PID Name Chunk Elements: Address Size Parent Name I/O memory Address Size Alloc_pc PID Name Chunk Elements: Address Size Parent Name Processor memory Address Size Alloc_pc PID Name 62DABD28 80 60616750 -2 Init 62DABD78 80 606167A0 -2 Init 62DCF240 88 605B7E70 -2 Init 62DCF298 96 605B7E98 -2 Init 62DCF2F8 88 605B7EB4 -2 Init 62DCF350 96 605B7EDC -2 Init 63336C28 104 60C67D74 -2 Init 63370D58 96 60C656AC -2 Init 633710A0 304 60C656AC -2 Init 63B2BF68 96 60C659D4 -2 Init 63BA3FE0 32832 608D2848 104 Audit Process 63BB4020 32832 608D2FD8 104 Audit Process Chunk Elements: Address Size Parent Name 62D80DA8 16 62D7BFD0 (Managed Chunk ) 62D80DB8 16 62D7BFD0 (Managed Chunk ) 62D80DC8 16 62D7BFD0 (Managed Chunk ) 62D80DD8 16 62D7BFD0 (Managed Chunk ) 62D80DE8 16 62D7BFD0 (Managed Chunk ) 62E8FD60 216 62E8F888 (IPC Message He) Table 109 describes the significant fields shown in the display. Table 109 show memory debug leaks chunks Field Descriptions Field Description Address Hexadecimal address of the leaked block. Size Size of the leaked block (in bytes). Alloc_pc Address of the system call that allocated the block. PID The process identifier of the process that allocated the block. Name The name of the process that allocated the block. Size (Chunk Elements) Size of the leaked element (bytes). Parent (Chunk Elements) Parent chunk of the leaked chunk. Name (Chunk Elements) The name of the leaked chunk. show memory debug leaks CF-781 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory debug leaks largest Command Example The following example shows output from the show memory debug leaks largest command: Router# show memory debug leaks largest Adding blocks for GD... PCI memory Alloc_pc total leak size I/O memory Alloc_pc total leak size Processor memory Alloc_pc total leak size 608D2848 32776 inconclusive 608D2FD8 32776 inconclusive 60C656AC 288 inconclusive 60C67D74 48 inconclusive 605B7E98 40 inconclusive 605B7EDC 40 inconclusive 60C659D4 40 inconclusive 605B7E70 32 inconclusive 605B7EB4 32 inconclusive 60616750 24 inconclusive The following example shows output from the second invocation of the show memory debug leaks largest command: Router# show memory debug leaks largest Adding blocks for GD... PCI memory Alloc_pc total leak size I/O memory Alloc_pc total leak size Processor memory Alloc_pc total leak size 608D2848 32776 608D2FD8 32776 60C656AC 288 60C67D74 48 605B7E98 40 605B7EDC 40 60C659D4 40 605B7E70 32 605B7EB4 32 60616750 24 show memory debug leaks summary Command Example The following example shows output from the show memory debug leaks summary command: Router# show memory debug leaks summary Adding blocks for GD... PCI memory Alloc PC Size Blocks Bytes What show memory debug leaks CF-782 Cisco IOS Configuration Fundamentals Command Reference April 2010 I/O memory Alloc PC Size Blocks Bytes What Processor memory Alloc PC Size Blocks Bytes What 0x605B7E70 0000000032 0000000001 0000000032 Init 0x605B7E98 0000000040 0000000001 0000000040 Init 0x605B7EB4 0000000032 0000000001 0000000032 Init 0x605B7EDC 0000000040 0000000001 0000000040 Init 0x60616750 0000000024 0000000001 0000000024 Init 0x606167A0 0000000024 0000000001 0000000024 Init 0x608D2848 0000032776 0000000001 0000032776 Audit Process 0x608D2FD8 0000032776 0000000001 0000032776 Audit Process 0x60C656AC 0000000040 0000000001 0000000040 Init 0x60C656AC 0000000248 0000000001 0000000248 Init 0x60C659D4 0000000040 0000000001 0000000040 Init 0x60C67D74 0000000048 0000000001 0000000048 Init Table 110 describes the significant fields shown in the display. Related Commands Table 110 show memory debug leaks summary Field Descriptions Field Description Alloc_pc Address of the system call that allocated the block. Size Size of the leaked block. Blocks Number of blocks leaked. Bytes Total amount of memory leaked. What Name of the process that owns the block. Command Description set memory debug incremental starting-time Sets the current time as the starting time for incremental analysis. show memory debug incremental allocation Displays all memory blocks that were allocated after the issue of the set memory debug incremental starting-time command. show memory debug incremental leaks Displays only memory that was leaked after the issue of the set memory debug incremental starting-time command. show memory debug incremental leaks lowmem Forces incremental memory leak detection to work in low memory mode. Displays only memory that was leaked after the issue of the set memory debug incremental starting-time command. show memory debug incremental status Displays if the starting point of incremental analysis has been defined and the time elapsed since then. show memory debug references CF-783 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory debug references To display debug information on references, use the show memory debug references command in user EXEC or privileged EXEC mode. show memory debug references [dangling [start-address start-address ]] Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines All show memory debug commands must be used on customer networks only to diagnose the router for memory leaks when memory depletion is observed. These CLI’s will have high CPU utilization and might result in time sensitive protocols to flap. These CLI’s are recommended for customer use, only in the maintenance window when the router is not in a scaled condition. Examples The following is sample output from the show memory debug references command: Router# show memory debug references 2 3 Address Reference Cont_block Cont_block_name 442850BC 2 44284960 bss 44285110 3 44284960 bss 4429C33C 2 44284960 bss 4429C34C 2 44284960 bss 4429C35C 3 44284960 bss . . . The following is sample output from the show memory debug references dangling command: Router# show memory debug references dangling Address Reference Free_block Cont_block Cont_block_name 442D5774 458CE5EC 458CE5BC 44284960 bss 442D578C 46602998 46602958 44284960 bss 442D58A0 465F9BC4 465F9B94 44284960 bss 442D58B8 4656785C 4656781C 44284960 bss 442D5954 45901E7C 45901E4C 44284960 bss . . . dangling (Optional) Displays the possible references to free memory. start-address (Optional) Address numbers <0-4294967295> that determine the address range. Release Modification 12.0 This command was introduced. show memory debug references CF-784 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 111 describes the significant fields shown in the displays. Table 111 show memory debug references Field Descriptions Field Description Address Hexadecimal address of the block having the given or dangling reference. Reference Address which is given or dangling. Free_block Address of the free block which now contains the memory referenced by the dangling reference. Cont_block Address of the control block which contains the block having the reference. Cont_block_name Name of the control block. show memory debug unused CF-785 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory debug unused To display debug information on leaks that are accessible, but are no longer needed, use the show memory debug unused command in user EXEC or privileged EXEC mode. show memory debug unused Syntax Description This command has no arguments or keywords. Command Modes User EXEC Privileged EXEC Command History Examples The following is sample output from the show memory debug unused command: Router# show memory debug unused Address Alloc_pc PID size Name 654894B8 62BF31DC -2 44 *Init* 6549A074 601F7A84 -2 4464 XDI data 6549B218 601F7274 -2 4500 XDI data 6549DFB0 6089DDA4 42 84 Init 65509160 6089DDA4 1 84 *Init* 6550A260 6089DDA4 2 84 *Init* 6551FDB4 6089DDA4 4 84 *Init* 6551FF34 627EFA2C -2 24 *Init* 65520B3C 6078B1A4 -2 24 Parser Mode Q1 65520B88 6078B1C8 -2 24 Parser Mode Q2 65520C40 6078B1A4 -2 24 Parser Mode Q1 65520C8C 6078B1C8 -2 24 Parser Mode Q2 65520D44 6078B1A4 -2 24 Parser Mode Q1 65520D90 6078B1C8 -2 24 Parser Mode Q2 65520E48 6078B1A4 -2 24 Parser Mode Q1 65520E94 6078B1C8 -2 24 Parser Mode Q2 65520F4C 6078B1A4 -2 24 Parser Mode Q1 65520F98 6078B1C8 -2 24 Parser Mode Q2 65521050 6078B1A4 -2 24 Parser Mode Q1 6552109C 6078B1C8 -2 24 Parser Mode Q2 65521154 6078B1A4 -2 24 Parser Mode Q1 655211A0 6078B1C8 -2 24 Parser Mode Q2 . . . Release Modification 12.0 This command was introduced. show memory debug unused CF-786 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 112 describes the significant fields shown in the display. Table 112 show memory debug unused Field Descriptions Field Description Address Hexadecimal address of the block. Alloc_pc Address of the program counter that allocated the block. PID Process identifier of the process that allocated the block. size Size of the unused block (in bytes). Name Name of the process that owns the block. show memory ecc CF-787 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory ecc To display single-bit Error Code Correction (ECC) error logset data, use the show memory ecc command in privileged EXEC mode. show memory ecc Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Usage Guidelines Use this command to determine if the router has experienced single-bit parity errors. Examples The following is sample output from the show memory ecc command from a 12000-series router running Cisco IOS Release 12.0(23)S: Router# show memory ecc ECC Single Bit error log ------------------------ Single Bit error detected and corrected at 0x574F3640 - Occured 1 time(s) - Whether a scrub was attempted at this address: Yes - Syndrome of the last error at this address: 0xE9 - Error detected on a read-modify-write cycle ? No - Address region classification: Unknown - Address media classification : Read/Write Single Bit error detected and corrected at 0x56AB3760 - Occured 1 time(s) - Whether a scrub was attempted at this address: Yes - Syndrome of the last error at this address: 0x68 - Error detected on a read-modify-write cycle ? No - Address region classification: Unknown - Address media classification : Read/Write Total Single Bit error(s) thus far: 2 Release Modification 11.1(30)CC This command was introduced in Cisco IOS Release 11.1(30)CC. 12.0(4)XE This command was integrated into Cisco IOS Release 12.0(4)XE. 12.0(6)S This command was integrated into Cisco IOS Release 12.0(6)S. 12.1(13) This command was integrated into Cisco IOS Release 12.1(13). show memory ecc CF-788 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 113 describes the significant fields shown in the first section of the display. Related Commands Table 113 show memory ecc Field Descriptions Field Description Occured n time(s) Number of single-bit errors that has occurred. Whether a scrub was attempted at this address: Indicates whether a scrub has been performed. Syndrome of the last error at this address: Describes the syndrome of last error. Error detected on a read-modify-write cycle ? Indicates whether an error has occurred. Address region classification: Unknown Describes the region of the error. Address media classification : Describes the media of the error and correction. Command Description show memory Displays statistics about memory, including memory-free pool statistics. show memory events CF-789 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory events To display recorded memory events, use the show memory events command in privileged EXEC mode. show memory events [outstanding [summary]] Syntax Description Command Modes Privileged EXEC (#) Command History Usage Guidelines Before you can enable the show memory events command, you must configure the memory record events command in global configuration mode. Examples The following is sample output from the show memory events command: Router# configure terminal Router(config)# memory record events Memory event recording already enabled! Router(config)# exit Router# show memory events Last recorded memory events: When Type Block/Chunk DataPtr Size PID What Traceback/PC 4d19h FREE 695B3200 695B3230 3000 82 Iterator Hash Entry 615B75C4 Table 114 describes the significant fields shown in the display. outstanding (Optional) Displays the outstanding allocation events in the event buffer. summary (Optional) Displays a summary of outstanding allocation events in the event buffer. Release Modification 15.0(1)M This command was introduced in a release earlier than Cisco IOS Release 15.0(1)M. Table 114 show memory events Field Descriptions Field Description When Time when the memory event was last seen by the system (in hours and days). Type Allocation type. Block/Chunk/DataPtr Number of memory events allocated. Size Amount of memory, in bytes, used by the task. PID Packet identification number. show memory events CF-790 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following is sample output from the show memory events command using the outstanding and summary keywords: Router# configure terminal Router(config)# memory record events Memory event recording already enabled! Router(config)# exit Router# show memory events outstanding summary Last-Seen Type How-Many Size PID What Traceback/PC 5d16h ALLOC 1 320 135 Exec 61B399F4 Table 115 describes the significant fields shown in the display. Related Commands What Name of the process that owns a block or fragment. Traceback/PC Traceback error. Table 114 show memory events Field Descriptions (continued) Field Description Table 115 show memory events Field Descriptions Field Description Last-Seen Time when the memory event was last seen by the system (in hours and days). Type Allocation type. How-Many Number of memory events allocated. Size Amount of memory, in bytes, used by the task. PID Packet identification number. What Name of the process that owns a block or fragment. Traceback/PC Traceback error. Command Description show memory traceback Displays memory traceback information. show memory failures alloc CF-791 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory failures alloc To display statistics about failed memory allocation requests, use the show memory failures alloc command in the privileged EXEC mode. show memory failures alloc Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Examples The following is sample output from the show memory failures alloc command: Router# show memory failures alloc Caller Pool Size Alignment When 0x60394744 I/O 1684 32 00:10:03 0x60394744 I/O 1684 32 00:10:03 0x60394744 I/O 1684 32 00:10:03 0x60394744 I/O 1684 32 00:10:03 0x60394744 I/O 1684 32 00:10:03 0x60394744 I/O 1684 32 00:10:03 0x60394744 I/O 1684 32 00:10:03 0x60394744 I/O 1684 32 00:10:03 0x60394744 I/O 1684 32 00:10:04 0x60394744 I/O 1684 32 00:10:04 Table 116 describes the significant fields shown in the display. Release Modification 12.0 This command was introduced. Table 116 show memory failures alloc Field Descriptions Field Description Caller Address of the allocator function that issued memory allocation request that failed. Pool Pool from which the memory was requested. Size Size of the memory requested in bits. Alignment Memory alignment in bits. When Time of day at which the memory allocation request was issued. show memory fast CF-792 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory fast To display fast memory details for the router, use the show memory fast command. show memory fast [allocating-process [totals] | dead [totals] | free [totals]] Syntax Description Command Modes Exec Command History Usage Guidelines The show memory fast command displays the statistics for the fast memory. “Fast memory” is another name for “processor memory,” and is also known as “cache memory.” Cache memory is called fast memory because the processor can generally access the local cache (traditionally stored on SRAM positioned close to the processor) much more quickly than main memory or RAM. Note The show memory fast command is a command alias for the show memory processor command. These commands will issue the same output. Examples The following example shows sample output from the show memory fast and the show memory processor commands: Router>show memory fast Processor memory Address Bytes Prev Next Ref PrevF NextF Alloc PC what 8404A580 0001493284 00000000 841B6ECC 000 0 84BADF88 815219D8 (coalesced) 841B6ECC 0000020004 8404A580 841BBD18 001 -------- -------- 815DB094 Managed Chunk Queue Elements 841BBD18 0000001504 841B6ECC 841BC320 001 -------- -------- 8159EAC4 List Elements 841BC320 0000005004 841BBD18 841BD6D4 001 -------- -------- 8159EB04 List Headers 841BD6D4 0000000048 841BC320 841BD72C 001 -------- -------- 81F2A614 *Init* 841BD72C 0000001504 841BD6D4 841BDD34 001 -------- -------- 815A9514 messages 841BDD34 0000001504 841BD72C 841BE33C 001 -------- -------- 815A9540 Watched messages 841BE33C 0000001504 841BDD34 841BE944 001 -------- -------- 815A95E4 Watched Semaphore allocating-process (Optional) Include allocating process names with the standard output. dead (Optional) Display only memory owned by dead processes. free (Optional) Display only memory not allocated to a process. totals (Optional) Summarizes the statistics for allocating processes, dead memory, or free memory. Release Modification 12.1 This command was introduced in a release prior to 12.1. This command replaced the show memory sram command. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show memory fast CF-793 Cisco IOS Configuration Fundamentals Command Reference April 2010 841BE944 0000000504 841BE33C 841BEB64 001 -------- -------- 815A9630 Watched Message Queue 841BEB64 0000001504 841BE944 841BF16C 001 -------- -------- 815A9658 Watcher Message Queue 841BF16C 0000001036 841BEB64 841BF5A0 001 -------- -------- 815A2B24 Process Array -- More -- Router>show memory processor Processor memory Address Bytes Prev Next Ref PrevF NextF Alloc PC what 8404A580 0001493284 00000000 841B6ECC 000 0 84BADF88 815219D8 (coalesced) 841B6ECC 0000020004 8404A580 841BBD18 001 -------- -------- 815DB094 Managed Chunk Queue Elements 841BBD18 0000001504 841B6ECC 841BC320 001 -------- -------- 8159EAC4 List Elements 841BC320 0000005004 841BBD18 841BD6D4 001 -------- -------- 8159EB04 List Headers 841BD6D4 0000000048 841BC320 841BD72C 001 -------- -------- 81F2A614 *Init* 841BD72C 0000001504 841BD6D4 841BDD34 001 -------- -------- 815A9514 messages 841BDD34 0000001504 841BD72C 841BE33C 001 -------- -------- 815A9540 Watched messages 841BE33C 0000001504 841BDD34 841BE944 001 -------- -------- 815A95E4 Watched Semaphore 841BE944 0000000504 841BE33C 841BEB64 001 -------- -------- 815A9630 Watched Message Queue 841BEB64 0000001504 841BE944 841BF16C 001 -------- -------- 815A9658 Watcher Message Queue 841BF16C 0000001036 841BEB64 841BF5A0 001 -------- -------- 815A2B24 Process Array -- More -- Router> The following example shows sample output from the show memory fast allocating-process command, followed by sample output from the show memory fast allocating-process totals command: Router#show memory fast allocating-process Processor memory Address Bytes Prev Next Ref Alloc Proc Alloc PC What 8404A580 0001493284 00000000 841B6ECC 000 815219D8 (coalesced) 841B6ECC 0000020004 8404A580 841BBD18 001 *Init* 815DB094 Managed Chunk Queue Elements 841BBD18 0000001504 841B6ECC 841BC320 001 *Init* 8159EAC4 List Elements 841BC320 0000005004 841BBD18 841BD6D4 001 *Init* 8159EB04 List Headers 841BD6D4 0000000048 841BC320 841BD72C 001 *Init* 81F2A614 *Init* 841BD72C 0000001504 841BD6D4 841BDD34 001 *Init* 815A9514 messages 841BDD34 0000001504 841BD72C 841BE33C 001 *Init* 815A9540 Watched messages 841BE33C 0000001504 841BDD34 841BE944 001 *Init* 815A95E4 Watched Semaphore 841BE944 0000000504 841BE33C 841BEB64 001 *Init* 815A9630 Watched Message Queue 841BEB64 0000001504 841BE944 841BF16C 001 *Init* 815A9658 Watcher Message Queue 841BF16C 0000001036 841BEB64 841BF5A0 001 *Init* 815A2B24 Process Array --More-- c2600-1#show memory fast allocating-process totals Allocator PC Summary for: Processor PC Total Count Name 0x815C085C 1194600 150 Process Stack 0x815B6C28 948680 5 pak subblock chunk show memory fast CF-794 Cisco IOS Configuration Fundamentals Command Reference April 2010 0x819F1DE4 524640 8 BGP (0) update 0x815C4FD4 393480 6 MallocLite 0x815B5FDC 351528 30 TW Buckets 0x819F14DC 327900 5 connected 0x81A1E838 327900 5 IPv4 Unicast net-chunk(8) 0x8153DFB8 248136 294 *Packet Header* 0x82142438 133192 4 CEF: 16 path chunk pool 0x82151E0C 131116 1 Init 0x819F1C8C 118480 4 BGP (0) attr 0x815A4858 100048 148 Process 0x8083DA44 97248 17 --More-- The following example shows sample output from the show memory fast dead command: Router#show memory fast dead Processor memory Address Bytes Prev Next Ref PrevF NextF Alloc PC what 8498FC20 0000000028 8498FB90 8498FC64 001 -------- -------- 81472B24 AAA MI SG NAME ------- 68 Router#show memory fast dead totals Dead Proc Summary for: Processor PC Total Count Name 0x81472B24 68 1 AAA MI SG NAME Router# show memory fragment CF-795 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory fragment To display the block details of fragmented free blocks and allocated blocks, which is physically just before or after the blocks on the free list, use the show memory fragment command in user EXEC or privileged EXEC mode. show memory [processor | io] fragment [detail] Syntax Description Command Modes User EXEC Privileged EXEC Command History Examples The following is sample output from the show memory processor fragment command: Router# show memory processor fragment Processor memory Free memory size : 65516944 Number of free blocks: 230 Allocator PC Summary for allocated blocks in pool: Processor PC Total Count Name 0x6047DDCC 852020 1 atmdx_vc_table 0x6075DC30 544392 4 ATM1/0 0x61BDBA14 131176 2 eddri_self_event 0x61913BEC 131124 1 l2tp tnl table 0x602E9820 114832 1 AutoVC Msg Chunk 0x6071253C 98408 2 Exec 0x607DF5BC 96624 12 Process Stack 0x6118DDA0 77252 1 Spanning Tree Opt Port Block 0x61F13C30 67636 1 QOS_MODULE_MAIN 0x6047DD3C 65640 2 atmdx_tx_shadow 0x614B6624 65588 1 CEF: loadinfo chunk 0x614D1924 65588 1 IP mtrie node 0x614A58A0 65588 1 CEF: 16 path chunk pool 0x619241D4 65588 1 PPTP mgd timer chunk 0x606581CC 65588 1 AAA DB Chunk 0x607E5EAC 65588 1 MallocLite 0x6192420C 65588 1 PPTP: pptp_tunneltype chunk 0x6075DCB8 45924 10 FastEthernet2/ processor (Optional) Displays the processor memory information. io (Optional) Displays the I/O memory information. fragment Displays the information of the free blocks and the blocks surrounding the free blocks. detail (Optional) Displays the detailed information of all the free blocks and the blocks surrounding the free blocks that are located between the allocated blocks. Release Modification 12.3(14)T This command was introduced. 12.2(33)SRB This command was integrated into Cisco IOS Release 12.2(33)SRB. show memory fragment CF-796 Cisco IOS Configuration Fundamentals Command Reference April 2010 0x607CA400 36288 2 pak subblock chunk 0x6255648C 28948 1 CCPROXY_CT 0x6047DD7C 24628 1 atmdx_bfd_cache 0x6047DAA4 23500 1 atmdx_instance 0x6047DAE8 23500 1 atmdx_instance snap 0x60962DFC 21420 17 TCP CB 0x616F729C 20052 1 AC context chunks 0x616F72C8 20052 1 AC Mgr mgd timer chunk 0x60734010 16644 19 *Packet Header* 0x6047DE0C 16436 1 atmdx_abr_stats 0x6047DCFC 16112 2 atmdx_rx_pool_info 0x60A77E98 13060 1 DHCPD Message Workspace 0x61F50008 12852 1 CCVPM_HTSP 0x60D509BC 12580 17 Virtual Exec 0x60EFA1EC 12344 1 RSVP DB Handle Bin . . . 0x6067AE44 76 1 AAA Secrettype encrypt 0x61C0EEC0 76 1 Init 0x60F76B1C 76 1 SNMP Trap 0x60BE2444 76 1 Init 0x62638F78 76 1 EEM ED Syslog 0x6077C574 76 1 Init 0x608F7030 76 1 IPC Name String 0x608EEAB8 76 1 IPC Name 0x620468A8 76 1 ivr: ccapAppEntry_t name 0x6066D084 76 1 gk process 0x6064824C 76 1 AAA MI SG NAME Allocator PC Summary for free blocks in pool: Processor PC Total Count Name 0x6071253C 67387912 2 (fragment) 0x60734010 63292440 11 *Packet Header* 0x60962DFC 105552 10 (coalesced) 0x60D509BC 98384 10 (coalesced) 0x60D4A0B4 70776 9 (coalesced) 0x60803260 21488 4 (fragment) 0x60B2E488 19704 2 (fragment) 0x606E0278 19272 1 (coalesced) 0x606DD8D8 9024 113 Init 0x60B27FE8 5740 3 (fragment) 0x60778AAC 3504 1 (coalesced) 0x607AC764 2212 11 Process Events 0x60F7FCD4 1556 9 (fragment) 0x6071F3FC 1316 12 (fragment) 0x606C5324 1176 6 (coalesced) 0x60D7C518 1148 1 (coalesced) 0x624E170C 876 1 (coalesced) 0x60A68164 588 3 (fragment) 0x60B302C0 408 5 (fragment) 0x60976574 272 2 AAA Event Data 0x60801E38 216 2 (fragment) 0x611DA23C 164 1 shelf_info 0x60A6A638 148 1 (fragment) 0x60801D2C 148 1 (fragment) 0x60D29DCC 148 1 (fragment) 0x62628CA0 144 1 (fragment) 0x60A68218 104 1 (fragment) 0x606B9614 88 1 NameDB String 0x6090A978 84 1 (fragment) 0x606C51D0 84 1 (fragment) 0x62647558 76 1 (fragment) show memory fragment CF-797 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following is sample output from the show memory processor fragment detail command: Router# show memory processor fragment detail Processor memory Free memory size : 65566148 Number of free blocks: 230 Address Bytes Prev Next Ref PrevF NextF Alloc PC what 645A8148 0000000028 645A80F0 645A8194 001 -------- -------- 60695B20 Init 645A8194 0000000040 645A8148 645A81EC 000 0 200B4300 606B9614 NameDB String 645A81EC 0000000260 645A8194 645A8320 001 -------- -------- 607C2D20 Init 200B42B4 0000000028 200B4268 200B4300 001 -------- -------- 62366C80 Init 200B4300 0000000028 200B42B4 200B434C 000 645A8194 6490F7E8 60976574 AAA Event Data 200B434C 0000002004 200B4300 200B4B50 001 -------- -------- 6267D294 Coproc Request Structures 6490F79C 0000000028 6490F748 6490F7E8 001 -------- -------- 606DDA04 Parser Linkage 6490F7E8 0000000028 6490F79C 6490F834 000 200B4300 6491120C 606DD8D8 Init 6490F834 0000006004 6490F7E8 64910FD8 001 -------- -------- 607DF5BC Process Stack 649111A0 0000000060 64911154 6491120C 001 -------- -------- 606DE82C Parser Mode 6491120C 0000000028 649111A0 64911258 000 6490F7E8 500770F0 606DD8D8 Init 64911258 0000000200 6491120C 64911350 001 -------- -------- 603F0E38 Init . . . 504DCF54 0000001212 504DB2E4 504DD440 001 -------- -------- 60962DFC TCP CB 2C41DCA4 0000000692 2C41BCC8 2C41DF88 001 -------- -------- 60D509BC Virtual Exec 2C41DF88 0000005344 2C41DCA4 2C41F498 000 504DB2E4 6449A828 60D509BC (coalesced) 2C41F498 0000000692 2C41DF88 2C41F77C 001 -------- -------- 60D509BC Virtual Exec 6449A544 0000000692 64499794 6449A828 001 -------- -------- 60D509BC Virtual Exec 6449A828 0000007760 6449A544 6449C6A8 000 2C41DF88 504D89D4 60D509BC (coalesced) 6449C6A8 0000008044 6449A828 6449E644 001 -------- -------- 60D2AACC Virtual Exec 504D8778 0000000556 504D754C 504D89D4 001 -------- -------- 60D4A0B4 Virtual Exec 504D89D4 0000009860 504D8778 504DB088 000 6449A828 504D1B78 60D4A0B4 (coalesced) 504DB088 0000000556 504D89D4 504DB2E4 001 -------- -------- 60D4A0B4 Virtual Exec 504D168C 0000001212 504C9658 504D1B78 001 -------- -------- 60962DFC TCP CB 504D1B78 0000008328 504D168C 504D3C30 000 504D89D4 504C5B54 60962DFC (coalesced) 504D3C30 0000001212 504D1B78 504D411C 001 -------- -------- 60962DFC TCP CB 504C5870 0000000692 504C5504 504C5B54 001 -------- -------- 60D509BC Virtual Exec 504C5B54 0000005344 504C5870 504C7064 000 504D1B78 2C423A88 60D509BC (coalesced) 504C7064 0000000408 504C5B54 504C722C 001 -------- -------- 606E0E44 Chain Cache No 2C42359C 0000001212 2C41F77C 2C423A88 001 -------- -------- 60962DFC TCP CB 2C423A88 0000008328 2C42359C 2C425B40 000 504C5B54 504D411C 60962DFC (coalesced) 504E7DD8 0000000828 504E2660 504E8144 001 -------- -------- 60734010 *Packet Header* 65006A08 0000000408 65003834 65006BD0 001 -------- -------- 606E0E44 Chain Cache No 65006BD0 0000020520 65006A08 6500BC28 000 504E2660 0 60803260 (coalesced) 6500BC28 0000000828 65006BD0 6500BF94 001 -------- -------- 60734010 *Packet Header* 5C3AE7B8 0000000828 5C3AE614 5C3AEB24 001 -------- -------- 60734010 *Packet Header* 5C3AEB24 0063247532 5C3AE7B8 20000000 000 0 6500C300 60734010 (coalesced) 20000000 0000000828 5C3AEB24 2000036C 001 -------- -------- 60734010 *Packet Header* 6500BF94 0000000828 6500BC28 6500C300 001 -------- -------- 60734010 *Packet Header* 6500C300 0004760912 6500BF94 50000000 000 5C3AEB24 2C42E310 6071253C (coalesced) 50000000 0000000828 6500C300 5000036C 001 -------- -------- 60734010 *Packet Header* 2C42E0B4 0000000556 2C429430 2C42E310 001 -------- -------- 60D4A0B4 Virtual Exec 2C42E310 0062725312 2C42E0B4 00000000 000 6500C300 0 6071253C (coalesced Related Commands Command Description memory io Configures thresholds for I/O memory. memory processor Configures thresholds for processor memory. show memory multibus CF-798 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory multibus To display statistics about multibus memory, including memory-free pool statistics, use the show memory multibus command in user EXEC or privileged EXEC mode. show memory multibus [allocating-process [totals]| dead [totals]| free [totals]] Syntax Description Command Modes User EXEC Privileged EXEC Command History Examples The following is sample output from the show memory multibus command: Router# show memory multibus Processor memory Address Bytes Prev Next Ref PrevF NextF Alloc PC what 6540BBA0 0000016388 00000000 6540FBD4 001 -------- -------- 60883984 TW Buckes 6540FBD4 0000016388 6540BBA0 65413C08 001 -------- -------- 60883984 TW Buckes 65413C08 0000016388 6540FBD4 65417C3C 001 -------- -------- 60883984 TW Buckes 65417C3C 0000006004 65413C08 654193E0 001 -------- -------- 608A0D4C Process k 654193E0 0000012004 65417C3C 6541C2F4 001 -------- -------- 608A0D4C Process k 6541C2F4 0000411712 654193E0 65480B64 000 0 0 608A0D4C (fragmen) 65480B64 0000020004 6541C2F4 654859B8 001 -------- -------- 608CF99C Managed s 654859B8 0000010004 65480B64 654880FC 001 -------- -------- 6085C7F8 List Eles 654880FC 0000005004 654859B8 654894B8 001 -------- -------- 6085C83C List Heas 654894B8 0000000048 654880FC 65489518 001 -------- -------- 62BF31DC *Init* . . . Table 117 describes the significant fields shown in the display. allocating-process [totals] (Optional) Displays allocating memory totals by name. dead [totals] (Optional) Displays memory totals on dead processes. fragment [detail] (Optional) Displays memory statistics for fragmented processes. free [totals] (Optional) Displays statistics on free memory. statistics [history] (Optional) Displays memory pool history statistics on all processes. Release Modification 12.0 This command was introduced. Table 117 show memory multibus Field Descriptions Field Description Address Hexadecimal address of the block. Bytes Size of the block (in bytes). show memory multibus CF-799 Cisco IOS Configuration Fundamentals Command Reference April 2010 Prev Address of the preceding block (should match the address on the preceding line). Next Address of the following block (should match the address on the following line). Ref Reference count for that memory block, indicating how many different processes are using that block of memory. PrevF Address of the preceding free block (if free). NextF Address of the following free block (if free). Alloc PC Address of the program counter that allocated the block. What Name of the process that owns the block, or “(fragmen)” if the block is a fragment, or “(coalesced)” if the block was coalesced from adjacent free blocks. Table 117 show memory multibus Field Descriptions (continued) Field Description show memory pci CF-800 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory pci To display statistics about Peripheral Component Interconnect (PCI) memory, use the show memory pci command in user EXEC or privileged EXEC mode. show memory pci Syntax Description This command has no arguments or keywords. Command Modes User EXEC Privileged EXEC Command History Examples The following is sample output from the show memory pci command: Router# show memory pci I/O memory Address Bytes Prev Next Ref PrevF NextF Alloc PC what 0E000000 0000000032 00000000 0E000050 000 64F5EBF4 0 00000000 (fragmen) 0E000050 0000000272 0E000000 0E000190 001 -------- -------- 607E2EC0 *Packet * 0E000190 0000000272 0E000050 0E0002D0 001 -------- -------- 607E2EC0 *Packet * 0E0002D0 0000000272 0E000190 0E000410 001 -------- -------- 607E2EC0 *Packet * 0E000410 0000000272 0E0002D0 0E000550 001 -------- -------- 607E2EC0 *Packet * 0E000550 0000000272 0E000410 0E000690 001 -------- -------- 607E2EC0 *Packet * 0E000690 0000000272 0E000550 0E0007D0 001 -------- -------- 607E2EC0 *Packet * 0E0007D0 0000000272 0E000690 0E000910 001 -------- -------- 607E2EC0 *Packet * 0E000910 0000000272 0E0007D0 0E000A50 001 -------- -------- 607E2EC0 *Packet * 0E000A50 0000000272 0E000910 0E000B90 001 -------- -------- 607E2EC0 *Packet * 0E000B90 0000000272 0E000A50 0E000CD0 001 -------- -------- 607E2EC0 *Packet * Address Bytes Prev Next Ref PrevF NextF Alloc PC what 0E000CD0 0000000272 0E000B90 0E000E10 001 -------- -------- 607E2EC0 *Packet * 0E000E10 0000000272 0E000CD0 0E000F50 001 -------- -------- 607E2EC0 *Packet * Table 118 describes the significant fields shown in the display. Release Modification 12.0 This command was introduced. Table 118 show memory pci Field Descriptions Field Description Address Hexadecimal address of the block. Bytes Size of the block (in bytes). Prev Address of the preceding block (should match the address on the preceding line). Next Address of the following block (should match the address on the following line). Ref Reference count for that memory block, indicating how many different processes are using that block of memory. show memory pci CF-801 Cisco IOS Configuration Fundamentals Command Reference April 2010 PrevF Address of the preceding free block (if free). NextF Address of the following free block (if free). Alloc PC Address of the program counter that allocated the block. what Name of process that owns the blocks. Table 118 show memory pci Field Descriptions (continued) Field Description show memory processor CF-802 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory processor To display statistics on the Router Processor memory, use the show memory processor command in user EXEC or privileged EXEC mode. show memory processor [fragment | free | statistics | allocating-process [totals] | dead [totals]] Syntax Description Command Modes User EXEC (>) Privileged EXEC (#) Command History Examples The following is sample output from the show memory processor command: Router# show memory processor Processor memory Address Bytes Prev Next Ref PrevF NextF Alloc PC what 6540BBA0 0000016388 00000000 6540FBD4 001 -------- -------- 60883984 TW Buckes 6540FBD4 0000016388 6540BBA0 65413C08 001 -------- -------- 60883984 TW Buckes 65413C08 0000016388 6540FBD4 65417C3C 001 -------- -------- 60883984 TW Buckes 65417C3C 0000006004 65413C08 654193E0 001 -------- -------- 608A0D4C Process k 654193E0 0000012004 65417C3C 6541C2F4 001 -------- -------- 608A0D4C Process k 6541C2F4 0000411712 654193E0 65480B64 000 0 0 608A0D4C (fragmen) 65480B64 0000020004 6541C2F4 654859B8 001 -------- -------- 608CF99C Managed s 654859B8 0000010004 65480B64 654880FC 001 -------- -------- 6085C7F8 List Eles 654880FC 0000005004 654859B8 654894B8 001 -------- -------- 6085C83C List Heas 654894B8 0000000048 654880FC 65489518 001 -------- -------- 62BF31DC *Init* fragment (Optional) Displays the block details of fragmented free blocks and allocated blocks, which are shown either preceding or following the blocks on the free list. free (Optional) Displays the number of free blocks. statistics (Optional) Displays memory processor statistics. allocating-process (Optional) Displays the allocated block name. totals (Optional) Displays the allocated memory total. dead (Optional) Displays information about memory owned by dead processes. totals (Optional) Displays the dead process memory total. Release Modification 12.0 This command was introduced. 12.4(24)T This command was modified in a release earlier than Cisco IOS Release 12.4(24)T. The allocating-process and dead keywords were added. show memory processor CF-803 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 119 describes the significant fields shown in the display. The following is sample output from the show memory processor fragment command: Router# show memory processor fragment Processor memory Free memory size : 3144348 Number of free blocks: 96 Allocator PC Summary for allocated blocks in pool: Processor PC Total Count Name 0x6069A038 262196 1 TACL FLT 0x62224AA8 219188 1 QOS_MODULE_MAIN 0x61648840 131124 1 Init 0x6218DAA4 73780 1 CCSIP_UDP_SOCKET 0x61649288 65588 1 CEF: loadinfo chunk 0x61BFD4B8 65588 1 PPTP mgd timer chunk 0x61EE1050 65588 1 eddri_self_event 0x607C13C4 49204 1 Exec 0x608A0D4C 35208 4 Process Stack 0x6069D804 32052 1 TACL hist 0x61631A90 21444 2 CEF: IPv4 Unicast RPF subblock 0x62BA5DD8 20432 1 Init 0x6086F858 20052 1 RMI-RO_RU Chun 0x608CF99C 20052 1 Managed Chunk Queue Elements Table 120 describes the significant fields shown in the display. Table 119 show memory processor Field Descriptions Field Description Address Hexadecimal address of the block. Bytes Size of the block (in bytes). Prev Address of the preceding block (should match the address on the preceding line). Next Address of the following block (should match the address on the following line). Ref Reference count for that memory block, indicating how many different processes are using that block of memory. PrevF Address of the preceding free block (if free). NextF Address of the following free block (if free). Alloc PC Address of the program counter that allocated the block. What Name of the process that owns the blocks. Table 120 show memory processor fragment Field Descriptions Field Description PC Program counter. Total Total memory allocated by the process (in bytes). Count Number of allocations. Name Name of the allocating process. show memory processor CF-804 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following is sample output from the show memory processor free command: Router# show memory processor free Processor memory Address Bytes Prev Next Ref PrevF NextF Alloc PC what 24 Free list 1 66994680 0000000072 66994618 669946FC 000 0 6698FFC8 60699114 Turbo ACr 6698FFC8 0000000072 6698FF60 66990044 000 66994680 659CF6B0 60699114 Turbo ACr 659CF6B0 0000000024 659CF678 659CF6FC 000 6698FFC8 659CF86C 6078A2CC Init 659CF86C 0000000024 659CF710 659CF8B8 000 659CF6B0 65ADB53C 6078A2CC Init 65ADB53C 0000000024 65ADB504 65ADB588 000 659CF86C 65ADFC38 6078A2CC Init 65ADFC38 0000000024 65ADFC00 65ADFC84 000 65ADB53C 65B6C504 6078A2CC Init 65B6C504 0000000024 65B6C4B8 65B6C550 000 65ADFC38 6593E924 6078A2CC Init 6593E924 0000000028 6593E8E8 6593E974 000 65B6C504 65CCB054 6078A2CC Init 65CCB054 0000000024 65CCB01C 65CCB0A0 000 6593E924 65CCBD98 6078A2CC Init 65CCBD98 0000000028 65CCBD60 65CCBDE8 000 65CCB054 65CCFB70 6078A2CC Init 65CCFB70 0000000024 65CCFB38 65CCFBBC 000 65CCBD98 65D0BB58 6078A2CC Init 65D0BB58 0000000024 65D0BB20 65D0BBA4 000 65CCFB70 65D0C5F0 6078A2CC Init 65D0C5F0 0000000024 65D0C5B8 65D0C63C 000 65D0BB58 65CFF2F4 6078A2CC Init 65CFF2F4 0000000024 65CFF2BC 65CFF340 000 65D0C5F0 6609B7B8 6078A2CC Init 6609B7B8 0000000036 6609AFC8 6609B810 000 65CFF2F4 660A0BD4 6078A2CC Init Table 121 describes the significant fields shown in the display. The following is sample output from the show memory processor statistics command: Router# show memory processor statistics Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor 6540BBA0 415187836 27216968 387970868 385755044 381633404 I/O E000000 33554432 6226336 27328096 27328096 27317852 . . . Table 121 show memory processor free Field Descriptions Field Description Address Hexadecimal address of the block. Bytes Size of the block (in bytes). Prev Address of the preceding block (should match the address on the preceding row). Next Address of the following block (should match the address on the following row). Ref Reference count for that memory block, indicating how many different processes are using that block of memory. PrevF Address of the preceding free block (if free). NextF Address of the following free block (if free). Alloc PC Address of the program counter that allocated the block. what Name of the process that owns the block. show memory processor CF-805 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 122 describes the significant fields shown in the display. The following is sample output from the show memory processor allocating-process command: Router# show memory processor allocating-process PC Total Count Name 0x6013A948 3719220 1 atmdx_setup_vc_table 0x6064EB28 2581132 291 Process Stack 0x627E2420 2569476 78 CCE dp subbloc 0x62A098C8 1637116 24 regex 0x62EAF010 979876 77 TW Buckets 0x602439EC 935064 962 *Packet Header* 0x614B3A4C 916724 13 Init 0x6013A89C 852020 1 atmdx_vc_table 0x61A54AEC 786292 1 Init 0x62D7BDD0 702336 160 TCL Chunks 0x62EB0458 666988 14 pak subblock chunk 0x60767C38 641076 1 CCPROXY_CT 0x607439C4 524340 1 L2X Hash Table 0x60271864 434328 28 Normal 0x602718F8 407592 148 Normal 0x600CE0C0 393528 6 Init The following is sample output from the show memory processor dead command: Router# show memory processor dead PC Total Count Name 0x61E4EB70 65588 1 IP Static Rout 0x62332A2C 65588 1 MFI: Clnt SMsg 0x6268DFE4 32820 1 PPP Context Ch 0x62660CCC 32820 1 PPP HANDLE IDs 0x61B9B350 12052 1 IP Addresses 0x614246F8 4148 1 AAA Unique Id Hash Table 0x61BA93CC 3688 1 IPAD DIT chunk 0x63B630A4 2544 12 Autoinstall 0x61824BFC 2084 2 CEF: fib GSB 0x62E82CEC 2052 1 Reg Function 1 0x62E8A028 1824 24 Autoinstall 0x617DE354 1744 2 CEF: paths 0x6149E638 1552 1 String-DB owne 0x6149E490 1552 1 String-DB entr 0x60191180 1216 8 AF entry 0x617EB5AC 1176 2 CEF: pathl 0x62EAE860 1156 1 Event Manager Table 0x6149E4BC 920 12 NameDB String 0x6176BCF4 884 2 Ether OAM subblock Table 122 show memory processor statistics Field Descriptions Field Description Head Hexadecimal address of the head of the memory allocation chain. Total(b) Sum of the used bytes plus free bytes. Used(b) Amount of memory in use (in bytes). Free(b) Amount of memory not in use (in bytes). Lowest(b) Smallest amount of free memory since the last boot (in bytes). Largest(b) Size of the largest available free block (in bytes). show memory scan CF-806 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory scan To monitor the number and type of parity (memory) errors on your system, use the show memory scan command in EXEC mode. show memory scan Syntax Description This command has no arguments or keywords. Command Modes EXEC Command History Examples The following example shows a result with no memory errors: Router# show memory scan Memory scan is on. No parity error has been detected. If errors are detected in the system, the show memory scan command generates an error report. In the following example, memory scan detected a parity error: Router# show memory scan Memory scan is on. Total Parity Errors 1. Address BlockPtr BlckSize Disposit Region Timestamp 6115ABCD 60D5D090 9517A4 Scrubed Local 16:57:09 UTC Thu Mar 18 Table 123 describes the fields contained in the error report. Release Modification 12.0(4)XE This command was introduced. 12.0(7)T This command was implemented in Cisco IOS Release 12.0(7) T. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 123 show memory scan Field Descriptions Field Description Address The byte address where the error occurred. BlockPtr The pointer to the block that contains the error. BlckSize The size of the memory block show memory scan CF-807 Cisco IOS Configuration Fundamentals Command Reference April 2010 Disposit The action taken in response to the error: • BlockInUse—An error was detected in a busy block. • InFieldPrev—An error was detected in the previous field of a block header. • InHeader—An error was detected in a block header. • Linked—A block was linked to a bad list. • MScrubed—The same address was “scrubbed” more than once, and the block was linked to a bad list. • MultiError—Multiple errors have been found in one block. • NoBlkHdr—No block header was found. • NotYet—An error was found; no action has been taken at this time. • Scrubed—An error was “scrubbed.” • SplitLinked—A block was split, and only a small portion was linked to a bad list. Region The memory region in which the error was found: • IBSS—image BSS • IData—imagedata • IText—imagetext • local—heap Timestamp The time the error occurred. Table 123 show memory scan Field Descriptions (continued) Field Description show memory statistics history table CF-808 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory statistics history table To display the history of memory consumption, use the show memory statistics history table command in user EXEC or privileged EXEC mode. show memory statistics history table Syntax Description This command has no arguments or keywords. Command Modes User EXEC Privileged EXEC Command History Examples The following is sample output from the show memory statistics history table command: Router# show memory statistics history table History for Processor memory Time: 15:48:56.806 Used(b): 422748036 Largest(b): 381064952 Free blocks :291 Maximum memory users for this period Process Name Holding Num Alloc Virtual Exec 26992 37 TCP Protocols 14460 6 IP Input 1212 1 Time: 14:42:54.506 Used(b): 422705876 Largest(b): 381064952 Free blocks :296 Maximum memory users for this period Process Name Holding Num Alloc Exec 400012740 24 Dead 1753456 90 Pool Manager 212796 257 Time: 13:37:26.918 Used(b): 20700520 Largest(b): 381064952 Free blocks :196 Maximum memory users for this period Process Name Holding Num Alloc Exec 8372 5 Time: 12:39:44.422 Used(b): 20701436 Largest(b): 381064952 Free blocks :193 Time: 11:46:25.135 Used(b): 20701436 Largest(b): 381064952 Free blocks :193 Maximum memory users for this period Process Name Holding Num Alloc CDP Protocol 3752 25 Release Modification 12.3(14)T This command was introduced. 12.2(33)SRB This command was integrated into Cisco IOS Release 12.2(33)SRB. show memory statistics history table CF-809 Cisco IOS Configuration Fundamentals Command Reference April 2010 Time: 10:44:24.342 Used(b): 20701400 Largest(b): 381064952 Free blocks :194 Time: 09:38:53.038 Used(b): 20701400 Largest(b): 381064952 Free blocks :194 Time: 08:33:35.154 Used(b): 20701400 Largest(b): 381064952 Free blocks :194 Time: 07:28:05.987 Used(b): 20701400 Largest(b): 381064952 Free blocks :194 Time: 06:35:22.878 Used(b): 20701400 Largest(b): 381064952 Free blocks :194 Time: 05:42:14.286 Used(b): 20701400 Largest(b): 381064952 Free blocks :194 Time: 04:41:53.486 Used(b): 20701400 Largest(b): 381064952 Free blocks :194 Time: 03:48:47.891 Used(b): 20701400 Largest(b): 381064952 Free blocks :194 Time: 02:46:32.391 Used(b): 20701400 Largest(b): 381064952 Free blocks :194 Time: 01:54:27.931 Used(b): 20717804 Largest(b): 381064952 Free blocks :189 Time: 01:02:05.535 Used(b): 20717804 Largest(b): 381064952 Free blocks :189 Maximum memory users for this period Process Name Holding Num Alloc Entity MIB API 67784 16 TTY Background 12928 4 Exec 7704 3 Time: 00:00:17.936 Used(b): 21011192 Largest(b): 381064952 Free blocks :186 Maximum memory users for this period Process Name Holding Num Alloc Init 18653520 6600 CCPROXY_CT 599068 57 Proxy Session Applic 275424 21 History for I/O memory Time: 15:48:56.809 Used(b): 7455520 Largest(b): 59370080 Free blocks :164 Time: 14:42:54.508 Used(b): 7458064 Largest(b): 59370080 Free blocks :165 Maximum memory users for this period Process Name Holding Num Alloc Pool Manager 141584 257 Time: 13:37:26.920 Used(b): 7297744 Largest(b): 59797664 Free blocks :25 Time: 12:39:44.424 Used(b): 7297744 Largest(b): 59797664 Free blocks :25 show memory statistics history table CF-810 Cisco IOS Configuration Fundamentals Command Reference April 2010 Time: 11:46:25.137 Used(b): 7297744 Largest(b): 59797664 Free blocks :25 Time: 10:44:24.344 Used(b): 7297744 Largest(b): 59797664 Free blocks :25 Time: 09:38:53.040 Used(b): 7297744 Largest(b): 59797664 Free blocks :25 Time: 08:33:35.156 Used(b): 7297744 Largest(b): 59797664 Free blocks :25 Time: 07:28:05.985 Used(b): 7297744 Largest(b): 59797664 Free blocks :25 Time: 06:35:22.877 Used(b): 7297744 Largest(b): 59797664 Free blocks :25 Time: 05:42:14.285 Used(b): 7297744 Largest(b): 59797664 Free blocks :25 Time: 04:41:53.485 Used(b): 7297744 Largest(b): 59797664 Free blocks :25 Time: 03:48:47.889 Used(b): 7297744 Largest(b): 59797664 Free blocks :25 Time: 02:46:32.389 Used(b): 7297744 Largest(b): 59797664 Free blocks :25 Time: 01:54:27.929 Used(b): 7308336 Largest(b): 59797664 Free blocks :23 Time: 01:02:05.533 Used(b): 7308336 Largest(b): 59797664 Free blocks :23 Time: 00:00:17.937 Used(b): 7308336 Largest(b): 59797664 Free blocks :23 Maximum memory users for this period Process Name Holding Num Alloc Init 7296000 214 Pool Manager 816 3 Related Commands Command Description memory statistics history table Changes the memory log time. show memory traceback CF-811 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory traceback To display memory traceback information, use the show memory traceback command in privileged EXEC mode. show memory traceback [id | exclusive | totals] Syntax Description Command Modes Privileged EXEC (#) Command History Usage Guidelines Before you can enable the show memory traceback command, you must configure the memory record events command in global configuration mode. Examples The following is sample output from the show memory traceback command for traceback ID 100: Router# configure terminal Router(config)# memory record events Memory event recording already enabled! Router(config)# exit Router# show memory traceback 100 Traceback: [100] 0x60630D9Cz 0x60632B50z 0x6063426Cz 0x6063483Cz 0x61AE4910) The following is sample output from the show memory traceback command using the exclusive keyword: Router# configure terminal Router(config)# memory record events Memory event recording already enabled! Router(config)# exit Router# show memory traceback exclusive Address Size refcount tid What 682E53F4 0005206856 000 T43 (coalesced) 68D2739C 0000002212 000 T85 (coalesced) id (Optional) Traceback ID. exclusive (Optional) Displays the memory blocks that have traceback information. totals (Optional) Displays information about memory usage of blocks having tracebacks. Release Modification 15.0(1)M This command was introduced in a release earlier than Cisco IOS Release 15.0(1)M. show memory traceback CF-812 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 124 describes the significant fields shown in the display. Related Commands Table 124 show memory traceback Field Descriptions Field Description Address Hexadecimal address of the block. Size Amount of memory, in bytes, used by the task. refcount Reference count for the memory block, indicating how many different processes are using that block of memory. tid Task ID. What Name of the process that owns the block or fragment. Specifies if the block is a fragment or coalesced. Command Description show memory events Displays recorded memory events. show memory transient CF-813 Cisco IOS Configuration Fundamentals Command Reference April 2010 show memory transient To display statistics about transient memory, use the show memory transient command in user EXEC or privileged EXEC mode. show memory transient [allocating-process [totals] | dead [totals] | fragment [detail] | free [totals] | statistics [history]] Syntax Description Command Modes User EXEC Privileged EXEC Command History Examples The following is sample output from the show memory transient command: Router# show memory transient Processor memory Address Bytes Prev Next Ref PrevF NextF Alloc PC what 81F99C00 0002236408 00000000 821BBC28 000 829C8104 82776FD0 8060B6D0 (coalesc) 821BBC28 0000020004 81F99C00 821C0A7C 001 -------- -------- 8002D5C0 Managed s 821C0A7C 0000010004 821BBC28 821C31C0 001 -------- -------- 811604C0 List Eles 821C31C0 0000005004 821C0A7C 821C457C 001 -------- -------- 81160500 List Heas Table 125 describes the significant fields shown in the display. allocating-process (Optional) Displays allocating memory totals by name. dead [totals] (Optional) Displays memory totals on dead processes. fragment [detail] (Optional) Displays memory statistics for fragmented processes. free [totals] (Optional) Displays statistics on free memory. statistics [history] (Optional) Displays memory pool history statistics on all processes. Release Modification 12.0 This command was introduced. Table 125 show memory transient Field Descriptions Field Description Address Hexadecimal address of the block. Bytes Size of the block (in bytes). Prev Address of the preceding block (should match the address on preceding line). Next Address of the following block (should match the address on following line). Ref Reference count for that memory block, indicating how many different processes are using that block of memory. PrevF Address of the preceding free block (if free). show memory transient CF-814 Cisco IOS Configuration Fundamentals Command Reference April 2010 NextF Address of the following free block (if free). Alloc PC Address of the system call that allocated the block. what Name of the process that owns the block, or “(fragment)” if the block is a fragment, or “(coalesced)” if the block was coalesced from adjacent free blocks. Table 125 show memory transient Field Descriptions (continued) Field Description show microcode CF-815 Cisco IOS Configuration Fundamentals Command Reference April 2010 show microcode To display microcode image information available on line cards, use the show microcode command in EXEC mode. show microcode Syntax Description This command has no arguments or keywords. Command Modes EXEC Command History Examples The following is sample output from the show microcode command: Router# show microcode Microcode bundled in system Card Microcode Target Hardware Description Type Version Version ---- --------- --------------- ----------- SP 2.3 11.x SP version 2.3 EIP 1.1 1.x EIP version 1.1 TRIP 1.2 1.x TRIP version 1.2 FIP 1.4 2.x FIP version 1.4 HIP 1.1 1.x HIP version 1.1 SIP 1.1 1.x SIP version 1.1 FSIP 1.1 1.x FSIP version 1.1 In the following example for the Cisco 7200 series router, the output from the show microcode command lists the hardware types that support microcode download. For each type, the default microcode image name is displayed. If there is a configured default override, that name also is displayed. router# show microcode Microcode images for downloadable hardware HW Type Microcode image names ------------------------------------------ ecpa default slot0:xcpa26-0 configured slot0:xcpa26-2 pcpa default slot0:xcpa26-4 Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show microcode CF-816 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description microcode (7000/7500) Specifies where microcode should be loaded from on Cisco 7500/7000RSP routers. microcode (7200) Configures a default override for the microcode that is downloaded to the hardware on a Cisco 7200 series router. show mls statistics CF-817 Cisco IOS Configuration Fundamentals Command Reference April 2010 show mls statistics To display the Multilayer Switching (MLS) statistics for the Internet Protocol (IP), Internetwork Packet Exchange (IPX), multicast, Layer 2 protocol, and quality of service (QoS), use the show mls statistics command in user EXEC or privileged EXEC mode. show mls statistics [module num] Syntax Description Defaults This command has no default settings. Command Modes User EXEC Privileged EXEC Command History Usage Guidelines The total packets switched performance displayed is the rate calculated as the average rate in a period within the last 30 seconds. The ingress ACL denied packet count is displayed in the Total packets L3 Switched field and in the Total packets dropped by ACL field. The RPF failed packet count is displayed in the Total packets L3 Switched field. If the IP multicast source sends traffic to any multicast group that does not have an (*,G) entry present in the mroute table, the show mls statistics command displays these packets as incrementing in the Total Mcast Packets Switched/Routed field. These packets are dropped in the hardware because there are no receivers for that group and no entry in the mroute table. Examples This example shows how to display the MLS statistics for all modules: Router# show mls statistics Statistics for Earl in Module 2 L2 Forwarding Engine Total packets Switched : 20273@ 22552 pps module num (Optional) Displays the MLS statistics for a specific module. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17b)SXA This command was changed to include the module num keyword and argument. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(17d)SXB1 The output was changed to include total packets switched information. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show mls statistics CF-818 Cisco IOS Configuration Fundamentals Command Reference April 2010 L3 Forwarding Engine Total Packets Bridged : 20273 Total Packets FIB Switched : 7864 Total Packets ACL Routed : 0 Total Packets Netflow Switched : 0 Total Mcast Packets Switched/Routed : 220598 Total ip packets with TOS changed : 0 Total ip packets with COS changed : 0 Total non ip packets COS changed : 0 Total packets dropped by ACL : 0 Total packets dropped by Policing : 705757744 Statistics for Earl in Module 9 L2 Forwarding Engine Total packets Switched : 16683@ 1 pps L3 Forwarding Engine Total Packets Bridged : 0 Total Packets FIB Switched : 0 Total Packets ACL Routed : 0 Total Packets Netflow Switched : 0 Total Mcast Packets Switched/Routed : 0 Total ip packets with TOS changed : 0 Total ip packets with COS changed : 0 Total non ip packets COS changed : 0 Total packets dropped by ACL : 0 Total packets dropped by Policing : 277949053 Router# This example shows how to display the MLS statistics for a specific module: Router# show mls statistics module 1 Statistics for Earl in Module 1 L2 Forwarding Engine Total packets Switched : 2748166@ 22332 pps >> L3 Forwarding Engine Total Packets Bridged : 92750@ 34 pps Total Packets FIB Switched : 7 Total Packets ACL Routed : 0 Total Packets Netflow Switched : 0 Total Mcast Packets Switched/Routed : 3079200 Total ip packets with TOS changed : 0 Total ip packets with COS changed : 0 Total non ip packets COS changed : 0 Total packets dropped by ACL : 0 Total packets dropped by Policing : 0 Total Unicast RPF failed packets : 0 Errors MAC/IP length inconsistencies : 0 Short IP packets received : 0 IP header checksum errors : 0 MAC/IPX length inconsistencies : 0 Short IPX packets received : 0 Router# show mls statistics CF-819 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description show mls asic display the application-specific integrated circuit (ASIC) version show mls df-table Displays information about the DF table. show mls ip Displays the Multilayer Switching (MLS) IP information. show mls ipx Displays the Multilayer Switching (MLS) IPX information. show mls qos Displays Multilayer Switching (MLS) quality of service (QoS) information show mls statistics Displays the Multilayer Switching (MLS) statistics for the Internet Protocol (IP) show module CF-820 Cisco IOS Configuration Fundamentals Command Reference April 2010 show module To display the module status and information, use the show module command in user EXEC or privileged EXEC mode. show module [mod-num | all | provision | version] Syntax Description Defaults This command has no default settings. Command Modes User EXEC Privileged EXEC Command History Usage Guidelines In the Mod Sub-Module fields, the show module command displays the supervisor engine number but appends the uplink daughter card’s module type and information. Entering the show module command with no arguments is the same as entering the show module all command. Examples This example shows how to display information for all modules on a Cisco 7600 series router that is configured with a Supervisor Engine 720: Router# show module Mod Ports Card Type Model Serial No. --- ----- -------------------------------------- ------------------ ----------- 5 2 Supervisor Engine 720 (Active) WS-SUP720-BASE SAD0644030K 8 48 aCEF720 48 port 10/100/1000 Ethernet WS-X6748-GE-TX SAD07010045 9 32 dCEF720 32 port Gigabit Ethernet WS-X6832-SFP SAD07010045 Mod MAC addresses Hw Fw Sw Status --- ---------------------------------- ------ ------------ ------------ ------- 5 00e0.aabb.cc00 to 00e0.aabb.cc3f 1.0 12.2(2003012 12.2(2003012 Ok 8 0005.9a3b.d8c4 to 0005.9a3b.d8c7 0.705 7.1(0.12-Eng 12.2(2003012 Ok 9 00e0.b0ff.f0f4 to 00e0.b0ff.f0f5 0.207 12.2(2002082 12.2(2003012 Ok mod-num (Optional) Number of the module. all (Optional) Displays the information for all modules. provision (Optional) Displays the status about the module provisioning. version (Optional) Displays the version information. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show module CF-821 Cisco IOS Configuration Fundamentals Command Reference April 2010 Mod Sub-Module Model Serial Hw Status --- --------------------------- --------------- --------------- ------- ------- 5 Policy Feature Card 3 WS-F6K-PFC3 SAD0644031P 0.302 Ok 5 MSFC3 Daughtercard WS-SUP720 SAD06460172 0.701 Mod Online Diag Status --- ------------------- 5 Not Available 7 Bypass 8 Bypass 9 Bypass Router# This example shows how to display information for a specific module: Router# show module 2 Mod Ports Card Type Model Serial No. --- ----- -------------------------------------- ------------------ ----------- 5 2 Supervisor Engine 720 (Active) WS-SUP720-BASE SAD0644030K Mod MAC addresses Hw Fw Sw Status --- ---------------------------------- ------ ------------ ------------ ------- 5 00e0.aabb.cc00 to 00e0.aabb.cc3f 1.0 12.2(2003012 12.2(2003012 Ok Mod Sub-Module Model Serial Hw Status --- --------------------------- --------------- --------------- ------- ------- 5 Policy Feature Card 3 WS-F6K-PFC3 SAD0644031P 0.302 Ok 5 MSFC3 Daughtercard WS-SUP720 SAD06460172 0.701 Mod Online Diag Status --- ------------------- 5 Not Available Router# This example shows how to display version information: Router# show module version Mod Port Model Serial # Versions --- ---- ------------------ ----------- -------------------------------------- 2 0 WS-X6182-2PA Hw : 1.0 Fw : 12.2(20030125:231135) Sw : 12.2(20030125:231135) 4 16 WS-X6816-GBIC SAD04400CEE Hw : 0.205 WS-F6K-DFC3A SAD0641029Y Hw : 0.501 Fw : 12.2(20020828:202911) Sw : 12.2(20030125:231135) 6 2 WS-X6K-SUP3-BASE SAD064300GU Hw : 0.705 Fw : 7.1(0.12-Eng-02)TAM Sw : 12.2(20030125:231135) Sw1: 8.1(0.45)KIS WS-X6K-SUP3-PFC3 SAD064200VR Hw : 0.701 Fw : 12.2(20021016:001154) Sw : 12.2(20030125:231135) WS-F6K-PFC3 SAD064300M7 Hw : 0.301 9 48 WS-X6548-RJ-45 SAD04490BAC Hw : 0.301 Fw : 6.3(1) Sw : 7.5(0.30)CFW11 Router# This example shows how to display module provisioning information: Router# show module provision show module CF-822 Cisco IOS Configuration Fundamentals Command Reference April 2010 Module Provision 1 dynamic 2 dynamic 3 dynamic 4 dynamic 5 dynamic 6 dynamic 7 dynamic 8 dynamic 9 dynamic 10 dynamic 11 dynamic 12 dynamic 13 dynamic Router# Related Commands Command Description show interfaces Displays the status and statistics for the interfaces in the chassis. show environment alarm Displays the information about the environmental alarm. show fm summary Displays a summary of FM Information. show environment status Displays the information about the operational FRU status. show monitor event-trace CF-823 Cisco IOS Configuration Fundamentals Command Reference April 2010 show monitor event-trace To display event trace messages for Cisco IOS software subsystem components, use the show monitor event-trace command in privileged EXEC mode. show monitor event-trace [all-traces] [component {all | back hour:minute | clock hour:minute | from-boot seconds | latest | parameters}] Syntax Description Command Modes Privileged EXEC (#) Command History all-traces (Optional) Displays all event trace messages in memory to the console. component (Optional) Name of the Cisco IOS software subsystem component that is the object of the event trace. To get a list of components that support event tracing in this release, use the monitor event-trace ? command. all Displays all event trace messages currently in memory for the specified component. back hour:minute Specifies how far back from the current time you want to view messages. For example, you can gather messages from the last 30 minutes. The time argument is specified in hours and minutes format (hh:mm). clock hour:minute Displays event trace messages starting from a specific clock time in hours and minutes format (hh:mm). from-boot seconds Displays event trace messages starting from a specified number of seconds after booting (uptime). To display the uptime, in seconds, enter the show monitor event-trace component from-boot ? command. latest Displays only the event trace messages since the last show monitor event-trace command was entered. parameters Displays the trace parameters. The only parameter displayed is the size (number of trace messages) of the trace file. Release Modification 12.0(18)S This command was introduced. 12.2(8)T This command was integrated into Cisco IOS Release 12.2(8)T. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. The show monitor event-trace cef comand replaced the show cef events and show ip cef events commands. 12.2(18)SXE This command was integrated into Cisco IOS Release 12.2(18)SXE. The spa component keyword was added to support online insertion and removal (OIR) event messages for shared port adapters (SPAs). The bfd keyword was added for the component argument to display trace messages relating to the Bidirectional Forwarding Detection (BFD) feature. 12.4(4)T Support for the bfd keyword was added for Cisco IOS Release 12.4(4)T. 12.0(31)S Support for the bfd keyword was added for Cisco IOS Release 12.0(31)S. show monitor event-trace CF-824 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines Use the show monitor event-trace command to display trace message information. The trace function is not locked while information is being displayed to the console, which means that new trace messages can accumulate in memory. If entries accumulate faster than they can be displayed, some messages can be lost. If this happens, the show monitor event-trace command will generate a message indicating that some messages might be lost; however, messages will continue to display on the console. If the number of lost messages is excessive, the show monitor event-trace command will stop displaying messages. Use the bfd keyword for the component argument to display trace messages relating to the BFD feature. Use the cfd keyword for the component argument to display trace messages relating to the crypto fault detection feature. This keyword displays the contents of the error trace buffers in an encryption data path. Examples IPC Component Example The following is sample output from the show monitor event-trace component command for the interprocess communication (IPC) component. Notice that each trace message is numbered and is followed by a time stamp (derived from the device uptime). Following the time stamp is the component-specific message data. Router# show monitor event-trace ipc 3667: 6840.016:Message type:3 Data=0123456789 3668: 6840.016:Message type:4 Data=0123456789 3669: 6841.016:Message type:5 Data=0123456789 3670: 6841.016:Message type:6 Data=0123456 BFD Component for Cisco IOS Release 12.2(18)SXE, 12.0(31)S, and 12.4(4)T Use the show monitor event-trace bfd all command to display logged messages for important BFD events in the recent past. The following trace messages show BFD session state changes: Router# show monitor event-trace bfd all 3d03h: EVENT: Session [172.16.10.2,172.16.10.1,Fa6/0,1], event Session create, state Unknown -> Fail 3d03h: EVENT: Session [172.16.10.2,172.16.10.1,Fa6/0,1], state Fail -> Down (from LC) 3d03h: EVENT: Session [172.16.10.2,172.16.10.1,Fa6/0,1], state Down -> Init (from LC) 3d03h: EVENT: Session [172.16.10.2,172.16.10.1,Fa6/0,1], state Init -> Up (from LC) 3d07h: EVENT: Session [172.16.10.2,172.16.10.1,Fa6/0,2], event Session 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB and implemented on the Cisco 10000 series routers. 12.4(9)T The cfd keyword was added as an entry for the component argument to display trace messages relating to crypto fault detection. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB. 12.4(20)T This command was integrated into Cisco IOS Release 12.4(20)T. Release Modification show monitor event-trace CF-825 Cisco IOS Configuration Fundamentals Command Reference April 2010 create, state Unknown -> Fail 3d07h: EVENT: Session [172.16.10.2,172.16.10.1,Fa6/0,2], state Fail -> Down (from LC) 3d07h: EVENT: Session [172.16.10.2,172.16.10.1,Fa6/0,2], state Down -> Up (from LC) To display trace information for all components configured for event tracing on the networking device, enter the show monitor event-trace all-traces command. In this example, separate output is provided for each event, and message numbers are interleaved between the events. Router# show monitor event-trace all-traces Test1 event trace: 3667: 6840.016:Message type:3 Data=0123456789 3669: 6841.016:Message type:4 Data=0123456789 3671: 6842.016:Message type:5 Data=0123456789 3673: 6843.016:Message type:6 Data=0123456789 Test2 event trace: 3668: 6840.016:Message type:3 Data=0123456789 3670: 6841.016:Message type:4 Data=0123456789 3672: 6842.016:Message type:5 Data=0123456789 3674: 6843.016:Message type:6 Data=0123456789 SPA Component Example The following is sample output from the show monitor event-trace component latest command for the spa component: Router# show monitor event-trace spa latest 00:01:15.364: subslot 2/3: 4xOC3 POS SPA, TSM Event:inserted New state:wait_psm _ready spa type 0x440 00:02:02.308: subslot 2/0: not present, TSM Event:empty New state:remove spa type 0x0, fail code 0x0(none) 00:02:02.308: subslot 2/0: not present, TSM Event:remove_complete New state:idle 00:02:02.308: subslot 2/1: not present, TSM Event:empty New state:remove spa type 0x0, fail code 0x0(none) 00:02:02.308: subslot 2/1: not present, TSM Event:remove_complete New state:idle 00:02:02.308: subslot 2/2: not present, TSM Event:empty New state:remove spa type 0x0, fail code 0x0(none) 00:02:02.308: subslot 2/2: not present, TSM Event:remove_complete New state:idle 00:02:02.312: subslot 2/3: not present(plugin 4xOC3 POS SPA), TSM Event:empty New state:remove spa type 0x0, fail code 0x0(none) 00:02:02.312: subslot 2/3: not present, TSM Event:remove_complete New state:idle Cisco Express Forwarding Component Examples If you select Cisco Express Forwarding as the component for which to display event messages, you can use the following additional arguments and keywords: show monitor event-trace cef [events | interface | ipv6 | ipv4][all]. The following example shows the IPv6 or IPv4 events related to the Cisco Express Forwarding component. Each trace message is numbered and is followed by a time stamp (derived from the device uptime). Following the time stamp is the component-specific message data. Router# show monitor event-trace cef ipv6 all 00:00:24.612: [Default] *::*/*'00 New FIB table [OK] Router# show monitor event-trace cef ipv4 all show monitor event-trace CF-826 Cisco IOS Configuration Fundamentals Command Reference April 2010 00:00:24.244: [Default] 127.0.0.81/32'01 FIB insert [OK] In the following example, all event trace messages for the Cisco Express Forwarding component are displayed: Router# show monitor event-trace cef events all 00:00:18.884: SubSys fib_ios_chain init 00:00:18.884: Inst unknown -> RP 00:00:24.584: SubSys fib init 00:00:24.592: SubSys fib_ios init 00:00:24.592: SubSys fib_ios_if init 00:00:24.596: SubSys ipv4fib init 00:00:24.608: SubSys ipv4fib_ios init 00:00:24.612: SubSys ipv6fib_ios init 00:00:24.620: Flag IPv4 CEF enabled set to yes 00:00:24.620: Flag 0x7BF6B62C set to yes 00:00:24.620: Flag IPv4 CEF switching enabled set to yes 00:00:24.624: GState CEF enabled 00:00:24.628: SubSys ipv4fib_les init 00:00:24.628: SubSys ipv4fib_pas init 00:00:24.632: SubSys ipv4fib_util init 00:00:25.304: Process Background created 00:00:25.304: Flag IPv4 CEF running set to yes 00:00:25.304: Process Background event loop enter 00:00:25.308: Flag IPv4 CEF switching running set to yes The following example shows Cisco Express Forwarding interface events: Router# show monitor event-trace cef interface all 00:00:24.624: (sw 4) Create new 00:00:24.624: (sw 4) SWIDBLnk FastEthernet0/0(4) 00:00:24.624: Fa0/0 (sw 4) NameSet 00:00:24.624: (hw 1) Create new 00:00:24.624: (hw 1) HWIDBLnk FastEthernet0/0(1) 00:00:24.624: Fa0/0 (hw 1) NameSet 00:00:24.624: (sw 3) Create new 00:00:24.624: (sw 3) SWIDBLnk FastEthernet0/1(3) 00:00:24.624: Fa0/1 (sw 3) NameSet 00:00:24.624: (hw 2) Create new Cisco Express Forwarding Component Examples for Cisco 10000 Series Routers Only The following example shows the IPv4 events related to the Cisco Express Forwarding component. Each trace message is numbered and is followed by a time stamp (derived from the device uptime). Following the time stamp is the component-specific message data. Router# show monitor event-trace cef ipv4 all 00:00:48.244: [Default] 127.0.0.81/32'01 FIB insert [OK] In the following example, all event trace message for the Cisco Express Forwarding component are displayed: Router# show monitor event-trace cef events all 00:00:18.884: SubSys fib_ios_chain init 00:00:18.884: Inst unknown -> RP 00:00:24.584: SubSys fib init 00:00:24.592: SubSys fib_ios init 00:00:24.592: SubSys fib_ios_if init 00:00:24.596: SubSys ipv4fib init 00:00:24.608: SubSys ipv4fib_ios init show monitor event-trace CF-827 Cisco IOS Configuration Fundamentals Command Reference April 2010 00:00:24.620: Flag IPv4 CEF enabled set to yes 00:00:24.620: Flag 0x7BF6B62C set to yes 00:00:24.620: Flag IPv4 CEF switching enabled set to yes 00:00:24.624: GState CEF enabled 00:00:24.628: SubSys ipv4fib_les init 00:00:24.628: SubSys ipv4fib_pas init 00:00:24.632: SubSys ipv4fib_util init 00:00:25.304: Process Background created 00:00:25.304: Flag IPv4 CEF running set to yes 00:00:25.304: Process Background event loop enter 00:00:25.308: Flag IPv4 CEF switching running set to yes The following examples show Cisco Express Forwarding interface events: Router# show monitor event-trace cef interface all 00:00:24.624: (sw 4) Create new 00:00:24.624: (sw 4) SWIDBLnk FastEthernet1/0/0(4) 00:00:24.624: Fa0/0 (sw 4) NameSet 00:00:24.624: (hw 1) Create new 00:00:24.624: (hw 1) HWIDBLnk FastEthernet1/0/0(1) 00:00:24.624: Fa0/0 (hw 1) NameSet 00:00:24.624: (sw 3) Create new 00:00:24.624: (sw 3) SWIDBLnk FastEthernet1/1/0(3) 00:00:24.624: Fa0/1 (sw 3) NameSet 00:00:24.624: (hw 2) Create new CFD Component for Cisco IOS Release 12.4(9)T To troubleshoot errors in an encryption datapath, enter the show monitor event-trace cfd all command. In this example, events are shown separately, each beginning with a time stamp, followed by data from the error trace buffer. Cisco Technical Assistence Center (TAC) engineers can use this information to diagnose the cause of the errors. Note If no packets have been dropped, this command does not display any output. Router# show monitor event-trace cfd all 00:00:42.452: 450000B4 00060000 FF33B306 02020203 02020204 32040000 F672999C 00000001 7A7690C2 A0A4F8BC E732985C D6FFDCC8 00000001 C0902BD0 A99127AE 8EAA22D4 00:00:44.452: 450000B4 00070000 FF33B305 02020203 02020204 32040000 F672999C 00000002 93C01218 2325B697 3C384CF1 D6FFDCC8 00000002 BFA13E8A D21053ED 0F62AB0E 00:00:46.452: 450000B4 00080000 FF33B304 02020203 02020204 32040000 F672999C 00000003 7D2E11B7 A0BA4110 CC62F91E D6FFDCC8 00000003 7236B930 3240CA8C 9EBB44FF 00:00:48.452: 450000B4 00090000 FF33B303 02020203 02020204 32040000 F672999C 00000004 FB6C80D9 1AADF938 CDE57ABA D6FFDCC8 00000004 E10D8028 6BBD748F 87F5E253 00:00:50.452: 450000B4 000A0000 FF33B302 02020203 02020204 32040000 F672999C 00000005 697C8D9D 35A8799A 2A67E97B D6FFDCC8 00000005 BC21669D 98B29FFF F32670F6 00:00:52.452: 450000B4 000B0000 FF33B301 02020203 02020204 32040000 F672999C show monitor event-trace CF-828 Cisco IOS Configuration Fundamentals Command Reference April 2010 00000006 CA18CBC4 0F387FE0 9095C27C D6FFDCC8 00000006 87A54811 AE3A0517 F8AC4E64 Related Commands Command Description monitor event-trace (EXEC) Controls event trace functions for a specified Cisco IOS software subsystem component. monitor event-trace (global) Configures event tracing for a specified Cisco IOS software subsystem component. monitor event-trace dump-traces Saves trace messages for all event traces currently enabled on the networking device. CF-829 Cisco IOS Configuration Fundamentals Command Reference April 2010 show monitor permit-list CF-830 Cisco IOS Configuration Fundamentals Command Reference April 2010 show monitor permit-list To display the permit-list state and interfaces configured, use the show monitor permit-list command in user EXEC or privileged EXEC mode. show monitor permit-list Syntax Description This command has no arguments or keywords. Defaults This command has no default settings. Command Modes User EXEC Privileged EXEC Command History Examples This example shows how to display the permit-list state and interfaces configured: Router# show monitor permit-list SPAN Permit-list :Admin Enabled Permit-list ports :Gi5/1-4,Gi6/1 Router(config)# Related Commands Release Modification 12.2(18)SXE Support for this command was introduced on the Supervisor Engine 720. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description monitor permit-list Configures a destination port permit list or adds to an existing destination port permit list. show monitor session CF-831 Cisco IOS Configuration Fundamentals Command Reference April 2010 show monitor session To display information about the ERSPAN, SPAN and RSPAN sessions, use the show monitor session command in user EXEC mode. show monitor session [range session-range | local | remote | all | session] show monitor session [erspan-destination | erspan-source | egress replication-mode capability| detail] Syntax Description Defaults This command has no default settings. Command Modes User EXEC (>) Command History range session-range (Optional) Displays a range of sessions; valid values are from 1 to 66. local (Optional) Displays only local SPAN sessions. remote (Optional) Displays both RSPAN source and destination sessions. all (Optional) Displays all sessions. session (Optional) Number of the session; valid values are from 1 to 66. erspan-destination (Optional) Displays information about the destination ERSPAN sessions only. This keyword is not supported on the Supervisor Engine 2. erspan-source (Optional) Displays information about the source ERSPAN sessions only. This keyword is not supported on the Supervisor Engine 2. egress replication-mode capability (Optional) Displays the operational mode and configured mode of the session and module session capabilities. detail (Optional) Displays detailed session information. Release Modification 12.2(14)SX This command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support was added for the Supervisor Engine 2. 12.2(18)SXE Support was added for the erspan-destination and erspan-source keywords on the Supervisor Engine 720 only. 12.2(18)SXF This command was updated as follows: • Support was added for the Supervisor Engine 32. • ERSPAN is supported in any switch fabric module functionality switching mode. 12.2(33)SXH The egress replication-mode capability keywords were added. show monitor session CF-832 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines The erspan-destination and erspan-source keywords are not supported on Catalyst 6500 series switches that are configured with a Supervisor Engine 2. In releases prior to Release 12.2(18)SXF, ERSPAN is supported on Catalyst 6500 series switches that are operating in compact switch fabric module functionality switching mode only. Release 12.2(18)SXF and later releases support ERSPAN in any switch fabric module functionality switching mode. If the switch fabric module functionality switching mode is set to compact, the output of the show commands display “dcef mode” for fabric-enabled modules with DFC3 installed and display “fabric mode” for other fabric-enabled modules. If the switch fabric module functionality switching mode is set to truncated, the output of the show commands display “fabric mode” for all fabric-enabled modules. When entering a range of sessions, use a dash (-) to specify a range and separate multiple entries with a comma (,). Do not enter spaces before or after the comma or the dash. You can enter multiple ranges by separating the ranges with a comma. If you enter the show monitor session command without specifying a session, the information for all sessions is displayed. Examples This example shows how to display the saved version of the monitor configuration for a specific session: Router# show monitor session 2 Session 2 ------------ Type : Remote Source Session Source Ports: RX Only: Fa1/1-3 Dest RSPAN VLAN: 901 Router# This example shows how to display the detailed information from a saved version of the monitor configuration for a specific session: Router# show monitor session 2 detail Session 2 ------------ Type : Remote Source Session Source Ports: RX Only: Fa1/1-3 TX Only: None Both: None Source VLANs: RX Only: None TX Only: None Both: None Source RSPAN VLAN: None Destination Ports: None Filter VLANs: None Dest RSPAN VLAN: 901 Router# This example shows how to display information about the egress replication mode only: Router# show monitor session egress replication-mode capability No SPAN configuration is present in the system. show monitor session CF-833 Cisco IOS Configuration Fundamentals Command Reference April 2010 ------------------------------------------------------- Global Egress SPAN Replication Mode Capability: Slot Egress Replication Capability No LSPAN RSPAN ERSPAN ------------------------------------------------------- 3 Distributed Distributed Distributed 5 Distributed Distributed Distributed Router# This example shows how to display information about the destination ERSPAN sessions only: Router# show monitor session erspan-destination Session 2 --------- Type : ERSPAN Destination Session Status : Admin Disabled Router# This example shows how to display detailed information about the destination ERSPAN sessions only: Router# show monitor session erspan-destination detail Session 2 --------- Type : ERSPAN Destination Session Status : Admin Disabled Description : - Source Ports : RX Only : None TX Only : None Both : None Source VLANs : RX Only : None TX Only : None Both : None Source RSPAN VLAN : None Destination Ports : None Filter VLANs : None Destination RSPAN VLAN : None Source IP Address : None Source IP VRF : None Source ERSPAN ID : None Destination IP Address : None Destination IP VRF : None Destination ERSPAN ID : None Origin IP Address : None IP QOS PREC : 0 IP TTL : 255 Router# This example shows how to display information about the source ERSPAN sessions only: Router# show monitor session erspan-source Session 1 --------- Type : ERSPAN Source Session Status : Admin Disabled Session 3 --------- Type : ERSPAN Source Session Status : Admin Disabled Router# show monitor session CF-834 Cisco IOS Configuration Fundamentals Command Reference April 2010 This example shows how to display detailed information about the source ERSPAN sessions only: Router# show monitor session erspan-source detail Session 1 --------- Type : ERSPAN Source Session Status : Admin Disabled Description : - Source Ports : RX Only : None TX Only : None Both : None Source VLANs : RX Only : None TX Only : None Both : None Source RSPAN VLAN : None Destination Ports : None Filter VLANs : None Destination RSPAN VLAN : None Source IP Address : None Source IP VRF : None Source ERSPAN ID : None Destination IP Address : None Destination IP VRF : None Destination ERSPAN ID : None Origin IP Address : None IP QOS PREC : 0 IP TTL : 255 Session 3 --------- Type : ERSPAN Source Session Status : Admin Disabled Description : - Source Ports : RX Only : None TX Only : None Both : None Source VLANs : RX Only : None TX Only : None Both : None Source RSPAN VLAN : None Destination Ports : None Filter VLANs : None Destination RSPAN VLAN : None Source IP Address : None Source IP VRF : None Source ERSPAN ID : None Destination IP Address : None Destination IP VRF : None Destination ERSPAN ID : None Origin IP Address : None IP QOS PREC : 0 IP TTL : 255 Router# This example shows how to display the operational mode and configured mode of the session and module session capabilities: Router# show monitor session egress replication-mode capability Session 65 Type Local Session ----------------------------------------------- show monitor session CF-835 Cisco IOS Configuration Fundamentals Command Reference April 2010 Operational mode of egress span replication : Centralized Configured mode of egress span replication : Distributed/Default Slot Egress Replication Capability ----------------------------------------------- 1 Centralized 3 Centralized 5 Centralized Router# Related Commands Command Description monitor session Starts a new ERSPAN, SPAN, or RSPAN session, adds or deletes interfaces or VLANs to or from an existing session, filters ERSPAN, SPAN, or RSPAN traffic to specific VLANs, or deletes a session. monitor session type Creates an ERSPAN source session number or enters the ERSPAN session configuration mode for the session. remote-span Configures a VLAN as an RSPAN VLAN. show msfc CF-836 Cisco IOS Configuration Fundamentals Command Reference April 2010 show msfc To display Multilayer Switching Feature Card (MSFC) information, use the show msfc command in user EXEC or privileged EXEC mode. show msfc {buffers | eeprom | fault | netint | tlb} Syntax Description Defaults This command has no default settings. Command Modes User EXEC Privileged EXEC Command History Examples These examples display the show msfc command output: Router# show msfc buffers Reg. set Min Max TX 640 ABQ 640 16384 0 0 40 1 6715 8192 2 0 0 3 0 0 4 0 0 5 0 0 6 0 0 7 0 0 Threshold = 8192 Vlan Sel Min Max Cnt Rsvd 1016 1 6715 8192 0 0 Router# Router# show msfc eeprom buffers Displays buffer-allocation information. eeprom Displays the internal information. fault Displays fault information. netint Displays network-interrupt information. tlb Displays information about the TLB registers. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show msfc CF-837 Cisco IOS Configuration Fundamentals Command Reference April 2010 RSFC CPU IDPROM: IDPROM image: (FRU is 'Cat6k MSFC 2 daughterboard') IDPROM image block #0: hexadecimal contents of block: 00: AB AB 01 90 13 22 01 00 00 02 60 03 00 EA 43 69 ....."....`...Ci 10: 73 63 6F 20 53 79 73 74 65 6D 73 00 00 00 00 00 sco Systems..... 20: 00 00 57 53 2D 46 36 4B 2D 4D 53 46 43 32 00 00 ..WS-F6K-MSFC2.. 30: 00 00 00 00 00 00 53 41 44 30 36 32 31 30 30 36 ......SAD0621006 40: 37 00 00 00 00 00 00 00 00 00 37 33 2D 37 32 33 7.........73-723 50: 37 2D 30 33 00 00 00 00 00 00 41 30 00 00 00 00 7-03......A0.... 60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 70: 00 00 00 02 00 03 00 00 00 00 00 09 00 05 00 01 ................ 80: 00 03 00 01 00 01 00 02 00 EA FF DF 00 00 00 00 ................ block-signature = 0xABAB, block-version = 1, block-length = 144, block-checksum = 4898 *** common-block *** IDPROM capacity (bytes) = 256 IDPROM block-count = 2 FRU type = (0x6003,234) OEM String = 'Cisco Systems' Product Number = 'WS-F6K-MSFC2' Serial Number = 'SAD06210067' Manufacturing Assembly Number = '73-7237-03' Manufacturing Assembly Revision = 'A0' Hardware Revision = 2.3 Manufacturing bits = 0x0 Engineering bits = 0x0 SNMP OID = 9.5.1.3.1.1.2.234 Power Consumption = -33 centiamperes RMA failure code = 0-0-0-0 *** end of common block *** IDPROM image block #1: hexadecimal contents of block: 00: 60 03 01 62 0A C2 00 00 00 00 00 00 00 00 00 00 `..b............ 10: 00 00 00 00 00 01 00 23 00 08 7C A4 CE 80 00 40 .......#..|....@ 20: 01 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 ................ 30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 40: 14 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 50: 10 00 4B 3C 41 32 80 80 80 80 80 80 80 80 80 80 ..K) Privileged EXEC (#) Command History Usage Guidelines This command was developed to allow the exploration of the CLI command syntax without requiring the user to actually enter a specific mode and use the ? command-line help. command-mode A keyword indicating the command mode. The output will include the syntax for commands only in the specified command mode. The list of command mode keywords will vary depending on your software image. Use the show parser dump ? command to display the list of command mode keyword options. For further assistance in determining the proper command mode, see the “Cisco IOS Command Modes” Release 12.2 document, available on Cisco.com. all Indicates that all commands in all modes should be displayed in the output. Caution This keyword generates a very large amount of output, which may exceed your system or buffer memory. privilege-level level (Optional) Lists CLI commands only with the privilege level specified in the level argument. extend (Optional) Enables the extended display mode. The extended parser display shows the keyword and argument descriptions typically shown with the command-line help (? command). Note This keyword can produce a large amount of output. breakage (Optional) Enables detection of potential parser chain syntax breakage. This keyword is intended for internal use. Release Modification 12.2(4)T This command was introduced. 12.2(13)T This command was enhanced to resolve certain execution errors. 12.0(23)S This command was enhanced to resolve certain execution errors. 15.0(1)M This command was removed. show parser dump CF-843 Cisco IOS Configuration Fundamentals Command Reference April 2010 Caution Use caution when entering this command with the all keyword. A large amount of output can be generated by this command, which may easily exceed buffer or system memory on smaller platforms. Also, some configuration modes have hundreds of valid commands. For large dumps, use of the redirection to a file using the | redirect URL syntax at the end of the command is highly recommended. (See the documentation for the show command redirect command for more information on using this command extension.) Output for this command will show the syntax options for all commands available in the specified mode. The number preceding the command shows the privilege level associated with that command. For example, the line 15 type dhcp indicates that the type dhcp command has a privilege level of 15 assigned to it. For information about privilege levels, see the “Configuring Passwords and Privileges” chapter in the Cisco IOS Security Configuration Guide. Any given command-line string should indicate the full syntax needed to make the command complete and valid. In other words, the command-line string ends where the carriage return (Enter) could be entered, as indicated in command-line help by the syntax. You will typically see multiple forms of a command, each showing a valid syntax combination. For example, each of the following syntax combinations, as seen in the output of the show parser dump rtr | include dhcp command, is a valid command: type dhcp dest-ipaddr

source-ipaddr

option <82-82> circuit-id type dhcp dest-ipaddr

source-ipaddr

option <82-82> remote-id type dhcp dest-ipaddr

source-ipaddr

option <82-82> subnet-mask type dhcp dest-ipaddr

source-ipaddr

option <82-82> type dhcp dest-ipaddr

source-ipaddr

type dhcp dest-ipaddr

type dhcp Use of the show command extensions | begin, | include, and | exclude is recommended for this command because these extensions allow you to filter the output to display only the commands you are interested in. The redirection extensions | redirect, | append, and | tee allow you to redirect the output of this command to local or remote storage as a file. As with most show commands, you can typically exit from the --More-- prompt back to EXEC mode using Ctrl-Z. For some connections, Ctrl-Shift-6 (Ctrl^) or Ctrl-Shift-6-X should be used instead. Examples The following example shows a typical list of command mode keywords. The fields are self-explanatory. Router# show parser dump ? aaa-attr-list AAA attribute list config mode aaa-user AAA user definition accept-dialin VPDN group accept dialin configuration mode accept-dialout VPDN group accept dialout configuration mode acct_mlist AAA accounting methodlist definitions address-family Address Family configuration mode aic Alarm Interface Card configuration mode all For all modes alps-ascu ALPS ASCU configuration mode show parser dump CF-844 Cisco IOS Configuration Fundamentals Command Reference April 2010 alps-circuit ALPS circuit configuration mode appfw-application-aim Appfw for AIM Configuration Mode appfw-application-msnmsgr Appfw for MSN Messenger Configuration Mode appfw-application-ymsgr Appfw for Yahoo! Messenger Configuration Mode appfw-policy Application FW Policy Configuration Mode application-http Appfw for HTTP Configuration Mode archive Archive the router configuration mode atalk-test Appletalk test mode atm-bm-config ATM bundle member configuration mode atm-bundle-config ATM bundle configuration mode atm-l2trans-pvc-config ATM L2transport PVC configuration mode atm-l2trans-pvp-config ATM L2transport PVP configuration mode atm-pvc-range-config ATM PVC Range configuration mode atm-range-pvc-config ATM PVC in Range configuration mode atm-svc-bm-config ATM SVC bundle member configuration mode atm-svc-bundle-config ATM SVC bundle configuration mode atm-vc-config ATM virtual circuit configuration mode atmsig_e164_table_mode ATMSIG E164 Table auto-ip-sla-mpls Auto IP SLA MPLS LSP Monitor configs auto-ip-sla-mpls-lpd-params Auto IP SLA MPLS LPD params configs auto-ip-sla-mpls-params Auto IP SLA MPLS LSP Monitor Params configs banner Banner Input mode bba-group BBA Group configuration mode boomerang Boomerang configuration mode bsm-cfg BSM config definition bulkstat-objlist Bulk-stat Object list configuration mode bulkstat-schemadef Bulk-stat schema configuration mode bulkstat-transfer Bulk Stat configuration mode cascustom Cas custom configuration mode call-filter-matchlist Call Filter matchlist configuration mode call-home call-home config mode call-home-profile call-home profile config mode call-router AnnexG configuration mode cascustom Cas custom configuration mode cause-code-list Voice Cause Code List configuration mode cfg-path IP Host backup configuration mode cfg-pt-ruleset Protocol Translation ruleset configuration mode cip-vadp Virtual Adapter configuration mode cip-vlan Virtual Lan configuration mode clid-group CLID group configuration mode cm-ac AC-AC connect configuration mode cm-fallback cm-fallback configuration mode cns-connect-intf-config CNS Connect Intf Info Mode cns-connect-config CNS Connect Info Mode cns-tmpl-connect-config CNS Template Connect Info Mode cns_inventory_submode CNS Inventory SubMode codec-profile Codec Profile configuration mode conf-dia-attr-list Diameter attribute list config mode conf-dia-peer Diameter peer config mode conf-dia-sg Diameter peer group config mode config-ip-sla-http-rr IP SLAs HTTP raw request Configuration config-l2tp-class l2tp-class configuration mode config-tgrep TRIP-Lite configuration mode config-rtr-http-rr RTR HTTP raw request Configuration config-x25-huntgroup X.25 hunt group configuration mode config_app_global Configure global settings config_app_map Configure application mapping config_app_monitor Configure application monitoring config_app_session Define script processes config_voice Define application services, modules, groups config_voice_app Define application parameters configure Global configuration mode congestion Frame Relay congestion configuration mode control-plane Control Plane configuration mode show parser dump CF-845 Cisco IOS Configuration Fundamentals Command Reference April 2010 control-plane-cef-exception-mode Control Plane cef-exception configuration mode control-plane-host-mode Control Plane host configuration mode control-plane-transit-mode Control Plane transit configuration mode controller Controller configuration mode cpf-classmap Class-map configuration mode cpf-policyclass Class-in-Policy configuration mode cpf-policymap Policy-map configuration mode cpu config-owner-cpu crypto-ca-cert-chain Crypto certificate entry mode crypto-ca-cert-comm Certificate query mode crypto-ca-cert-map Certificate map entry mode crypto-ca-profile-enroll Certificate enrollment profile entry mode crypto-ca-root Certificate authority trusted root entry mode crypto-ca-trustpoint Certificate authority trustpoint entry mode crypto-cs-server Certificate Server entry mode crypto-gdoi-group Crypto GDOI group policy config mode crypto-identity Crypto identity config mode crypto-ikmp Crypto ISAKMP config mode crypto-ikmp-browser-proxy Crypto ISAKMP browser proxy config mode crypto-ikmp-client-fw Crypto ISAKMP client firewall policy config mode crypto-ikmp-group Crypto ISAKMP group policy config mode crypto-ikmp-peer Crypto ISAKMP peer policy configuration mode crypto-ipsec-profile IPSec policy profile mode crypto-keyring Crypto Keyring command mode crypto-map Crypto map config mode crypto-map-fail-close Crypto map fail close mode crypto-pubkey Crypto subsystem public key entry mode crypto-transform Crypto transform config mode crypto-tti-petitioner TTI Petitioner entry mode crypto-tti-registrar TTI Registrar entry mode decnet-map DECnet map configuration mode dfp-submode DFP config mode dhcp DHCP pool configuration mode dhcp-class DHCP class configuration mode dhcp-pool-class Per DHCP pool class configuration mode dhcp-relay-info DHCP class relay agent info configuration mode dhcp-subnet-secondary Per DHCP secondary subnet configuration mode dnis-group DNIS group configuration mode dns-view DNS View configuration mode dns-view-list DNS View-list configuration mode dns-view-list-member DNS View-list member configuration mode dspfarm DSP farm configuration mode dspfarmprofile Profile configuration mode dynupd-http Dynamic DNS update HTTP configuration mode dynupd-method Dynamic DNS update method configuration mode emergency-response-location voice emergency response location configuration mode emergency-response-settings voice emergency response settings configuration mode emergency-response-zone voice emergency response zone configuration mode enum_rule enum configuration mode ephone ephone configuration mode ephone-dn ephone-dn configuration mode ephone-dn-template ephone-dn-template configuration mode ephone-hunt ephone-hunt configuration mode ephone-template ephone-template configuration mode ephone-type ephone-type configuration mode ether_cfm Ethernet CFM configuration mode event Event MIB event configuration mode event-action-notification Event MIB event action notification configuration mode event-action-set Event MIB event action set configuration mode event-objlist Event MIB object list configuration mode event-trigger Event MIB event trigger configuration mode event-trigger-boolean Event MIB event trigger boolean configuration mode event-trigger-existence Event MIB event trigger existence configuration mode event-trigger-object-id Event MIB trigger object id configuration mode show parser dump CF-846 Cisco IOS Configuration Fundamentals Command Reference April 2010 event-trigger-threshold Event MIB event trigger threshold configuration mode exec Exec mode expr-expression Expression configuration mode expr-object Expression Object configuration mode extcomm-list IP Extended community-list configuration mode fh_applet FH Applet Entry Configuration fh_applet_trigger FH Applet Trigger Configuration filter Output filter mode filterserver AAA filter server definitions flow-cache Flow aggregation cache config mode flow-sampler-map Flow sampler map config mode flowexp Flow Exporter configuration mode flowmon Flow Monitor configuration mode flowrec Flow Record configuration mode fr-fr FR/FR connection configuration mode fr-pw FR/PW connection configuration mode fr-vcb-bmode FR VC Bundle mode fr-vcb-mmode FR VC Bundle Member mode frf5 FR/ATM Network IWF configuration mode frf8 FR/ATM Service IWF configuration mode funi-vc-config FUNI virtual circuit configuration mode gatekeeper Gatekeeper config mode gateway Gateway configuration mode gdoi-coop-ks-config Crypto GDOI server redundancy config mode gdoi-local-server Crypto GDOI local server policy config mode gdoi-sa-ipsec Crypto GDOI local server IPsec SA policy config mode gg_fcpa-config FC tunnel configuration mode gk_altgk_cluster GK Commands for Cluster defn gk_be_annexg GK Commands for H.323 AnnexG configuration gk_srv_trigger_arq GK Server ARQ Trigger config mode gk_srv_trigger_brq GK Server BRQ Trigger config mode gk_srv_trigger_drq GK Server DRQ Trigger config mode gk_srv_trigger_irr GK Server IRR Trigger config mode gk_srv_trigger_lcf GK Server LCF Trigger config mode gk_srv_trigger_lrj GK Server LRJ Trigger config mode gk_srv_trigger_lrq GK Server LRQ Trigger config mode gk_srv_trigger_rai GK Server RAI Trigger config mode gk_srv_trigger_rrq GK Server RRQ Trigger config mode gk_srv_trigger_urq GK Server URQ Trigger config mode gw Webvpn virtual gateway configuration gw-accounting-aaa Gateway accounting aaa configuration mode gw-accounting-file Gateway accounting file configuration mode hostlist Host list configuration mode identity-policy-mode identity policy configuration mode identity-profile-mode identity profile configuration mode interface Interface configuration mode interface range Interface range configuration mode interface-dlci Frame Relay dlci configuration mode ip-explicit-path IP explicit path configuration mode ip-sla IP SLAs entry configuration ip-sla-am-grp IP SLAs auto group config ip-sla-am-grp-auto IP SLAs auto group dest-auto config ip-sla-am-schedule IP SLAs auto schedule config ip-sla-dhcp IP SLAs dhcp configuration ip-sla-dns IP SLAs dns configuration ip-sla-echo IP SLAs echo configuration ip-sla-ethernet-echo IP SLAs Ethernet Echo configuration ip-sla-ethernet-jitter IP SLAs Ethernet Jitter configuration ip-sla-ethernet-monitor IP SLAs Ethernet configs ip-sla-ethernet-monitor-params IP SLAs Ethernet Params configs ip-sla-frameRelay IP SLAs FrameRelay configuration ip-sla-ftp IP SLAs ftp configuration ip-sla-http IP SLAs http configuration ip-sla-icmp-ech-params IP SLAs icmpEcho Parameters show parser dump CF-847 Cisco IOS Configuration Fundamentals Command Reference April 2010 ip-sla-icmp-jtr-params IP SLAs icmpJitter Parameters ip-sla-icmpjitter IP SLAs icmpjitter configuration ip-sla-jitter IP SLAs jitter configuration ip-sla-pathEcho IP SLAs pathEcho configuration ip-sla-pathJitter IP SLAs pathJitter configuration ip-sla-tcp-conn-params IP SLAs tcpConnect Parameters ip-sla-tcpConnect IP SLAs tcpConnect configuration ip-sla-tplt-dest IP SLAs auto destination submode ip-sla-tplt-icmp-ech IP SLAs auto template icmpEcho ip-sla-tplt-icmp-jtr IP SLAs auto template icmpJitter ip-sla-tplt-tcp-conn IP SLAs auto template tcpConnect ip-sla-tplt-udp-ech IP SLAs auto template udpEcho ip-sla-tplt-udp-jtr IP SLAs auto template udpJitter ip-sla-udp-ech-params IP SLAs udpEcho Parameters ip-sla-udp-jtr-params IP SLAs udpJitter Parameters ip-sla-udpEcho IP SLAs udpEcho configuration ip-sla-voip IP SLA voip configuration ip-sla-voip-rtp IP SLAs rtp configuration ip-vrf Configure IP VRF parameters ipc-zone-assoc-protocol-sctp ipc protocol sctp mode ipczone IPC Zone config mode ipczone-assoc IPC Association config mode ipenacl IP named extended access-list configuration mode iphc-profile-mode IPHC Profile configuration mode ipmobile-test IP Mobility test mode ipnat-pool IP NAT pool configuration mode ipnat-portmap IP NAT portmap configuration mode ipnat-sbc IP NAT SIP-SBC config mode ipnat-sbc-vrf IP NAT SIP-SBC vrf config mode ipnat-snat IP SNAT configuration mode ipnat-snat-backup IP SNAT Backup configuration mode ipnat-snat-primary IP SNAT Primary configuration mode ipnat-snat-redundancy IP SNAT Redundancy configuration mode ips-seap-rules IPS event action rules configuration mode ips-sigdef-sig IPS signature number name configuration mode ipscataction IPS Category name configuration mode ipsnacl IP named simple access-list configuration mode ipssigau IPS Auto Update configuration mode ipssigcat IPS signature category configuration mode ipssigdef-action IPS Signature actions configuration mode ipssigdef-engine IPS signature def Engine configuration mode ipssigdef-status IPS signature def Status mode ipv6-mobile-router MIPv6 router configuration mode ipv6-router IPv6 router configuration mode ipv6acl IPv6 access-list configuration mode ipv6dhcp IPv6 DHCP configuration mode ipv6dhcpvs IPv6 DHCP Vendor-specific configuration mode ipx-router IPX router configuration mode ipxenacl IPX named extended access-list configuration mode ipxsapnacl IPX named SAP access-list configuration mode ipxsnacl IPX named standard access-list configuration mode ipxsumnacl IPX named Summary access-list configuration mode isakmp-profile Crypto ISAKMP profile command mode iua-cfg ISDN user adaptation layer configuration key-chain Key-chain configuration mode key-chain-key Key-chain key configuration mode kron-occurrence Kron Occurrence SubMode kron-policy Kron Policy SubMode l2 vfi configuration mode line Line configuration mode lw-vlan-id VLAN-id configuration mode lw-vlan-range VLAN-range configuration mode local-prof Local profile configuration mode log_config Log configuration changes made via the CLI show parser dump CF-848 Cisco IOS Configuration Fundamentals Command Reference April 2010 lsp-attribute-list LSP attribute list configuration mode map-class Map class configuration mode map-list Map list configuration mode memory config-owner-memory mgcpprofile MGCP Profile configuration mode mipv6-config-ha Mobile IPv6 HA mode mipv6-config-ha-host Mobile IPv6 Home Agent Host config mode mobile-map Mobile Map mode mobile-networks Mobile Networks mode mobile-router Mobile Router mode mplsmfistaticifrewrite MPLS MFI static if rewrite configuration mode mplsmfistaticrewrite MPLS MFI static rewrite configuration mode mripv6-config-ha-host Mobile IPv6 Home Agent Host config mode mrm-manager IP Multicast Routing Monitor config mode neighbor Neighbor configuration mode network-object-group ACL Object Group configuration null-interface Null interface configuration mode null-interface Null interface configuration mode nxg-service-relationship Service Relationship configuration mode nxg-usage-indication Usage Indication configuration mode oam LSP Verification configuration mode oer_br OER border router configuration submode oer_mc OER master controller configuration submode oer_mc_api_provider OER MC API Provider configuration submode oer_mc_br OER managed border router configuration submode oer_mc_br_if OER Border Exit configuration submode oer_mc_learn OER Top Talker and Delay learning configuration submode oer_mc_learn_list OER learn list configuration submode oer_mc_map oer-map config mode parameter_map_cfg parameter-map configuration mode policy-list IP Policy List configuration mode preauth AAA Preauth definitions profile Subscriber profile configuration mode pseudowire-class Pseudowire-class configuration mode public-key-chain Crypto public key identification mode public-key-chain-key Crypto public key entry mode public-key-chain-key-ring Crypto public key entry mode qosclassmap QoS Class Map configuration mode qosclasspolice QoS Class Police configuration mode qospolicymap QoS Policy Map configuration mode qospolicymapclass QoS Policy Map class configuration mode radius-attrl Radius Attribute-List Definition radius-locsvr Radius Application configuration red-group random-detect group configuration mode redundancy redundancy config mode regex-translation-rule voip translation-rule configuration mode request-dialin VPDN group request dialin configuration mode request-dialout VPDN group request dialout configuration mode rf-mode-interdev-local ipc sctp local config mode rf-mode-interdev-remote ipc sctp remote config mode rf-mode-interdevice redundancy config mode rlm-group RLM Group configuration mode rlm-group-sc RLM server/client link configuration mode roles Role configuration mode route-map Route map config mode router Router configuration mode rsvp-local-if-policy RSVP local policy interface configuration mode rsvp-local-policy RSVP local policy configuration mode rsvp-local-subif-policy RSVP local policy sub-interface configuration mode rtr SAA entry configuration saa-dhcp SAA dhcp configuration saa-dns SAA dns configuration saa-echo SAA echo configuration saa-frameRelay SAA FrameRelay configuration show parser dump CF-849 Cisco IOS Configuration Fundamentals Command Reference April 2010 saa-ftp SAA ftp configuration saa-http SAA http configuration saa-jitter SAA jitter configuration saa-pathEcho SAA pathEcho configuration saa-pathJitter SAA pathJitter configuration saa-slm-ctrlr-if SAA SLM controller/interface configuration saa-slmFrIf SAA SLM FrameRelay Interface configuration saa-slmfr SAA SLM Frame Relay configuration saa-tcpConnect SAA tcpConnect configuration saa-udpEcho SAA udpEcho configuration sg-radius Radius Server-group Definition sampler Sampler configuration mode sccpccmgroup SCCP CCM group configuration mode sccpplar SCCP PLAR configuration mode sctp-export SCTP export configuration commands seczonecfg Security Zone Configuration Mode seczonepaircfg Security Zone Pair Configuration Mode sep-init-config WSMA Initiator profile Mode sep-listen-config WSMA Listener profile Mode service-object-group ACL Object Group configuration serviceflow Service Flow configuration mode sg-tacacs+ Tacacs+ Server-group Definition signaling-class Signaling class configuration mode sip-ua SIP UA configuration mode sla-lspPing IP SLAs lsp ping configuration sla-lspTrace IP SLAs lsp trace configuration slb-mode-dfp SLB DFP configuration mode slb-mode-real SLB real server configuration mode slb-mode-sfarm SLB server farm configuration mode slb-mode-vserver SLB virtual server configuration mode source-group Voice Source Group configuration mode srst-video cm-fallback video configuration mode sss-subscriber SSS subscriber configuration mode subinterface Subinterface configuration mode subscriber-policy Subscriber policy configuration mode tablemap Table Map configuration mode tcl Tcl mode tdm-conn TDM connection configuration mode telephony-service telephony-service configuration mode telephony-service-group Telephony service group configuration mode telephony-service-video Telephony service video configuration mode template Template configuration mode template peer-policy peer-policy configuration mode template peer-session peer-session configuration mode test_cpu config-owner-test_cpu test_mem config-owner-test_mem tidp-group TIDP Group configuration mode tidp-keyset TIDP key-set configuration mode tn3270s-dlur tn3270 server DLUR configuration mode tn3270s-dlur-pu tn3270 server DLUR PU configuration mode tn3270s-dlur-sap tn3270 server DLUR SAP configuration mode tn3270s-listen-point tn3270 server Listen-Point configuration mode tn3270s-listen-point-pu tn3270 server Listen-Point PU configuration mode tn3270s-pu tn3270 server PU configuration mode tn3270s-resp-time tn3270 server response time client group configuration mode tn3270s-security tn3270 server Security Configuration mode tn3270s-security-profile tn3270 server Security Profile Configuration mode tn3270s-svr tn3270 server configuration mode top-talkers Netflow top talkers config mode tracking-config Tracking configuration mode trange time-range configuration mode translation-profile Voice Translation Profile configuration mode translation-rule Translation Rule configuration mode trunk-group Trunk group configuration mode show parser dump CF-850 Cisco IOS Configuration Fundamentals Command Reference April 2010 vc-class VC class configuration mode vc-group VC group configuration mode view View configuration mode vlan VLAN database editing buffer vm-integration voicemail integration configuration mode voice-cause-code Voice Cause Code configuration mode voice-gateway voice gateway configuration mode voice-mlpp voice mlpp configuration mode voice-service Voice service configuration mode voice-service-h323 Voice service h323 configuration mode voice-service-session Voice service session configuration mode voice-service-sip Voice service sip configuration mode voice-service-stun Voice service stun configuration mode voice-uri-class Voice URI Class configuration mode voicecl-cptone Voice Class CPTone configuration mode voicecl-cptone-dt CPtone dualtone configuration mode voicecl-dt-detect Voice Class Dualtone Detect configuration mode voiceclass Voice Class configuration mode voicednismaps Dnis Map Configuration voiceport Voice configuration mode voipdialpeer Dial Peer configuration mode voipdpcor Dial Peer Class of Restriction configuration mode voipdpcorlist Dial Peer Class of Restriction List configuration mode vpdn-group VPDN group configuration mode vpdn-template VPDN template configuration mode vrf Configure VRF parameters webvpn Webvpn virtual context configuration webvpn-acl Webvpn ACL configuration webvpn-cifs-url Webvpn CIFS URL list configuration webvpn-group-policy Webvpn group policy configuration webvpn-nbnslist Webvpn VW ctxt NBNS list configuration webvpn-port-fwd Webvpn port-forward list configuration webvpn-sso-server SSO Server configuration webvpn-time-range Webvpn time range configuration webvpn-url Webvpn URL list configuration webvpn-url-rewrite Webvpn url-rewrite list configuration x25-profile X.25 profile configuration mode xconnect-conn-config Xconnect connect configuration submode xconnect-dlci-config Xconnect FR DLCI configuration submode xconnect-if-config Xconnect interface configuration submode xconnect-pvc-config Xconnect atm l2transport PVC configuration submode xconnect-pvp-config Xconnect atm l2transport PVP configuration submode xconnect-subif-config Xconnect sub-interface configuration submode xml-app XML Application configuration mode xml-transport XML Transport configuration mode In the following example, only commands in RTR configuration mode are shown: Router# show parser dump rtr Mode Name :rtr 15 type udpEcho dest-ipaddr

dest-port <1-65535> source-ipaddr

source-port <1-65535> control enable 15 type udpEcho dest-ipaddr

dest-port <1-65535> source-ipaddr

source-port <1-65535> control disable 15 type udpEcho dest-ipaddr

dest-port <1-65535> source-ipaddr

source-port <1-65535> 15 type udpEcho dest-ipaddr

dest-port <1-65535> source-ipaddr

15 type udpEcho dest-ipaddr

dest-port <1-65535> 15 type tcpConnect dest-ipaddr

dest-port <1-65535> source-ipaddr

source-port <1-65535> control enable 15 type tcpConnect dest-ipaddr

dest-port <1-65535> source-ipaddr

source-port <1-65535> control disable show parser dump CF-851 Cisco IOS Configuration Fundamentals Command Reference April 2010 15 type tcpConnect dest-ipaddr

dest-port <1-65535> source-ipaddr

source-port <1-65535> 15 type tcpConnect dest-ipaddr

dest-port <1-65535> source-ipaddr

15 type tcpConnect dest-ipaddr

dest-port <1-65535> 15 type jitter dest-ipaddr

dest-port <1-65535> source-ipaddr

15 type jitter dest-ipaddr

dest-port <1-65535> source-port <1-65535> 15 type jitter dest-ipaddr

dest-port <1-65535> control enable 15 type jitter dest-ipaddr

dest-port <1-65535> control disable 15 type jitter dest-ipaddr

dest-port <1-65535> num-packets <1-60000> 15 type jitter dest-ipaddr

dest-port <1-65535> interval <1-60000> 15 type jitter dest-ipaddr

dest-port <1-65535> 15 type echo protocol ipIcmpEcho

source-ipaddr

15 type echo protocol ipIcmpEcho

15 type ftp operation get url source-ipaddr

mode active 15 type ftp operation get url source-ipaddr

mode passive 15 type ftp operation get url source-ipaddr

15 type ftp operation get url 15 type http operation get url name-server

version source-ipaddr

source-port <1-65535> cache 15 type http operation get url name-server

version source-ipaddr

source-port <1-65535> cache 15 type http operation get url name-server

version source-ipaddr

source-port <1-65535> cache 15 type http operation get url name-server

version source-ipaddr

source-port <1-65535> 15 type http operation get url name-server

version source-ipaddr

15 type http operation get url name-server

version 15 type http operation get url name-server

15 type http operation get url 15 type http operation raw 15 type dhcp dest-ipaddr

source-ipaddr

option <82-82> circuit-id 15 type dhcp dest-ipaddr

source-ipaddr

option <82-82> remote-id 15 type dhcp dest-ipaddr

source-ipaddr

option <82-82> subnet-mask 15 type dhcp dest-ipaddr

source-ipaddr

option <82-82> 15 type dhcp dest-ipaddr

source-ipaddr

15 type dhcp dest-ipaddr

15 type dhcp 15 type dns target-addr name-server

source-ipaddr

source-port <1-65535> 15 type dns target-addr name-server

source-ipaddr

15 type dns target-addr name-server

15 type pathEcho protocol ipIcmpEcho

source-ipaddr

15 type pathEcho protocol ipIcmpEcho

15 type pathJitter dest-ipaddr

source-ipaddr

15 type pathJitter dest-ipaddr

num-packets <1-100> 15 type pathJitter dest-ipaddr

interval <1-1000> 15 type pathJitter dest-ipaddr

targetOnly 15 type pathJitter dest-ipaddr

15 type slm frame-relay pvc 15 type slm controller T1 15 type slm controller E1 15 type slm controller T3 15 type slm controller E3 15 exit In the following example, only those commands in RTR configuration mode containing the keyword dhcp are shown: Router# show parser dump rtr | include dhcp show parser dump CF-852 Cisco IOS Configuration Fundamentals Command Reference April 2010 15 type dhcp dest-ipaddr

source-ipaddr

option <82-82> circuit-id 15 type dhcp dest-ipaddr

source-ipaddr

option <82-82> remote-id 15 type dhcp dest-ipaddr

source-ipaddr

option <82-82> subnet-mask 15 type dhcp dest-ipaddr

source-ipaddr

option <82-82> 15 type dhcp dest-ipaddr

source-ipaddr

15 type dhcp dest-ipaddr

15 type dhcp Router# The following example shows how the extend keyword displays the syntax descriptions that match those shown using the ? command-line help: Router# show parser dump rtr extend Mode Name :rtr 15 type udpEcho dest-ipaddr

dest-port <1-65535> source-ipaddr

source-port <1-65535> control enable type : Type of entry udpEcho : UDP Echo Operation dest-ipaddr : Destination address

: IP address or hostname dest-port : Destination Port <1-65535> : Port Number source-ipaddr : Source address

: IP address or hostname source-port : Source Port <1-65535> : Port Number control : Enable or disable control packets enable : Enable control packets exchange (default) . . . ! Ctrl-Z used here to interrupt output and return to CLI prompt. Router# config terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)# rtr 1 Router(config-rtr)# type udpEcho ? dest-ipaddr Destination address Router(config-rtr)# type udpEcho dest-ipaddr ? Hostname or A.B.C.D IP address or hostname Router(config-rtr)# type udpEcho dest-ipaddr HOSTNAME ? dest-port Destination Port Router(config-rtr)# type udpEcho dest-ipaddr HOSTNAME dest-port ? <1-65535> Port Number Router(config-rtr)# type udpEcho dest-ipaddr HOSTNAME dest-port 1 ? control Enable or disable control packets source-ipaddr Source address source-port Source Port Router(config-rtr)# type udpEcho dest-ipaddr HOSTNAME dest-port 1 control ? disable Disable control packets exchange enable Enable control packets exchange (default) show parser dump CF-853 Cisco IOS Configuration Fundamentals Command Reference April 2010 In the following example, show parser dump output is redirected to a file on a remote TFTP server: show parser dump exec extend | redirect tftp://209.165.200.225/userdirectory/123-exec-commands.txt In the following example, the show parser dump command is not available in Cisco IOS software because this command was removed in Cisco IOS 15.0(1)M: Router# show parser dump all Command accepted, but obsolete, parser dumper has been deprecated Related Commands Command Description show append Redirects and adds the output of any show command to an existing file. show begin Filters the output of any show command to display the output from the first instance of a specified string. show exclude Filters show command output so that it excludes lines that contain a particular regular expression. show include Filters show command output so that only lines that containing the specified string are displayed. show redirect Redirects the output of any show command to a file. show tee Copies the output of any show command to a file while displaying it on the terminal. show parser macro CF-854 Cisco IOS Configuration Fundamentals Command Reference April 2010 show parser macro To display the smart port macros, use the show parser macro command in privileged EXEC mode. show parser macro [name macro-name | brief | description [interface interface]] Syntax Description Defaults This command has no default settings. Command Modes Privileged EXEC (#) Command History Examples The following example shows how to display the macro description: Router# show parser macro description Interface Macro Description -------------------------------------------------------------- Fa1/2 desktop-config -------------------------------------------------------------- The following example shows how to display the contents of the cisco-router smart port macro: Router# show parser macro name cisco-router Macro name : cisco-router Macro type : default interface # macro keywords $NVID # Do not apply to EtherChannel/Port Group # Access Uplink to Distribution switchport # Define unique Native VLAN on trunk ports # Recommended value for native vlan (NVID) should not be 1 switchport trunk native vlan $NVID # Update the allowed VLAN range (VRANGE) such that it # includes data, voice and native VLANs # switchport trunk allowed vlan VRANGE # Hardcode trunk and disable negotiation to # speed up convergence switchport trunk encapsulation dot1q name macro-name (Optional) Displays a specific macro. brief (Optional) Displays the configured macro names. description (Optional) Displays the macro description for all interfaces. interface interface (Optional) Displays the macro description for the specified interface. Release Modification 12.2(33)SXH This command was introduced. show parser macro CF-855 Cisco IOS Configuration Fundamentals Command Reference April 2010 switchport mode trunk switchport nonegotiate # Configure qos to trust this interface auto qos voip trust mls qos trust dscp # Ensure fast access to the network when enabling the interface. # Ensure that switch devices cannot become active on the interface. spanning-tree portfast spanning-tree bpduguard enable The following example shows how to list the Cisco-provided smart port macros: Router# show parser macro brief | include default default global : cisco-global default interface: cisco-desktop default interface: cisco-phone default interface: cisco-switch default interface: cisco-router Related Commands Command Description macro (global configuration) Creates a command macro. macro (interface configuration) Creates an interface-specific command macro. show parser statistics CF-856 Cisco IOS Configuration Fundamentals Command Reference April 2010 show parser statistics To displays statistics about the last configuration file parsed and the status of the Parser Cache feature, use the show parser statistics command in privileged EXEC mode. show parser statistics Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Usage Guidelines The show parser statistics command displays two sets of data: • The number of commands in the configuration file that was last copied into the running configuration, and the time it took for the system to parse them (a configuration file can be loaded into the running configuration at system startup, or by issuing commands such as the copy source running-config command). • The status of the Parser Cache feature (enabled or disabled) and the number of command matches (indicated by hits/misses) since the system was started or since the parser cache was cleared. The Parser Cache feature optimizes the parsing (translation and execution) of Cisco IOS software configuration command lines by remembering how to parse recently encountered command lines, decreasing the time required to process large configuration files. Examples The following example shows sample output from the show parser statistics command: Router# show parser statistics Last configuration file parsed:Number of Commands:1484, Time:1272 ms Parser cache:disabled, 0 hits, 2 misses In this example, the Parser Cache feature is disabled, but shows the hit/miss statistics for the two commands issued while the parser cache was last enabled. Table 126 describes the key output fields. Release Modification 12.1(5)T This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show parser statistics CF-857 Cisco IOS Configuration Fundamentals Command Reference April 2010 In the following example the show parser statistics command is used to compare the parse-time of a large configuration file with the Parser Cache feature disabled and enabled. In this example, a configuration file with 1484 access list commands is loaded into the running configuration. Router# configure terminal !parser cache is disabled Router(config)# no parser cache !configuration file is loaded into the running configuration Router# copy slot0:acl_list running-config . . . Router# show parser statistics Last configuration file parsed:Number of Commands:1484, Time:1272 ms Parser cache:disabled, 0 hits, 2 misses !the parser cache is reenabled Router(config)# parser cache !configuration file is loaded into the running configuration Router# copy slot0:acl_list running-config . . . Router# show parser statistics Last configuration file parsed:Number of Commands:1484, Time:820 ms Parser cache:enabled, 1460 hits, 26 misses Table 126 show parser statistics Output Fields Last configuration file parsed: Displays statistics on the last configuration file copied into the running configuration (at startup or using the copy command). Number of commands: The number of command lines in the last configuration file parsed. Time: Time (in milliseconds) taken for the system to load the last configuration file. Parser cache: Displays whether the Parser Cache feature is enabled or disabled, and the hit/miss statistics related to the feature. Statistics are stored since the initialization of the system, or since the last time the parser cache was cleared. hits Number of commands the parser cache was able to parse more efficiently by matching them to similar commands executed previously. misses Number of commands the parser cache was unable to match to previously executed commands. The performance enhancement provided by the Parser Cache feature cannot be applied to unmatched commands. show parser statistics CF-858 Cisco IOS Configuration Fundamentals Command Reference April 2010 These results show an improvement to the load time for the same configuration file from 1272 milliseconds (ms) to 820 ms when the Parser Cache feature was enabled. As indicated in the “hits” field of the show command output, 1460 commands were able to be parsed more efficiently by the parser cache. Related Commands Command Description clear parser cache Clears the parse cache entries and hit/miss statistics stored for the Parser Cache feature. parser cache Enables or disables the Parser Cache feature. show pci CF-859 Cisco IOS Configuration Fundamentals Command Reference April 2010 show pci To display information about the peripheral component interconnect (PCI) hardware registers or bridge registers for the Cisco 7200 series routers, use the show pci command in EXEC mode. show pci {hardware | bridge [register]} Syntax Description Command Modes EXEC Command History Usage Guidelines The output of this command is generally useful for diagnostic tasks performed by technical support only. Note The show pci hardware EXEC command displays a substantial amount of information. Examples The following is sample output for the PCI bridge register 1 on a Cisco 7200 series router: Router# show pci bridge 1 Bridge 4, Port Adaptor 1, Handle=1 DEC21050 bridge chip, config=0x0 (0x00): cfid = 0x00011011 (0x04): cfcs = 0x02800147 (0x08): cfccid = 0x06040002 (0x0C): cfpmlt = 0x00010010 (0x18): cfsmlt = 0x18050504 (0x1C): cfsis = 0x22805050 (0x20): cfmla = 0x48F04880 (0x24): cfpmla = 0x00004880 (0x3C): cfbc = 0x00000000 (0x40): cfseed = 0x00100000 (0x44): cfstwt = 0x00008020 The following is partial sample output for the PCI hardware register, which also includes information on all the PCI bridge registers on a Cisco 7200 series router: Router# show pci hardware hardware Displays PCI hardware registers. bridge Displays PCI bridge registers. register (Optional) Number of a specific bridge register in the range from 0 to 7. If not specified, this command displays information about all registers. Release Modification 11.2 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show pci CF-860 Cisco IOS Configuration Fundamentals Command Reference April 2010 GT64010 External PCI Configuration registers: Vendor / Device ID : 0xAB114601 (b/s 0x014611AB) Status / Command : 0x17018002 (b/s 0x02800117) Class / Revision : 0x00000006 (b/s 0x06000000) Latency : 0x0F000000 (b/s 0x0000000F) RAS[1:0] Base : 0x00000000 (b/s 0x00000000) RAS[3:2] Base : 0x00000001 (b/s 0x01000000) CS[2:0] Base : 0x00000000 (b/s 0x00000000) CS[3] Base : 0x00000000 (b/s 0x00000000) Mem Map Base : 0x00000014 (b/s 0x14000000) IO Map Base : 0x01000014 (b/s 0x14000001) Int Pin / Line : 0x00010000 (b/s 0x00000100) Bridge 0, Downstream MB0 to MB1, Handle=0 DEC21050 bridge chip, config=0x0 (0x00): cfid = 0x00011011 (0x04): cfcs = 0x02800143 (0x08): cfccid = 0x06040002 (0x0C): cfpmlt = 0x00011810 (0x18): cfsmlt = 0x18000100 (0x1C): cfsis = 0x02809050 (0x20): cfmla = 0x4AF04880 (0x24): cfpmla = 0x4BF04B00 (0x3C): cfbc = 0x00000000 (0x40): cfseed = 0x00100000 (0x44): cfstwt = 0x00008020 . . . show pci hardware CF-861 Cisco IOS Configuration Fundamentals Command Reference April 2010 show pci hardware To display information about the Host-PCI bridge, use the show pci hardware command in EXEC mode. show pci hardware Syntax Description This command has no arguments or keywords. Command Modes EXEC Command History Usage Guidelines The output of this command is generally useful for diagnostic tasks performed by technical support only: Router# show pci hardware hardware PCI hardware registers Each device on the PCI bus is assigned a PCI device number. For the C2600, device numbers are as follows: Device Device number 0 First LAN device 1 Second LAN device 2 AIM device (if present) 3 Not presently used 4 Port module - first PCI device 5 Port module - second PCI device 6 Port module - third PCI device 7 Port module - fourth PCI device 8-14 Not presently used 15 Xilinx PCI bridge Examples The following is partial sample output for the PCI hardware register, which also includes information on all the PCI bridge registers. router# show pci hardware XILINX Host-PCI Bridge Registers: Vendor / Device ID: 0x401310EE Status / Command: 0x040001C6 PCI Slave Base Reg 0: 0x00000000 PCI Slave Base Reg 1: 0x04000000 Table 127 describes the significant fields shown in the display. Release Modification 11.2 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show pci hardware CF-862 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 127 show pci hardware Field Descriptions Field Description Device/Vendor ID Identifies the PCI vendor and device. The value 0x401310EE identifies the device as the Xilinx-based Host-PCI bridge for the Cisco 2600 router. Status/Command Provides status of the Host-PCI bridge. Refer to the PCI Specification for more information. PCI Slave Base Reg 0 The base address of PCI Target Region 0 for the Host-PCI bridge. This region is used for Big-Endian transfers between PCI devices and memory. PCI Slave Base Reg 1 The base address of PCI Target Region 1 for the Host-PCI bridge. This region is used for Little-Endian transfers between PCI devices and memory. show perf-meas CF-863 Cisco IOS Configuration Fundamentals Command Reference April 2010 show perf-meas To display the performance measurement of the router, use the show perf-meas command in user EXEC or privileged EXEC mode. show perf-meas [report-types | all] Syntax Description Command Modes User EXEC (>) Privileged EXEC (#) Command History Usage Guidelines Use the show perf-meas command to display the performance measurement of the router. Examples The following is sample output from the show perf-meas command. The field descriptions are self-explanatory. Router# show perf-meas ****** P E R F O R M A N C E M E A S U R E M E N T ****** ---------------------------------------------- Fastswitch packets from: Fast-Ethernet to Fast-Ethernet - Min Time: 0 micro seconds - Avg Time: 0 micro seconds - Max Time: 0 micro seconds - Total number Fastswitch-packets: 0 - Number of packets from output queue (non-Fastswitch): 0 -------------------------------------------------------------------------------| | Perf Ctr Min | Perf Ctr Avg | Perf Ctr Max | report-types (optional) Reports type. The values are: • 2t-to-hdlc - Display 2t-to-hdlc report2t-to-modem Display 2t-to-modem report • all - Display all reports • fe-to-hdlc- Displays fe-to-hdlc report • fe-to-modem- Displays fe-to-modem report • hdlc-to-2t- Display hdlc-to-2t report • hdlc-to-fe- Display hdlc-to-fe report • modem-to-2t - Display modem-to-2t report • modem-to-fe- Displays modem-to-fe report all (Optional) Display all reports. Release Modification 15.0(1)M This command was introduced in a release earlier than Cisco IOS Release 15.0(1)M. show perf-meas CF-864 Cisco IOS Configuration Fundamentals Command Reference April 2010 -------------------------------------------------------------------------------| Clock Cycles | 0 | 0 | 0 | Total-Issued Instructions | 0 | 0 | 0 | Floating Point Instructions Issued| 0 | 0 | 0 | Integer Instructions Issued | 0 | 0 | 0 | Load Instructions Issued | 0 | 0 | 0 | Store Instructions Issued | 0 | 0 | 0 | Dual-Issued Instruction Pairs | 0 | 0 | 0 | Branch Pre-Fetches | 0 | 0 | 0 | Slip Cycles | 0 | 0 | 0 | Stall Cycles | 0 | 0 | 0 | On-Chip Secondary Cache Misses | 0 | 0 | 0 | Primary Instruction Cache Misses | 0 | 0 | 0 | Primary Data Cache Misses | 0 | 0 | 0 | DTLB Misses | 0 | 0 | 0 | ITLB Misses | 0 | 0 | 0 | Joint TLB Instruction Misses | 0 | 0 | 0 | Joint TLB Data Misses | 0 | 0 | 0 | Taken Branch Instructions | 0 | 0 | 0 | Branch Instructions Issued | 0 | 0 | 0 | OCS Cache Write-Backs | 0 | 0 | 0 | Data Cache Write-Backs | 0 | 0 | 0 | Pending Load Stall Cycles | 0 | 0 | 0 | Number of Re-Misses | 0 | 0 | 0 | FP Possible Exception Stall Cycle | 0 | 0 | 0 | -------------------------------------------------------------------------------| show platform CF-865 Cisco IOS Configuration Fundamentals Command Reference April 2010 show platform To display platform information, use the show platform command in privileged EXEC mode. show platform {buffers | copp rate-limit {arp | dhcp | atm-oam | ethernet-oam | icmp | igmp | pppoe-discovery | atom ether-vc | all} | np copp [ifnum] [detail] | dma | eeprom | fault | hardware capacity | hardware pfc mode | internal-vlan | interrupts | netint | software ipv6-multicast connected | stats | tech-support {ipmulticast [vrf vrf-name] group-ip-addr src-ip-addr | unicast [vrf vrf-name] destination-ip-addr destination-mask [global]} | tlb | vfi dot1q-transparency | vlans} Cisco ASR 1000 Series Aggregation Services Routers show platform Syntax Description buffers Displays buffer-allocation information. copp rate-limit Displays Cisco Control Plane Policing (CoPP) rate-limit information on the Cisco 7600 SIP-400. arp Specifies Address Resolution Protocol (ARP) packet traffic. dhcp Specifies Dynamic Host Configuration Protocol (DHCP) packet traffic. atm-oam Specifies ATM Operation, Administration, and Maintenance (OAM) packet traffic. ethernet-oam Specifies Ethernet OAM packet traffic. icmp Specifies Internet Connection Management Protoocol Rate limiter. igmp Specifies Internet Group Management Potocol Rate limiter. pppoe-discovery Specifies Point-to-Point Protocol over Ethernet (PPPoE) discovery packet information. atom ether-vc Shows whether IP or routed mode interworking is configured. all Displays rate-limit information for all protocols. np copp Displays debug information for a given CoPP session ID or for all CoPP sessions. ifnum (Optional) A session ID. detail (Optional) Shows full rate-limited values. dma Displays Direct Memory Access (DMA) channel information. eeprom Displays CPU EEPROM information. fault Displays the fault date. hardware capacity Displays the capacities and utilizations for hardware resources; see the show platform hardware capacity command. hardware pfc mode Displays the type of installed Policy Feature Card (PFC). internal-vlan Displays the internal VLAN. interrupts Displays m8500 interrupt counters. netint Displays the platform network-interrupt information. software ipv6-multicast connected Displays all the IPv6 subnet Access Control List (ACL) entries on the Route Processor (RP); see the show platform software ipv6-multicast command. show platform CF-866 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Modes Privileged EXEC (#) Command History Usage Guidelines This command is similar to the show msfc command. This command can be used to verify the existence of a second Cisco IOS process on a single Cisco ASR 1000 RP on a Cisco ASR 1002 router or Cisco ASR 1004 router. When this command is used with the atom ether-vc keyword, it is used on the line-card console. stats Displays Constellation WAN (CWAN) statistics. tech-support ipmulticast Displays IP multicast-related information for Technical Assistance Center (TAC). vrf vrf-name (Optional) Displays the Virtual Private Network (VPN) routing and forwarding (VRF) instance. group-ip-addr Group IP address. src-ip-addr Source IP address. unicast Displays IP unicast-related information for TAC. destination-ip-addr Destination IP address. destination-mask Destination mask. global (Optional) Displays global output. tlb Displays information about the translation look-aside buffer (TLB) register. vfi Displays CWAN virtual forwarding instance (VFI) commands. dot1q-transparency Displays the dot1q transparency setting. vlans Displays hidden VLAN-to-WAN interface mapping. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Cisco IOS Release 12.2(17d)SXB. This command was changed to include the hardware pfc mode keywords. 12.2(18)SXD This command was modified to include the software ipv6-multicast connected keywords. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SRC This command was modified to include additional keywords to support CoPP enhancements on the Cisco 7600 SIP-400 on the Cisco 7600 series router. Cisco IOS XE Release 2.1 This command was integrated into Cisco IOS XE Release 2.1. 12.2(33)SRD This command was modified. The atom ether-vc keyword was added. show platform CF-867 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following sample output from the show platform buffers command displays buffer-allocation information: Router# show platform buffers Reg. set Min Max TX 640 ABQ 640 16384 0 0 40 1 6715 8192 2 0 0 3 0 0 4 0 0 5 0 0 6 0 0 7 0 0 Threshold = 8192 Vlan Sel Min Max Cnt Rsvd 1019 1 6715 8192 0 0 Router# Cisco ASR 1000 Series Routers The following example displays online status information for the shared port adapters (SPAs), Cisco ASR 1000 SPA Interface Processor (SIP), Cisco ASR 1000 Embedded Services Processor (ESP), Cisco ASR 1000 RP, power supplies, and fans. The ESPs are shown as F0 and F1. The RPs are shown as R0 and R1. The State column should display “ok” for SIPs, SPAs, power supplies, and fans. For RPs and ESPs, the State column should display “ok, active” or “ok, standby.” Router# show platform Chassis type: ASR1006 Slot Type State Insert time (ago) --------- ------------------- --------------------- ----------------- 0 ASR1000-SIP10 ok 18:23:58 0/0 SPA-5X1GE-V2 ok 18:22:38 0/1 SPA-8X1FE-TX-V2 ok 18:22:33 0/2 SPA-2XCT3/DS0 ok 18:22:38 1 ASR1000-SIP10 ok 18:23:58 1/0 SPA-2XOC3-POS ok 18:22:38 1/1 SPA-8XCHT1/E1 ok 18:22:38 1/2 SPA-2XT3/E3 ok 18:22:38 R0 ASR1000-RP1 ok, active 18:23:58 R1 ASR1000-RP1 ok, standby 18:23:58 F0 ASR1000-ESP10 ok, active 18:23:58 F1 ASR1000-ESP10 ok, standby 18:23:58 P0 ASR1006-PWR-AC ok 18:23:09 P1 ASR1006-FAN ok 18:23:09 Slot CPLD Version Firmware Version --------- ------------------- --------------------------------------- 0 06120701 12.2(33r)XN2 1 06120701 12.2(33r)XN2 R0 07082312 12.2(33r)XN2 R1 07082312 12.2(33r)XN2 F0 07051680 12.2(33r)XN2 F1 07051680 12.2(33r)XN2 show platform CF-868 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco ASR 1000 Series Routers—Verifying Dual Cisco IOS Processes on Single RP In the following example, a second Cisco IOS process is enabled on a Cisco ASR 1004 router using stateful switchover (SSO). The output of the show platform command is provided before and after the SSO configuration to verify that the second Cisco IOS process is enabled and active. Router# show platform Chassis type: ASR1004 Slot Type State Insert time (ago) --------- ------------------- --------------------- ----------------- 0 ASR1000-SIP10 ok 00:04:39 0/0 SPA-5X1GE-V2 ok 00:03:23 0/1 SPA-2XT3/E3 ok 00:03:18 R0 ASR1000-RP1 ok, active 00:04:39 F0 ASR1000-ESP10 ok, active 00:04:39 P0 ASR1004-PWR-AC ok 00:03:52 P1 ASR1004-PWR-AC ok 00:03:52 Slot CPLD Version Firmware Version --------- ------------------- --------------------------------------- 0 07091401 12.2(33r)XN2 R0 07062111 12.2(33r)XN2 F0 07051680 12.2(33r)XN2 Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)# redundancy Router(config-red)# mode sso *May 27 19:43:43.539: %CMRP-6-DUAL_IOS_REBOOT_REQUIRED: R0/0: cmand: Configuration must be saved and the chassis must be rebooted for IOS redundancy changes to take effect Router(config-red)# exit Router(config)# exit Router# *May 27 19:44:04.173: %SYS-5-CONFIG_I: Configured from console by user on console Router# copy running-config startup-config Destination filename [startup-config]? Building configuration... [OK] Router# reload Proceed with reload? [confirm] *May 27 19:45:16.917: %SYS-5-RELOAD: Reload requested by user on console. Reload Reason: Reload command. Router# show platform Chassis type: ASR1004 Slot Type State Insert time (ago) --------- ------------------- --------------------- ----------------- 0 ASR1000-SIP10 ok 00:29:34 0/0 SPA-5X1GE-V2 ok 00:28:13 0/1 SPA-2XT3/E3 ok 00:28:18 R0 ASR1000-RP1 ok 00:29:34 R0/0 ok, active 00:29:34 R0/1 ok, standby 00:27:49 F0 ASR1000-ESP10 ok, active 00:29:34 P0 ASR1004-PWR-AC ok 00:28:47 show platform CF-869 Cisco IOS Configuration Fundamentals Command Reference April 2010 P1 ASR1004-PWR-AC ok 00:28:47 Slot CPLD Version Firmware Version --------- ------------------- --------------------------------------- 0 07091401 12.2(33r)XN2 R0 07062111 12.2(33r)XN2 F0 07051680 12.2(33r)XN2 Table 128 describes the significant fields shown in the display. Table 128 show platform Field Descriptions Field Description Slot Chassis slot. Type Hardware type. show platform CF-870 Cisco IOS Configuration Fundamentals Command Reference April 2010 State Online state of the hardware. One of the following values: All Hardware • booting—Hardware is initializing and software is booting. • disabled—Hardware is not operational. • init—Hardware or Cisco IOS process is initializing. • ok—Hardware is operational. • shutdown—Hardware was administratively shut down using the no shutdown command. • unknown—Hardware is not operational; state is unknown. RP or ESP • init, standby—Standby RP or ESP is operational but is not yet in a high availability (HA) state. An RP or ESP switchover is not yet possible. • ok, active—Active RP or ESP is operational. • ok, standby—Standby RP or ESP is operational. The standby RP or ESP is ready to become active in the event of a switchover. SPA • admin down—SPA was disabled using the shutdown command. • inserted—SPA is being inserted. • missing—SPA was removed. • out of service—SPA is not operational. • retrieval error—An error occurred while retrieving the SPA state; state is unknown. • stopped—SPA was gracefully deactivated using the hw-module subslot stop command. Fan or Power Supply • fan, fail—Fan is failing. • ps, fail—Power supply is failing. Insert time (ago) Amount of time (hh:mm:ss format) the hardware has been online. CPLD Version Complex programmable logic device version number. Firmware Version Firmware (ROMmon) version number. Table 128 show platform Field Descriptions (continued) Field Description show platform CF-871 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco 7600 Series Routers with Cisco 7600 SIP-400 The following sample output from the show platform copp rate-limit arp command displays the list of interfaces on which a rate limiter is active for ARP, along with the count of confirmed and exceeded packets for the rate limiter: Router# show platform copp rate-limit arp Rate limiter Information for Protocol arp: Rate Limiter Status: Enabled Rate : 20 pps Max Observation Period : 60 seconds Per Interface Rate Limiter Information Interface Conformed Pkts Exceeded Pkts Enabled Obs Period (Mts) GigabitEthernet5/1 0 0 No - GigabitEhternet5/1.1 14 0 No - GigabitEthernet5/1.2 28 2 No - GigabitEthernet5/2 0 0 No - GigabitEthernet5/2.1 180 4 Yes 35 GigabitEthernet5/2.2 200 16 Yes Max Table 129 describes the significant fields shown in the display. The following sample from the show platform eeprom command displays CPU EEPROM information: Router# show platform eeprom MSFC CPU IDPROM: IDPROM image: Table 129 show platform copp rate-limit Field Descriptions Field Description Rate Limiter Status Indicates if a rate limiter has been enabled on the interface. Rate Indicates the configured rate in packets per second (pps) or bits per second (bps). Max Observation Period Indicates the configured observation period, in seconds, before the per-interface rate limiter is automatically turned off. Per Interface Rate Limiter Information Displays the list of interfaces on which the rate limiter is active. In this example: • GigabitEthernet5/1.1 is free from attack. • GigabitEthernet5/2.1 has an exceed count of 4, and has a rate limiter enabled. The observation period is 35 minutes, which indicates that currently the interface is free from attack and is being kept under observation. The interface will remain under observation for an additional 35 minutes. If it remains free from attack after that time, the rate limiter is automatically removed. • GigabitEthernet5/2.2 has an exceed count of 16 and has a rate limiter enabled. The observation period has been designated as Max. This indicates that the interface is still under attack and has not yet entered the observation time window. show platform CF-872 Cisco IOS Configuration Fundamentals Command Reference April 2010 IDPROM image block #0: hexadecimal contents of block: 00: AB AB 02 9C 13 5B 02 00 00 02 60 03 03 E9 43 69 .....[....`...Ci 10: 73 63 6F 20 53 79 73 74 65 6D 73 00 00 00 00 00 sco Systems..... 20: 00 00 57 53 2D 58 36 4B 2D 53 55 50 33 2D 50 46 ..WS-X6K-SUP3-PF 30: 43 33 00 00 00 00 53 41 44 30 36 34 34 30 31 57 C3....SAD064401W 40: 4C 00 00 00 00 00 00 00 00 00 37 33 2D 37 34 30 L.........73-740 50: 34 2D 30 37 00 00 00 00 00 00 30 35 00 00 00 00 4-07......05.... 60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 70: 00 00 00 00 02 BD 00 00 00 00 00 09 00 05 00 01 ................ 80: 00 03 00 01 00 01 00 02 03 E9 00 00 00 00 00 00 ................ 90: 00 00 00 00 00 00 00 00 00 00 00 00 ............ block-signature = 0xABAB, block-version = 2, block-length = 156, block-checksum = 4955 *** common-block *** IDPROM capacity (bytes) = 512 IDPROM block-count = 2 FRU type = (0x6003,1001) OEM String = 'Cisco Systems' Product Number = 'WS-X6K-SUP3-PFC3' Serial Number = 'SAD064401WL' Manufacturing Assembly Number = '73-7404-07' Manufacturing Assembly Revision = '05' Hardware Revision = 0.701 Manufacturing bits = 0x0 Engineering bits = 0x0 SNMP OID = 9.5.1.3.1.1.2.1001 Power Consumption = 0 centiamperes RMA failure code = 0-0-0-0 CLEI = *** end of common block *** IDPROM image block #1: hexadecimal contents of block: 00: 60 03 02 67 0C 24 00 00 00 00 00 00 00 00 00 00 `..g.$.......... 10: 00 00 00 00 00 00 00 51 00 05 9A 3A 7E 9C 00 00 .......Q...:~... 20: 02 02 00 01 00 01 00 00 00 00 00 00 00 00 00 00 ................ 30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 40: 14 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 50: 00 00 81 81 81 81 80 80 80 80 80 80 80 80 80 80 ................ 60: 80 80 06 72 00 46 37 ...r.F7 block-signature = 0x6003, block-version = 2, block-length = 103, block-checksum = 3108 *** linecard specific block *** feature-bits = 00000000 00000000 hardware-changes-bits = 00000000 00000000 card index = 81 mac base = 0005.9A3A.7E9C mac_len = 0 num_processors = 2 epld_num = 2 epld_versions = 0001 0001 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 port numbers: pair #0: type=14, count=01 pair #1: type=00, count=00 pair #2: type=00, count=00 pair #3: type=00, count=00 pair #4: type=00, count=00 pair #5: type=00, count=00 pair #6: type=00, count=00 pair #7: type=00, count=00 sram_size = 0 show platform CF-873 Cisco IOS Configuration Fundamentals Command Reference April 2010 sensor_thresholds = sensor #0: critical = -127 oC (sensor present but ignored), warning = -127 oC (sensor present but ignored) sensor #1: critical = -127 oC (sensor present but ignored), warning = -127 oC (sensor present but ignored) sensor #2: critical = -128 oC (sensor not present), warning = -128 oC (sensor not present) sensor #3: critical = -128 oC (sensor not present), warning = -128 oC (sensor not present) sensor #4: critical = -128 oC (sensor not present), warning = -128 oC (sensor not present) sensor #5: critical = -128 oC (sensor not present), warning = -128 oC (sensor not present) sensor #6: critical = -128 oC (sensor not present), warning = -128 oC (sensor not present) sensor #7: critical = -128 oC (sensor not present), warning = -128 oC (sensor not present) max_connector_power = 1650 cooling_requirement = 70 ambient_temp = 55 *** end of linecard specific block *** The following sample output from the show platform fault command displays fault-date information: Router# show platform fault Fault History Buffer: rsp72043_rp Software (rsp72043_rp-ADVENTERPRISEK9_DBG-M), Version 12.2(32.8.1)RE C186 ENGINEERING WEEKLY BUILD, synced to V122_32_8_11_SR186 Compiled Wed 08-Apr-09 09:22 by abcd Uptime 2w3d Exception Vector: 0x1500 PC 0x0B13DD4C MSR 0x00029200 LR 0x0B13DD10 r0 0x0B13DD10 r1 0x1C58A1C8 r2 0xFFFCFFFC r3 0x189EDEF4 r4 0x00000000 r5 0x00000000 r6 0x1C58A1B0 r7 0x00029200 r8 0x00029200 r9 0x00000000 r10 0x00000001 r11 0x189EDEF0 r12 0x0000001B r13 0x04044000 r14 0x08736008 r15 0x115C0000 r16 0x00000000 r17 0x00000000 r18 0x00000000 r19 0x1B751358 r20 0x00000000 r21 0x00000000 r22 0x00000000 r23 0x00000000 r24 0x00000000 r25 0x00000000 r26 0x00000000 r27 0x00000001 r28 0x13255EC0 r29 0x1C59BD00 r30 0x13255EC0 r31 0x00000000 dec 0x00007333 tbu 0x00004660 tbl 0x594BBFC4 pvr 0x80210020 dear 0x00000000 dbcr0 0x41000000 dbcr1 0x00000000 dbcr2 0x00000000 iac1 0x00000000 iac2 0x00000000 dac1 0x00000000 dac2 0x00000000 The following sample output from the show platform hardware pfc mode command displays the PFC-operating mode: Router# show platform hardware pfc mode PFC operating mode : PFC3A This example shows how to display platform network-interrupt information: Router# show platform netint Network IO Interrupt Throttling: throttle count=0, timer count=0 active=0, configured=1 netint usec=3999, netint mask usec=800 inband_throttle_mask_hi = 0x0 inband_throttle_mask_lo = 0x800000 show platform CF-874 Cisco IOS Configuration Fundamentals Command Reference April 2010 This following sample output from the show platform tlb command displays the TLB-register information: Router# show platform tlb Mistral revision 5 TLB entries : 42 Virt Address range Phy Address range Attributes 0x10000000:0x1001FFFF 0x010000000:0x01001FFFF CacheMode=2, RW, Valid 0x10020000:0x1003FFFF 0x010020000:0x01003FFFF CacheMode=2, RW, Valid 0x10040000:0x1005FFFF 0x010040000:0x01005FFFF CacheMode=2, RW, Valid 0x10060000:0x1007FFFF 0x010060000:0x01007FFFF CacheMode=2, RW, Valid 0x10080000:0x10087FFF 0x010080000:0x010087FFF CacheMode=2, RW, Valid 0x10088000:0x1008FFFF 0x010088000:0x01008FFFF CacheMode=2, RW, Valid 0x18000000:0x1801FFFF 0x010000000:0x01001FFFF CacheMode=0, RW, Valid 0x19000000:0x1901FFFF 0x010000000:0x01001FFFF CacheMode=7, RW, Valid 0x1E000000:0x1E1FFFFF 0x01E000000:0x01E1FFFFF CacheMode=2, RW, Valid 0x1E880000:0x1E899FFF 0x01E880000:0x01E899FFF CacheMode=2, RW, Valid 0x1FC00000:0x1FC7FFFF 0x01FC00000:0x01FC7FFFF CacheMode=2, RO, Valid 0x30000000:0x3001FFFF 0x070000000:0x07001FFFF CacheMode=2, RW, Valid 0x40000000:0x407FFFFF 0x000000000:0x0007FFFFF CacheMode=3, RO, Valid . . . 0x58000000:0x59FFFFFF 0x088000000:0x089FFFFFF CacheMode=3, RW, Valid 0x5A000000:0x5BFFFFFF 0x08A000000:0x08BFFFFFF CacheMode=3, RW, Valid 0x5C000000:0x5DFFFFFF 0x08C000000:0x08DFFFFFF CacheMode=3, RW, Valid 0x5E000000:0x5FFFFFFF 0x08E000000:0x08FFFFFFF CacheMode=3, RW, Valid This example shows how use the atom ether-vc keyword to display line-card information for an ES20 line card in slot 3. Router# show platform copp rate-limit atom ether-vc AToM Ether VC Index(12902): segtype(3) seghandle(0x5ECF7F34) Disposition : flags(97) vlanid(502) local_vc_label(22691) ForwardingTable: oper(12) flags(0x2100) vlan(502) dest_index(0x9ED) Imposition: flags(0x21) egress_idx(0x0) ifnum(28) tx_tvc(0x7D83) rvclbl[0](3356) rigplbl[1](1011) label[2](0) label[3](0) ltl(0x9ED) mac(0014.1c80.f600) qos_info(0x0) Platform Data: loc_lbl acif_num fw_idx cword eg_ifnum ckt_idx vlan ac_hdl vc_hash 22691 615 0x0 0x3 28 0x8003 502 0x5ECF7F34 0x3266 Platform Index(0x81F68003) is_sw(1) is_vfi(0) vlan(502) pseudo_port_offset(3) tx_tvc(0x7D83) Statistics : Packets Bytes Drop Pkts Drop Bytes ID Disposition: 0 0 0 0 0 Imposition : 0 0 0 0 0 Vlan func[1]: 502 (0x1F6) func(0:invalid) feat (0x0 ) Tx TVC Table idx ltl h pt cw vt efp adj v imp x---- x-- d d- d- d- x--- x--- d x--- SIP10G EoMPLS disp detailed info: t vclbl VLAN Type disp-idx - d------- x---(d---) ------- x------- 0 00022691 01F6(0502) ether 00001692 SIP10G EoMPLS ipiw disp detailed info: ipiw mac valid CE-MAC Address b--- b-------- -------------- 0001 000000001 0016.9c6e.7480 VC Summary: vlan(502) VC count(1) show platform CF-875 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description platform copp Turns on or off rate-limiting for an interface on the Cisco 7600 SIP-400. platform copp observation period Sets the observation period before automatically turning off the per-interface rate limiter on the Cisco 7600 SIP-400. pseudowire class Specifies the name of a Layer 2 pseudowire class. show msfc Displays MSFC information. show platform bridge CF-876 Cisco IOS Configuration Fundamentals Command Reference April 2010 show platform bridge To display distributed or hardware-based bridging information, use the show platform bridge command in privileged EXEC mode. show platform bridge [interface-type interface-number] [vlan vlan-id] [summary] Syntax Description Command Modes Privileged EXEC (#) Command History Examples The following is sample output from the show platform bridge command: Router# show platform bridge VLAN Interface CircuitId LTL PseudoPort State Options 12 PO1/1/3.1 102 0xC3F 1/256 up dot1q 13 PO1/1/3.1 103 0xC3F 1/256 up dot1q 14 PO1/1/3.2 104 0xC3F 1/256 up default 15 PO1/1/3.2 105 0xC3F 1/256 up default 16 PO1/1/3.3 106 0xC3F 1/256 up dot1q-tunnel 17 PO1/1/3.3 107 0xC3F 1/256 up dot1q-tunnel 41 Gi8/0/17 1201 0xDE2 8/227 up access 41 Gi8/0/17 1202 0xDE3 8/228 up access 41 Gi8/0/17 1203 0xDE4 8/229 up access 41 Gi8/0/17 1204 0xDE5 8/230 up access 41 Gi8/0/17 1205 0xDE6 8/231 up access 41 Gi8/0/17 1206 0xDE7 8/232 up access 41 Gi8/0/17 1207 0xDE8 8/233 up access 41 Gi8/0/17 1208 0xDE9 8/234 up access 41 Gi8/0/17 1209 0xDEA 8/235 up access 41 Gi8/0/17 1210 0xDEB 8/236 up access 41 Gi8/0/17 1211 0xDEC 8/237 up access 41 Gi8/0/17 1212 0xDED 8/238 up access 41 Gi8/0/17 1213 0xDEE 8/239 up access 41 Gi8/0/17 1214 0xDEF 8/240 up access 41 Gi8/0/17 1215 0xDF0 8/241 up access interface-type interface-number (Optional) Interface type and number. vlan vlan-id (Optional) Displays VLAN bridging information. summary (Optional) Displays a summary of bridging information. Release Modification 12.2(33)SRA This command was introduced. show platform bridge CF-877 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 128 describes the significant fields shown in the display. Related Commands Table 130 show platform bridge Field Descriptions Field Description VLAN The VLAN for which bridging is configured. Interface The WAN interface on which bridging is configured. This can be an ATM, Gigabit Ethernet, POS, or Serial interface. CircuitId The circuit ID. The range is from 0 to 65536. LTL The local target logic (LTL) of the interface. LTL is 13 bits long. The format is eee ssss pppppp (e: extended port bits, s: slot bits, p: port bits). Extended bits along with port bits identify the pseudoport and slot bits identifies the slot. PseudoPort In the case of flexwan, the port numbering is from 133 to 192 for Bay 0 and 197 to 256 for Bay 1. There are 60 ports per packet processing engine (PPE). For the SIP200, the pseudoports are in the range of 137 to 256. State State indicates the status of the physical interface on which bridging is configured. The state is either up or down. If the state is down, then there is a problem and debugging needs to be done. Options Options specify whether split-horizon is enabled on the WAN interface. This can be access, default, dot1q, or dot1q-tunnel. Command Description show platform Displays platform information. show platform cfm CF-878 Cisco IOS Configuration Fundamentals Command Reference April 2010 show platform cfm To display connectivity fault management (CFM) commands, use the show platform cfm command in privileged EXEC mode. show platform cfm {epl | info | interface {fastethernet | gigabitethernet | port-channel} number {fwd_vlan vlan-number | level | vlan_list}} Syntax Description Command Modes Privileged EXEC (#) Command History Examples The following is sample output from the show platform cfm info command. The field descriptions are self-explanatory. Router# show platform cfm info CFM is disabled CFM unicast MAC 00d0.2b6c.b103, CFM multicast MAC 0180.c200.0030, AEB multicast MAC 0100.0ccc.ccc0 CFM Ingress Control Packet System Statistics: Current software Rate Limit Setting: 1100 pkts/sec Statistics are collected in intervals of 3 seconds. Allow the first 3300 packets to pass each interval, drop thereafter Current Ingress Count in this interval: 0 pkts In this interval have we Exceeded Rate and Dropped pkts: NO For the last 3 intervals the maximum sample had 0 packets in one interval. epl Displays CFM Ethernet private line (EPL) details. info Displays the CFM Platform Adaptation Layer (PAL) information. interface Specifies the interface type. fastethernet Specifies the FastEthernet interface. gigabitethernet Specifies the GigabitEthernet interface. port-channel Specifies the port-channel interface. number Interface number. fwd_vlan Displays the CFM forward VLAN list. vlan-number VLAN number. level Displays the CFM level for the interface. vlan_list Specifies CFM VLAN list. Release Modification 12.2(33)SRA This command was introduced. 12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI. show platform cfm CF-879 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description show platform Displays platform information. show platform diag CF-880 Cisco IOS Configuration Fundamentals Command Reference April 2010 show platform diag To display diagnostic and debug information for individual platform components, use the show platform diag command in privileged EXEC mode. show platform diag Syntax Description Command Default This command has no default settings. Command Modes privileged EXEC (#) Command History Usage Guidelines This command can be used to display debug and diagnostic information and indicate the status of field replaceable unit (FRU) components in any Cisco ASR 1000 Series Router. Examples The following example displays diagnostic information for the Cisco ASR 1000 SPA Interface Processor (SIP), shared port adapters (SPAs), Cisco ASR 1000 Embedded Services Processor (ESP), Cisco ASR 1000 Route Processors (RP), and power supplies. The ESP is shown as F0 or F1. The RPs are shown as R0 or R1. The power supplies are shown as P0 and P1 Router#show platform diag Chassis type: ASR1004 Slot: 0, ASR1000-SIP10 Running state : ok Internal state : online Internal operational state : ok Physical insert detect time : 00:00:48 (4d22h ago) Software declared up time : 00:01:40 (4d22h ago) CPLD version : 07091401 Firmware version : 12.2(33r)XNB Sub-slot: 0/0, SPA-5X1GE-V2 Operational status : ok Internal state : inserted Physical insert detect time : 00:00:36 (4d22h ago) Logical insert detect time : 00:02:23 (4d22h ago) Sub-slot: 0/1, SPA-2XT3/E3 Operational status : ok Internal state : inserted diag Displays diagnostic and debug information for the platform components. Release Modification Cisco IOS XE Release 2.2 This command was introduced on the Cisco ASR 1000 Series Aggregation Services Routers. show platform diag CF-881 Cisco IOS Configuration Fundamentals Command Reference April 2010 Physical insert detect time : 00:00:36 (4d22h ago) Logical insert detect time : 00:02:23 (4d22h ago) Slot: R0, ASR1000-RP1 Running state : ok Internal state : online Internal operational state : ok Physical insert detect time : 00:00:48 (4d22h ago) Software declared up time : 00:00:48 (4d22h ago) CPLD version : 07062111 Firmware version : 12.2(33r)XNB Sub-slot: R0/0, Running state : ok, active Logical insert detect time : 00:00:48 (4d22h ago) Became HA Active time : 00:04:56 (4d22h ago) Sub-slot: R0/1, Running state : ok, standby Logical insert detect time : 00:02:50 (4d22h ago) Slot: F0, ASR1000-ESP10 Running state : ok, active Internal state : online Internal operational state : ok Physical insert detect time : 00:00:48 (4d22h ago) Software declared up time : 00:01:40 (4d22h ago) Hardware ready signal time : 00:00:49 (4d22h ago) Packet ready signal time : 00:01:49 (4d22h ago) CPLD version : 07051680 Firmware version : 12.2(33r)XNB Slot: P0, ASR1004-PWR-AC State : ok Physical insert detect time : 00:01:40 (4d22h ago) Slot: P1, ASR1004-PWR-AC State : ok Physical insert detect time : 00:01:40 (4d22h ago) Table 131 describes the significant fields shown in the display. Table 131 show platform diag Field Descriptions Field Description Running state The current online running state of the FRU component. Internal state The internal debug state of the FRU component for diagnostic purposes. Internal operational state The internal operational state of the FRU component for diagnostic purposes. Physical insert detect time The time of the most recent physical insertion of the FRU component detected by the platform code. Software declared up time The time that the software on the FRU component was declared running by the platform code. Hardware ready signal time The time that the hardware ready signal was detected by the platform code. show platform diag CF-882 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Packet ready signal time The time that the Embedded Service Processor (ESP) packet ready signal was detected by the platform code. CPLD version The Complex Programmable Logic Device version number. Firmware version The Firmware (ROMmon) version number. Logical insert detect time The time that the SPA was logically detected by the platform code. Became HA Active time The time that this FRU became High Availability (HA) active status. Table 131 show platform diag Field Descriptions (continued) Field Description Command Description show platform Displays platform information. show platform hardware Displays platform hardware information. show platform software Displays platform software information show platform hardware capacity CF-883 Cisco IOS Configuration Fundamentals Command Reference April 2010 show platform hardware capacity To display the capacities and utilizations for the hardware resources, use the show platform hardware capacity command in privileged EXEC mode. show platform hardware capacity [resource-type] Syntax Description Defaults This command has no default settings. Command Modes Privileged EXEC Command History Usage Guidelines The valid values for resource-type are as follows: • acl—Displays the capacities and utilizations for ACL/QoS TCAM resources. • cpu—Displays the capacities and utilizations for CPU resources. • eobc—Displays the capacities and utilizations for Ethernet out-of-band channel resources. • fabric—Displays the capacities and utilizations for Switch Fabric resources. • flash—Displays the capacities and utilizations for Flash/NVRAM resources. • forwarding—Displays the capacities and utilizations for Layer 2 and Layer 3 forwarding resources. • ibc—Displays the capacities and utilizations for interboard communication resources. • interface—Displays the capacities and utilizations for interface resources. • monitor—Displays the capacities and utilizations for SPAN resources. • multicast—Displays the capacities and utilizations for Layer 3 multicast resources. • netflow—Displays the capacities and utilizations for NetFlow resources. • pfc—Displays the capacities and utilizations for all the PFC resources including Layer 2 and Layer 3 forwarding, NetFlow, CPU rate limiters, and ACL/QoS TCAM resources. • power—Displays the capacities and utilizations for power resources. • qos—Displays the capacities and utilizations for QoS policer resources. • rate-limiter—Displays the capacities and utilizations for CPU rate limiter resources. resource-type (Optional) Hardware resource type; see the “Usage Guidelines” section for the valid values. Release Modification 12.2(18)SXF Support for this command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show platform hardware capacity CF-884 Cisco IOS Configuration Fundamentals Command Reference April 2010 • rewrite-engine—Displays the packet drop and performance counters of the central rewrite engine on supervisors and line cards. For detailed information, see the show platform hardware capacity rewrite-engine command documentation. • system—Displays the capacities and utilizations for system resources. • vlan—Displays the capacities and utilizations for VLAN resources. The show platform hardware capacity cpu command displays the following information: • CPU utilization for the last 5 seconds (busy time and interrupt time), the percentage of the last 1-minute average busy time, and the percentage of the last 5-minute average busy time. • Processor memory total available bytes, used bytes, and percentage used. • I/O memory total available bytes, used bytes, and percentage used. The show platform hardware capacity eobc command displays the following information: • Transmit and receive rate • Packets received and packets sent • Dropped received packets and dropped transmitted packets The show platform hardware capacity forwarding command displays the following information: • The total available entries, used entries, and used percentage for the MAC tables. • The total available entries, used entries, and used percentage for the FIB TCAM tables. The display is done per protocol base. • The total available entries, used entries, and used percentage for the adjacency tables. The display is done for each region in which the adjacency table is divided. • The created entries, failures, and resource usage percentage for the NetFlow TCAM and ICAM tables. • The total available entries and mask, used entries and mask, reserved entries and mask, and entries and mask used percentage for the ACL/QoS TCAM tables. The output displays the available, used, reserved, and used percentage of the labels. The output displays the resource of other hardware resources that are related to the ACL/QoS TCAMs (such as available, used, reserved, and used percentage of the LOU, ANDOR, and ORAND). • The available, used, reserved, and used percentage for the CPU rate limiters. The show platform hardware capacity interface command displays the following information: • Tx/Rx drops—Displays the sum of transmit and receive drop counters on each online module (aggregate for all ports) and provides the port number that has the highest drop count on the module. • Tx/Rx per port buffer size—Summarizes the port-buffer size on a per-module basis for modules where there is a consistent buffer size across the module. The show platform hardware capacity monitor command displays the following SPAN information: • The maximum local SPAN sessions, maximum RSPAN sessions, maximum ERSPAN sessions, and maximum service module sessions. • The local SPAN sessions used/available, RSPAN sessions used/available, ERSPAN sessions used/available, and service module sessions used/available. The show platform hardware capacity multicast command displays the following information: • Multicast Replication Mode: ingress and egress IPv4 and IPv6 modes. • The MET table usage that indicates the total used and the percentage used for each module in the system. show platform hardware capacity CF-885 Cisco IOS Configuration Fundamentals Command Reference April 2010 • The bidirectional PIM DF table usage that indicates the total used and the percentage used. The show platform hardware capacity system command displays the following information: • PFC operating mode (PFC Version: PFC3A, PFC3B, unknown, and so forth) • Supervisor redundancy mode (RPR, RPR+, SSO, none, and so forth) • Module-specific switching information, including the following information: – Part number (WS-SUP720-BASE, WS-X6548-RJ-45, and so forth) – Series (supervisor engine, fabric, CEF720, CEF256, dCEF256, or classic) – CEF Mode (central CEF, dCEF) The show platform hardware capacity vlan command displays the following VLAN information: • Total VLANs • VTP VLANs that are used • External VLANs that are used • Internal VLANs that are used • Free VLANs Examples This example shows how to display CPU capacity and utilization information for the route processor, the switch processor, and the LAN module in the Cisco 7600 series router: Router# show platform hardware capacity cpu CPU Resources CPU utilization: Module 5 seconds 1 minute 5 minutes 1 RP 0% / 0% 1% 1% 1 SP 5% / 0% 5% 4% 7 69% / 0% 69% 69% 8 78% / 0% 74% 74% Processor memory: Module Bytes: Total Used %Used 1 RP 176730048 51774704 29% 1 SP 192825092 51978936 27% 7 195111584 35769704 18% 8 195111584 35798632 18% I/O memory: Module Bytes: Total Used %Used 1 RP 35651584 12226672 34% 1 SP 35651584 9747952 27% 7 35651584 9616816 27% 8 35651584 9616816 27% Router# This example shows how to display EOBC-related statistics for the route processor, the switch processor, and the DFCs in the Cisco 7600 series router: Router# show platform hardware capacity eobc EOBC Resources Module Packets/sec Total packets Dropped packets 1 RP Rx: 61 108982 0 Tx: 37 77298 0 1 SP Rx: 34 101627 0 Tx: 39 115417 0 7 Rx: 5 10358 0 Tx: 8 18543 0 8 Rx: 5 12130 0 Tx: 10 20317 0 show platform hardware capacity CF-886 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router# This example shows how to display the current and peak switching utilization: Router# show platform hardware capacity fabric Switch Fabric Resources Bus utilization: current is 100%, peak was 100% at 12:34 12mar45 Fabric utilization: ingress egress Module channel speed current peak current peak 1 0 20G 100% 100% 12:34 12mar45 100% 100% 12:34 12mar45 1 1 20G 12% 80% 12:34 12mar45 12% 80% 12:34 12mar45 4 0 20G 12% 80% 12:34 12mar45 12% 80% 12:34 12mar45 13 0 8G 12% 80% 12:34 12mar45 12% 80% 12:34 12mar45 Router# This example shows how to display information about the total capacity, the bytes used, and the percentage that is used for the Flash/NVRAM resources present in the system: Router# show platform hardware capacity flash Flash/NVRAM Resources Usage: Module Device Bytes: Total Used %Used 1 RP bootflash: 31981568 15688048 49% 1 SP disk0: 128577536 105621504 82% 1 SP sup-bootflash: 31981568 29700644 93% 1 SP const_nvram: 129004 856 1% 1 SP nvram: 391160 22065 6% 7 dfc#7-bootflash: 15204352 616540 4% 8 dfc#8-bootflash: 15204352 0 0% Router# This example shows how to display the capacity and utilization of the EARLs present in the system: Router# show platform hardware capacity forwarding L2 Forwarding Resources MAC Table usage: Module Collisions Total Used %Used 6 0 65536 11 1% VPN CAM usage: Total Used %Used 512 0 0% L3 Forwarding Resources FIB TCAM usage: Total Used %Used 72 bits (IPv4, MPLS, EoM) 196608 36 1% 144 bits (IP mcast, IPv6) 32768 7 1% detail: Protocol Used %Used IPv4 36 1% MPLS 0 0% EoM 0 0% IPv6 4 1% IPv4 mcast 3 1% IPv6 mcast 0 0% Adjacency usage: Total Used %Used 1048576 175 1% Forwarding engine load: Module pps peak-pps peak-time 6 8 1972 02:02:17 UTC Thu Apr 21 2005 show platform hardware capacity CF-887 Cisco IOS Configuration Fundamentals Command Reference April 2010 Netflow Resources TCAM utilization: Module Created Failed %Used 6 1 0 0% ICAM utilization: Module Created Failed %Used 6 0 0 0% Flowmasks: Mask# Type Features IPv4: 0 reserved none IPv4: 1 Intf FulNAT_INGRESS NAT_EGRESS FM_GUARDIAN IPv4: 2 unused none IPv4: 3 reserved none IPv6: 0 reserved none IPv6: 1 unused none IPv6: 2 unused none IPv6: 3 reserved none CPU Rate Limiters Resources Rate limiters: Total Used Reserved %Used Layer 3 9 4 1 44% Layer 2 4 2 2 50% ACL/QoS TCAM Resources Key: ACLent - ACL TCAM entries, ACLmsk - ACL TCAM masks, AND - ANDOR, QoSent - QoS TCAM entries, QOSmsk - QoS TCAM masks, OR - ORAND, Lbl-in - ingress label, Lbl-eg - egress label, LOUsrc - LOU source, LOUdst - LOU destination, ADJ - ACL adjacency Module ACLent ACLmsk QoSent QoSmsk Lbl-in Lbl-eg LOUsrc LOUdst AND OR ADJ 6 1% 1% 1% 1% 1% 1% 0% 0% 0% 0% 1% Router# This example shows how to display the interface resources: Router# show platform hardware capacity interface Interface Resources Interface drops: Module Total drops: Tx Rx Highest drop port: Tx Rx 9 0 2 0 48 Interface buffer sizes: Module Bytes: Tx buffer Rx buffer 1 12345 12345 5 12345 12345 Router# This example shows how to display SPAN information: Router# show platform hardware capacity monitor SPAN Resources Source sessions: 2 maximum, 0 used Type Used Local 0 RSPAN source 0 ERSPAN source 0 Service module 0 Destination sessions: 64 maximum, 0 used Type Used RSPAN destination 0 ERSPAN destination (max 24) 0 Router# show platform hardware capacity CF-888 Cisco IOS Configuration Fundamentals Command Reference April 2010 This example shows how to display the capacity and utilization of resources for Layer 3 multicast functionality: Router# show platform hardware capacity multicast L3 Multicast Resources IPv4 replication mode: ingress IPv6 replication mode: ingress Bi-directional PIM Designated Forwarder Table usage: 4 total, 0 (0%) used Replication capability: Module IPv4 IPv6 5 egress egress 9 ingress ingress MET table Entries: Module Total Used %Used 5 65526 6 0% Router# This example shows how to display information about the system power capacities and utilizations: Router# show platform hardware capacity power Power Resources Power supply redundancy mode: administratively combined operationally combined System power: 1922W, 0W (0%) inline, 1289W (67%) total allocated Powered devices: 0 total Router# This example shows how to display the capacity and utilization of QoS policer resources per EARL in the Cisco 7600 series router: Router# show platform hardware capacity qos QoS Policer Resources Aggregate policers: Module Total Used %Used 1 1024 102 10% 5 1024 1 1% Microflow policer configurations: Module Total Used %Used 1 64 32 50% 5 64 1 1% Router# This example shows how to display information about the key system resources: Router# show platform hardware capacity system System Resources PFC operating mode: PFC3BXL Supervisor redundancy mode: administratively rpr-plus, operationally rpr-plus Switching Resources: Module Part number Series CEF mode 5 WS-SUP720-BASE supervisor CEF 9 WS-X6548-RJ-45 CEF256 CEF Router# This example shows how to display VLAN information: Router# show platform hardware capacity vlan VLAN Resources VLANs: 4094 total, 10 VTP, 0 extended, 0 internal, 4084 free Router# Related Commands show platform hardware capacity CF-889 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Description show msfc Displays MSFC information. show platform Displays platform information. show platform isg CF-890 Cisco IOS Configuration Fundamentals Command Reference April 2010 show platform isg To display Constellation WAN (CWAN) iEdge Route Processor information, use the show platform isg command in privileged EXEC mode. show platform isg {msi-all | slot {slot-number | all} | vrf {vrf-number | all}} Syntax Description Command Modes Privileged EXEC (#) Command History Examples The following is sample output from the show platform isg vrf all command. The field descriptions are self-explanatory. Router# show platform isg vrf all dbg_stdby_cd_fibobj 35042 dbg_stdby_cd_rem_fibobj 492 dbg_stdby_cd_no_objhdl 1120 dbg_stdby_cd_no_ps 0 dbg_stdby_unpck_vrf_node 1612 dbg_stdby_unpck_pl_hdl 33922 dbg_stdby_unpck_rem_vrf_node 0 Related Commands msi-all Displays CWAN Multiservice Interface (MSI) information. slot Displays active slot session information. slot-number Slot number. all Displays information about all CWAN iEdge slots. vrf Displays CWAN iEdge VPN routing and forwarding (VRF) information. vrf-number VRF ID. all Displays information about all CWAN VRFs. Release Modification 12.2(33)SRC This command was introduced. Command Description show platform Displays platform information. show platform oam CF-891 Cisco IOS Configuration Fundamentals Command Reference April 2010 show platform oam To display Operation, Administration, and Maintenance (OAM) information of a platform, use the show platform oam command in privileged EXEC mode. show platform oam {link-monitor [interface type number] | loopback} Syntax Description Command Modes Privileged EXEC (#) Command History Examples The following is sample output from the show platform oam link-monitor interface GigabitEthernet 1/1 command. The fields are self-explanatory. Router# show platform oam link-monitor interface GigabitEthernet 1/1 Interface Gi1/1: first_poll = 0 symprd_tlv_sent = 0 frmprd_tlv_sent = 0 frm_poll_cnt = 1 frmsec_poll_cnt = 10 rxcrc_poll_cnt = 1 txcrc_poll_cnt = 1 symbol_period_start = 00:00:01.752 prev_rx_error_frames = 2 total_rx_error_frames = 0 error_frame_period_start = 2 total_frame_period_start = 20 prev_error_frame_seconds = 0 total_error_frame_seconds = 0 prev_rx_crc_error_frames = 0 prev_tx_crc_error_frames = 2 total_frm_tlvs = 0 total_frmsec_tlvs = 0 total_symprd_tlvs = 0 total_frmprd_tlvs = 0 Related Commands link-monitor Displays link monitoring information. interface type number (Optional) Displays the interface name and number. loopback Displays information about the loopback ports. Release Modification 12.2(33)SRC This command was introduced. Command Description show platform Displays platform information. show platform redundancy CF-892 Cisco IOS Configuration Fundamentals Command Reference April 2010 show platform redundancy To display platform-specific Constellation WAN (CWAN) redundancy information, use the show platform redundancy command in privileged EXEC mode. show platform redundancy {atm | ccb slot-number cpu-number | cwpa-ce3 | cwpa-ct3 | cwpa-e1 | cwpa-stm1 | cwpa-t1 | frame-relay | hdlc | if-config {slot-number cpu-number [bay-number] | default-retvals} | mlp | multilink-vc | osm-chocx | osm-ct3 | ppp | shadowstate | spa-chocx | spa-ct3 | switchover} Syntax Description Command Modes Privileged EXEC (#) atm Displays CWAN ATM redundancy state information. ccp Displays the CWAN Configuration Control Block (CCB) list. slot-number Slot number. cpu-number CPU number. cwpa-ce3 Displays CWAN port adapter (CWPA) Channelized E3 (CE3) redundancy state information. cwpa-ct3 Displays CWPA-CT3 redundancy state information. cwpa-e1 Displays CWPA-E1 redundancy state information. cwpa-stm1 Displays CWPA Synchronous Transport Module level-1 (STM-1) virtual circuit (VC) information. cwpa-t1 Displays CWPA-T1 redundancy state information. frame-relay Displays CWAN Frame Relay redundancy state information. hdlc Displays CWAN High-Level Data Link Control (HDLC) redundancy state information. if-config Displays the CWAN IF-configuration list. bay-number (Optional) Shared Port Adapter (SPA) bay number. default-retvals Displays default IF-configuration return values. mlp Displays CWAN Multilink Point-to-Point Protocol (MLP) redundancy state information. multilink-vc Displays CWAN Multilink VC information. osm-chocx Displays CWAN Optical Services Module (OSM) Channelized OC-12/OC-3 line card (CHOCX) redundancy state information. osm-ct3 Displays CWAN OSM-CT3 redundancy state information. ppp Displays CWAN PPP redundancy state information. shadowstate Displays the CWAN interface descriptor block (IDB) shadow state. spa-chocx Displays CHOCX SPA VC information. spa-ct3 Displays CT3 SPA VC information. switchover Displays CWAN switchover redundancy information. show platform redundancy CF-893 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command History Examples The following is sample output from the show platform redundancy command with the if-config keyword. The fields are self-explanatory. Router# show platform redundancy if-config 4 0 Current number of elements = 0 Current maximum elements = 128 List was grown = 0 times Number of elements sorted = 0 List errors = 0 List flags = 0x1E Current element pointer = 0x0 List pointer = 0x50A27438 +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | C=Command T=Type P=Port t=timedOut D=Dirty S=Sync | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | C | T | P | key address | t | D | S | value | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ Related Commands Release Modification 12.2(33)SRC This command was introduced. Command Description show platform Displays platform information. show platform software filesystem CF-894 Cisco IOS Configuration Fundamentals Command Reference April 2010 show platform software filesystem To display information about file systems, use the show platform software filesystem command in privileged EXEC or diagnostic mode. show platform software filesystem {bootflash: | stby-bootflash: | fpd: | harddisk: | stby-harddisk: | obfl: | stby-obfl: | usb0: | stby-usb0: | usb1: | stby-usb1:} [all] [details] Syntax Description Command Default No default behavior or values Command Modes Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines Use this command to ascertain the presence or absence of specific files and to determine space usage in the file system. This command is helpful to monitor the growth of log file sizes, because rapid growth of log files could indicate possible problems with the router. bootflash: File system on the bootflash device. stby-bootflash: Standby file system on the bootflash device (if the standby Route Processor [RP] is preset). fpd: Synthetic file system that is used by the field-programmable device (FPD) upgrade process—for Cisco Technical Support only. harddisk: File system on the hard disk device. stby-harddisk: Standby file system on the harddisk device (if the standby RP is preset). obfl: File system on the on board failure logging (OBFL) device. stby-obfl: Standby file system on the OBFL device (if the standby RP is preset). usb0: File system on the USB0 device (if installed). stby-usb0: Standby file system on the USB0 device (if the standby RP is preset). usb1: File system on the USB1 device (if installed). stby-usb1: Standby file system on the USB1 device (if the standby RP is preset). all (Optional) All possible device information. details (Optional) File system details. Release Modification Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR1000 Series Routers. show platform software filesystem CF-895 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example displays information about the files in the bootflash file system. It also shows the number of bytes used out of the total available in the bootflash file system. Router# show platform software filesystem bootflash: -#- --length-- ---------date/time--------- path 1 4096 Apr 01 2008 13:34:30 +00:00 /bootflash/ 2 16384 Dec 04 2007 04:32:46 +00:00 /bootflash/lost+found 3 4096 Dec 04 2007 06:06:24 +00:00 /bootflash/.ssh 4 963 Dec 04 2007 06:06:16 +00:00 /bootflash/.ssh/ssh_host_key 5 627 Dec 04 2007 06:06:16 +00:00 /bootflash/.ssh/ssh_host_key.pub 6 1675 Dec 04 2007 06:06:18 +00:00 /bootflash/.ssh/ssh_host_rsa_key 7 382 Dec 04 2007 06:06:18 +00:00 /bootflash/.ssh/ssh_host_rsa_key.pub 8 668 Dec 04 2007 06:06:24 +00:00 /bootflash/.ssh/ssh_host_dsa_key 9 590 Dec 04 2007 06:06:24 +00:00 /bootflash/.ssh/ssh_host_dsa_key.pub 10 4096 Dec 04 2007 06:06:36 +00:00 /bootflash/.rollback_timer 11 4096 Mar 18 2008 17:31:17 +00:00 /bootflash/.prst_sync 12 4096 Dec 04 2007 04:34:45 +00:00 /bootflash/.installer 13 205951180 Mar 18 2008 17:23:03 +00:00 /bootflash/asr1000rp1-advipservicesk 14 46858444 Mar 18 2008 17:28:55 +00:00 /bootflash/asr1000rp1-espbase.02.01. 15 20318412 Mar 18 2008 17:28:56 +00:00 /bootflash/asr1000rp1-rpaccess-k9.02 16 22266060 Mar 18 2008 17:28:57 +00:00 /bootflash/asr1000rp1-rpbase.02.01.0 17 21659852 Mar 18 2008 17:28:57 +00:00 /bootflash/asr1000rp1-rpcontrol.02.0 18 45934796 Mar 18 2008 17:28:58 +00:00 /bootflash/asr1000rp1-rpios-advipser 19 34169036 Mar 18 2008 17:28:59 +00:00 /bootflash/asr1000rp1-sipbase.02.01. 20 22067404 Mar 18 2008 17:29:00 +00:00 /bootflash/asr1000rp1-sipspa.02.01.0 21 7180 Mar 18 2008 17:29:00 +00:00 /bootflash/packages.conf 461897728 bytes available (419782656 bytes used) The following example displays information only about the bootflash file system itself, such as file system type and access permissions: Router# show platform software filesystem bootflash: details Filesystem: bootflash Filesystem Path: /bootflash Filesystem Type: ext2 Mounted: Read/Write Table 132 describes the significant fields shown in the displays of file system information. Table 132 show platform software filesystem Field Descriptions Field Description # Display line number. Length File size in bytes. Date/Time Date and time the file system was created. Path Full path of a file in the file system. Filesystem Path Root of the file system. Filesystem Type Type of file system. One of the following values: • ext2—Second extended file system. • jffs2—Journaling flash file system, version 2. • vfat—Virtual file allocation table (FAT16 or FAT32). Mounted Access permissions to the file system. show platform software filesystem CF-896 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description show platform software mount Displays the mounted file systems (both physical and virtual) on a shared port adapter (SPA) in a SPA interface processor (SIP), on an Embedded Services Processor (ESP), or on a Route Processor (RP). show platform software tech-support Displays system information or creates a technical support information tar file for Cisco Technical Support. show platform software memory CF-897 Cisco IOS Configuration Fundamentals Command Reference April 2010 show platform software memory To display memory information for the specified process, use the show platform software memory command in privileged EXEC or diagnostic mode. show platform software memory [database | messaging] {chassis-manager slot | cpp-control-process process | cpp-driver process | cpp-ha-server process | cpp-service-process process | forwarding-manager slot | host-manager slot | interface-manager slot | ios slot | logger slot | pluggable-services slot | shell-manager slot} [brief] Syntax Description database (Optional) Displays database memory information for the specified process. messaging (Optional) Displays messaging memory information for specified process. The information displayed is for internal debugging purposes only. chassis-manager slot Displays memory information for the Chassis Manager process in the specified slot. Possible slot values are: • 0—Cisco ASR 1000 Series SPA Interface Processor (SIP) slot 0 • 1—Cisco ASR 1000 Series SIP slot 1 • 2—Cisco ASR 1000 Series SIP slot 2 • f0—Cisco ASR 1000 Series Embedded Services Processor (ESP) slot 0 • f1—Cisco ASR 1000 Series ESP slot 1 • fp active—Active Cisco ASR 1000 Series ESP • fp standby—Standby Cisco ASR 1000 Series ESP • r0—Cisco ASR 1000 Series Route Processor (RP) slot 0 • r1—Cisco ASR 1000 Series RP slot 1 • rp active—Active Cisco ASR 1000 Series RP • rp standby—Standby Cisco ASR 1000 Series RP cpp-control-process Displays memory information for the specified Cisco Packet Processor (CPP) Client Control process. Possible process values are: • cpp active—Active CPP Client Control process • cpp standby—Standby CPP Client Control process The information displayed is for internal debugging purposes only. cpp-driver Displays memory information for the specified CPP Driver process. Possible process values are: • cpp active—Active CPPDriver process • cpp standby—Standby CPP Driver process The information displayed is for internal debugging purposes only. show platform software memory CF-898 Cisco IOS Configuration Fundamentals Command Reference April 2010 cpp-ha-server Displays memory information for the specified CPP High Availability (HA) Server process. Possible process values are: • cpp active—Active CPP HA Server process • cpp standby—Standby CPP HA Server process The information displayed is for internal debugging purposes only. cpp-service-process Displays memory information for the specified CPP Client Service process. Possible process values are: • cpp active—Active CPP Client Service process • cpp standby—Standby CPP Client Service process The information displayed is for internal debugging purposes only. forwarding-manager slot Displays memory information for the Forwarding Manager process in the specified slot. Possible slot values are: • f0—Cisco ASR 1000 Series ESP slot 0 • f1—Cisco ASR 1000 Series ESP slot 1 • fp active—Active Cisco ASR 1000 Series ESP • fp standby—Standby Cisco ASR 1000 Series ESP • r0—Cisco ASR 1000 Series RP slot 0 • r1—Cisco ASR 1000 Series RP slot 1 • rp active—Active Cisco ASR 1000 Series RP • rp standby—Standby Cisco ASR 1000 Series RP host-manager slot Displays memory information for the Host Manager process in the specified slot. Possible slot values are: • 0—Cisco ASR 1000 Series SIP slot 0 • 1—Cisco ASR 1000 Series SIP slot 1 • 2—Cisco ASR 1000 Series SIP slot 2 • f0—Cisco ASR 1000 Series ESP slot 0 • f1—Cisco ASR 1000 Series ESP slot 1 • fp active—Active Cisco ASR 1000 Series ESP • fp standby—Standby Cisco ASR 1000 Series ESP • r0—Cisco ASR 1000 Series RP slot 0 • r1—Cisco ASR 1000 Series RP slot 1 • rp active—Active Cisco ASR 1000 Series RP • rp standby—Standby Cisco ASR 1000 Series RP show platform software memory CF-899 Cisco IOS Configuration Fundamentals Command Reference April 2010 interface-manager slot Displays memory information for the Interface Manager process in the specified slot. Possible slot values are: • 0—Cisco ASR 1000 Series SIP slot 0 • 1—Cisco ASR 1000 Series SIP slot 1 • 2— Cisco ASR 1000 Series SIP slot 2 • r0—Cisco ASR 1000 Series RP slot 0 • r1—Cisco ASR 1000 Series RP slot 1 • rp active—Active Cisco ASR 1000 Series RP • rp standby—Standby Cisco ASR 1000 Series RP ios slot Displays memory information for the IOS process in the specified slot. Possible slot values are: • 0/0—Cisco ASR 1000 Series SIP slot 0, bay 0 • 0/1—Cisco ASR 1000 Series SIP slot 0, bay 1 • 0/2—Cisco ASR 1000 Series SIP slot 0, bay 2 • 0/3—Cisco ASR 1000 Series SIP slot 0, bay 3 • 1/0—Cisco ASR 1000 Series SIP slot 1, bay 0 • 1/1—Cisco ASR 1000 Series SIP slot 1, bay 1 • 1/2—Cisco ASR 1000 Series SIP slot 1, bay 2 • 1/3—Cisco ASR 1000 Series SIP slot 1, bay 3 • 2/0—Cisco ASR 1000 Series SIP slot 2, bay 0 • 2/1—Cisco ASR 1000 Series SIP slot 2, bay 1 • 2/2—Cisco ASR 1000 Series SIP slot 2, bay 2 • 2/3—Cisco ASR 1000 Series SIP slot 2, bay 3 • r0—Cisco ASR 1000 Series RP slot 0 • r1—Cisco ASR 1000 Series RP slot 1 • rp active—Active Cisco ASR 1000 Series RP • rp standby—Standby Cisco ASR 1000 Series RP show platform software memory CF-900 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Default No default behavior or values. Command Modes Privileged EXEC (#) Diagnostic (diag) Command History logger slot Displays memory information for the logger process in the specified slot. Possible slot values are: • 0—Cisco ASR 1000 Series SIP slot 0 • 1—Cisco ASR 1000 Series SIP slot 1 • 2—Cisco ASR 1000 Series SIP slot 2 • f0—Cisco ASR 1000 Series ESP slot 0 • f1—Cisco ASR 1000 Series ESP slot 1 • fp active—Active Cisco ASR 1000 Series ESP • fp standby—Standby Cisco ASR 1000 Series ESP • r0—Cisco ASR 1000 Series RP slot 0 • r1—Cisco ASR 1000 Series RP slot 1 • rp active—Active Cisco ASR 1000 Series RP • rp standby—Standby Cisco ASR 1000 Series RP pluggable-services slot Displays memory information for the pluggable-services process in the specified slot. Possible slot values are: • r0—Cisco ASR 1000 Series RP slot 0 • r1—Cisco ASR 1000 Series RP slot 1 • rp active—Active Cisco ASR 1000 Series RP • rp standby—Standby Cisco ASR 1000 Series RP shell-manager slot Displays memory information for the Shell Manager process in the specified slot. Possible slot values are: • r0—Cisco ASR 1000 Series RP slot 0 • r1—Cisco ASR 1000 Series RP slot 1 • rp active—Active Cisco ASR 1000 Series RP • rp standby—Standby Cisco ASR 1000 Series RP brief (Optional) Displays abbreviated memory information for the specified process. Release Modification Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Routers. show platform software memory CF-901 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines The specification of the database and brief keywords are optional. The specification of a process and slot are required. Examples The following example displays memory information for the Forwarding Manager process for Cisco ASR 1000 Series RP slot 0: Router# show platform software memory forwarding-manager r0 Module: cdllib allocated: 900, requested: 892, overhead: 8 Allocations: 2, failed: 0, frees: 1 Module: eventutil allocated: 117379, requested: 117059, overhead: 320 Allocations: 46, failed: 0, frees: 6 Module: uipeer allocated: 9264, requested: 9248, overhead: 16 Allocations: 3, failed: 0, frees: 1 Module: Summary allocated: 127543, requested: 127199, overhead: 344 Allocations: 51, failed: 0, frees: 8 Table 133 describes the significant fields shown in the display. The following example displays abbreviated (brief keyword) memory information for the Chassis Manager process for Cisco ASR 1000 Series ESP slot 0: Router# show platform software memory chassis-manager f0 brief module allocated requested allocs frees ------------------------------------------------------------------------ CPP Features 692 668 3 0 Summary 497816 495344 323 14 chunk 419322 419290 4 0 eventutil 68546 66146 312 12 uipeer 9256 9240 4 2 Table 133 show platform software memory Field Descriptions Field Description Module: Name of submodule. allocated: Memory, allocated in bytes. requested: Number of bytes requested by application. overhead: Allocation overhead. Allocations: Number of discrete allocation event attempts. failed: Number of allocation attempts that were attempted, but failed. frees: Number of free events. show platform software memory CF-902 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 134 describes the significant fields shown in the brief keyword display. Table 134 show platform software memory brief Field Descriptions Field Description module Name of submodule. allocated Memory, allocated in bytes. requested Number of bytes requested by application. allocs Number of discrete allocation event attempts. frees Number of free events. show platform software mount CF-903 Cisco IOS Configuration Fundamentals Command Reference April 2010 show platform software mount To display the mounted file systems, both physical and virtual, for a Cisco ASR 1000 Series SPA Interface Processor (SIP), Cisco ASR 1000 Series Embedded Services Processor (ESP), or Cisco ASR 1000 Series Route Processor (RP), use the show platform software mount command in privileged EXEC or diagnostic mode. show platform software mount [slot [brief]] Syntax Description Command Default No default behavior or values. Command Modes Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines If no slot is specified, the command returns mounted file systems for the active RP. This command allows you to ascertain the presence or absence of specific system mounts. For example, this command might be used to determine /tmp-related mounts, which are used to create many run-time directories and files. slot (Optional) Displays mounted file systems for the specified slot. Possible slot values are: • 0—Cisco ASR 1000 Series SIP slot 0 • 1—Cisco ASR 1000 Series SIP slot 1 • 2—Cisco ASR 1000 Series SIP slot 2 • f0—Cisco ASR 1000 Series ESP slot 0 • f1—Cisco ASR 1000 Series ESP slot 1 • fp active—Active Cisco ASR 1000 Series ESP • fp standby—Standby Cisco ASR 1000 Series ESP • r0—Cisco ASR 1000 Series RP slot 0 • r1—Cisco ASR 1000 Series RP slot 1 • rp active—Active Cisco ASR 1000 Series RP • rp standby—Standby Cisco ASR 1000 Series RP brief (Optional) Displays abbreviated mounted file system information. Release Modification Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Routers. show platform software mount CF-904 Cisco IOS Configuration Fundamentals Command Reference April 2010 Users may be requested to execute this command to collect information about the underlying configuration of the platform software. The RP output can differ depending on how the router was booted, and whether there are USB devices inserted. The SIP and ESP output can differ depending on whether the chassis is a dual or single RP. Examples The following example displays mounted file systems for the active RP: Router# show platform software mount Filesystem Used Available Use% Mounted on rootfs 0 0 - / proc 0 0 - /proc sysfs 0 0 - /sys none 524 1037640 1% /dev /dev/bootflash1 298263 42410 88% /bootflash /dev/harddisk1 609208 4025132 14% /misc/scratch /dev/loop1 28010 0 100% /tmp/sw/mount/2007-10-14_... /dev/loop2 26920 0 100% /tmp/sw/mount/2007-10-14_... /dev/loop3 48236 0 100% /tmp/sw/mount/2007-10-14_... /dev/loop4 6134 0 100% /tmp/sw/mount/2007-10-14_... /dev/loop5 43386 0 100% /tmp/sw/mount/2007-10-14_... /dev/loop6 30498 0 100% /tmp/sw/mount/2007-10-14_... /dev/loop7 14082 0 100% /tmp/sw/mount/2007-10-14_... none 524 1037640 1% /dev /proc/bus/usb 0 0 - /proc/bus/usb /dev/mtdblock1 460 1588 23% /obfl automount(pid4165) 0 0 - /vol The following example displays mounted file systems for the Cisco ASR 1000 Series ESP in ESP slot 0: Router# show platform software mount f0 Filesystem Used Available Use% Mounted on rootfs 0 0 - / proc 0 0 - /proc sysfs 0 0 - /sys none 10864 507124 3% /dev /dev/loop1 41418 0 100% /tmp/sw/fp/0/0/fp/mount none 10864 507124 3% /dev /proc/bus/usb 0 0 - /proc/bus/usb /dev/mtdblock1 504 1544 25% /obfl automount(pid3210) 0 0 - /misc1 The following example displays mounted file systems for the active Cisco ASR 1000 Series RP: Router# show platform software mount rp active Filesystem Used Available Use% Mounted on rootfs 0 0 - / proc 0 0 - /proc sysfs 0 0 - /sys none 436 1037728 1% /dev /dev/bootflash1 256809 83864 76% /bootflash /dev/harddisk1 252112 4382228 6% /misc/scratch /dev/loop1 30348 0 100% /tmp/sw/mount/2007-09-27_... /dev/loop2 28394 0 100% /tmp/sw/mount/2007-09-27_... /dev/loop3 42062 0 100% /tmp/sw/mount/2007-09-27_... /dev/loop4 8384 0 100% /tmp/sw/mount/2007-09-27_... /dev/loop5 41418 0 100% /tmp/sw/mount/2007-09-27_... /dev/loop6 21612 0 100% /tmp/sw/mount/2007-09-27_... /dev/loop7 16200 0 100% /tmp/sw/mount/2007-09-27_... none 436 1037728 1% /dev /proc/bus/usb 0 0 - /proc/bus/usb show platform software mount CF-905 Cisco IOS Configuration Fundamentals Command Reference April 2010 /dev/mtdblock1 484 1564 24% /obfl automount(pid4004) 0 0 - /vol Table 135 describes the significant fields shown in the SIP slot (0, 1, or 2) displays. The following example displays abbreviated (brief keyword) mounted file system information for Cisco ASR 1000 Series SIP slot 0: Router# show platform software mount 0 brief Mount point: rootfs Type : rootfs Location : / Options : rw Mount point: proc Type : proc Location : /proc Options : rw Mount point: sysfs Type : sysfs Location : /sys Options : rw Mount point: none Type : tmpfs Location : /dev Options : rw Mount point: /dev/loop1 Type : iso9660 Location : /tmp/sw/cc/0/0/cc/mount Options : ro Mount point: none Type : tmpfs Location : /dev Options : rw Mount point: /proc/bus/usb Type : usbfs Location : /proc/bus/usb Options : rw Mount point: /dev/mtdblock1 Type : jffs2 Location : /obfl Options : rw,noatime,nodiratime Table 135 show platform software mount SIP slot Field Descriptions Field Description Filesystem Logical name of the file system device. Used Number of 1Kb blocks used. Available Number of free 1Kb blocks available. Use% Percentage of 1Kb blocks used of the total available. Mounted on Canonical path to the mounted file system. show platform software mount CF-906 Cisco IOS Configuration Fundamentals Command Reference April 2010 Mount point: automount(pid3199) Type : autofs Location : /misc1 Options : rw,fd=5,pgrp=3199,timeout=60,minproto=2,maxproto=4,indirect Table 136 describes the significant fields shown in the brief keyword display. Table 136 show platform software mount brief Field Descriptions Field Description Mount point: Logical name of the file system device. Type: File system type. Location: Canonical path to the mounted file system. Options: Mount point type-specific flags and settings. show platform software process list CF-907 Cisco IOS Configuration Fundamentals Command Reference April 2010 show platform software process list To display a list of the processes running in a given slot, use the show platform software process list command in privileged EXEC or diagnostic mode. show platform software process list slot [name process-name | process-id process-id | summary] Syntax Description Command Default No default behavior or values. Command Modes Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines The name and process-id keywords can be used to narrow the process list display down to specific processes. The summary keyword can be used to display summary information about running processes. slot Displays running process information for the specified slot. Possible slot values are: • 0—Cisco ASR 1000 Series SPA Interface Processor (SIP) slot 0 • 1—Cisco ASR 1000 Series SIP slot 1 • 2—Cisco ASR 1000 Series SIP slot 2 • f0—Cisco ASR 1000 Series Embedded Services Processor (ESP) slot 0 • f1—Cisco ASR 1000 Series ESP slot 1 • fp active—Active Cisco ASR 1000 Series ESP • fp standby—Standby Cisco ASR 1000 Series ESP • r0—Cisco ASR 1000 Series Route Processor (RP) slot 0 • r1—Cisco ASR 1000 Series RP slot 1 • rp active—Active Cisco ASR 1000 Series RP • rp standby—Standby Cisco ASR 1000 Series RP name process-name (Optional) Displays information for the specified process name. process-id process-id (Optional) Displays information for the specified process ID. summary (Optional) Displays summary process information for the running host. Release Modification Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Routers. show platform software process list CF-908 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example displays information about running processes for Cisco ASR 1000 Series SIP slot 0: Router# show platform software process list 0 Name Pid PPid Group Id Status Priority Size ------------------------------------------------------------------------------ init 1 0 1 S 20 1974272 ksoftirqd/0 2 1 1 S 39 0 events/0 3 1 1 S 15 0 khelper 4 1 1 S 15 0 kthread 5 1 1 S 15 0 kblockd/0 19 5 1 S 15 0 khubd 23 5 1 S 15 0 pdflush 59 5 1 S 20 0 pdflush 60 5 1 S 20 0 kswapd0 61 5 1 S 15 0 aio/0 62 5 1 S 15 0 xfslogd/0 63 5 1 S 15 0 xfsdatad/0 64 5 1 S 15 0 mtdblockd 626 1 1 S 20 0 loop0 1370 1 1 S 0 0 portmap 1404 1 1404 S 20 2076672 portmap 1406 1 1406 S 20 2076672 loop1 1440 1 1 S 0 0 udevd 2104 1 2104 S 16 1974272 jffs2_gcd_mtd1 2796 1 1 S 30 0 klogd 3093 1 3093 S 20 1728512 automount 3199 1 3199 S 20 2396160 xinetd 3214 1 3214 S 20 3026944 xinetd 3216 1 3216 S 20 3026944 pvp.sh 3540 1 3540 S 20 3678208 inotifywait 3575 3540 3575 S 20 1900544 pman.sh 3614 3540 3614 S 20 3571712 pman.sh 3714 3540 3714 S 20 3571712 btrace_rotate.s 3721 3614 3721 S 20 3133440 agetty 3822 1 3822 S 20 1720320 mcp_chvrf.sh 3823 1 3823 S 20 2990080 sntp 3824 1 3824 S 20 2625536 issu_switchover 3825 1 3825 S 20 3899392 xinetd 3827 3823 3823 S 20 3026944 cmcc 3862 3714 3862 S 20 26710016 pman.sh 3883 3540 3883 S 20 3571712 pman.sh 4014 3540 4014 S 20 3575808 hman 4020 3883 4020 R 20 19615744 imccd 4114 4014 4114 S 20 31539200 inotifywait 4196 3825 3825 S 20 1896448 pman.sh 4351 3540 4351 S 20 3575808 plogd 4492 4351 4492 S 20 22663168 inotifywait 4604 3721 4604 S 20 1900544 Table 137 describes the significant fields shown in the display. Table 137 show platform software process list Field Descriptions Field Description Name Name of the process. Pid Process ID. PPid Parent Process ID. Group Id Process group ID. show platform software process list CF-909 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following example displays information about a specific named process for Cisco ASR 1000 Series SIP slot 0: Router# show platform software process list 0 name sleep Name: sleep Process id : 25938 Parent process id: 3891 Group id : 3891 Status : S Session id : 3816 User time : 0 Kernel time : 0 Priority : 20 Virtual bytes : 2482176 Resident pages : 119 Resident limit : 4294967295 Minor page faults: 182 Major page faults: 0 The following example displays information about a specific process identifier for Cisco ASR 1000 Series SIP slot 0: Router# show platform software process list 0 process-id 1 Name: init Process id : 1 Parent process id: 0 Group id : 1 Status : S Session id : 1 User time : 1 Kernel time : 741 Priority : 20 Virtual bytes : 1974272 Resident pages : 161 Resident limit : 4294967295 Minor page faults: 756 Major page faults: 0 Table 138 describes the significant fields shown in the name and process-id keyword displays. Status Process status. Priority Process priority. Size Virtual memory size (in bytes). Table 137 show platform software process list Field Descriptions (continued) Field Description Table 138 show platform software process list name and process-id Field Descriptions Field Description Name Name of the process. Process id Process ID. Parent process id Parent process ID. Group id Process group ID. Status Process status. show platform software process list CF-910 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following example displays process summary information for Cisco ASR 1000 Series SIP slot 0: Router# show platform software process list 0 summary Total number of processes: 54 Running : 4 Sleeping : 50 Disk sleeping : 0 Zombies : 0 Stopped : 0 Paging : 0 Up time : 1562 Idle time : 1511 User time : 1606 Kernel time : 1319 Virtual memory : 587894784 Pages resident : 45436 Major page faults: 25 Minor page faults: 149098 Architecture : ppc Memory (kB) Physical : 524288 Total : 479868 Used : 434948 Free : 44920 Active : 183020 Inactive : 163268 Inact-dirty : 0 Inact-clean : 0 Dirty : 0 AnonPages : 76380 Bounce : 0 Cached : 263764 Commit Limit : 239932 Committed As : 201452 High Total : 0 High Free : 0 Low Total : 479868 Low Free : 44920 Mapped : 59996 NFS Unstable : 0 Page Tables : 1524 Session id Process session ID. User time Time (in seconds) spent in user mode. Kernel time Time (in seconds) spent in kernel mode. Priority Process priority. Virtual bytes Virtual memory size (in bytes). Resident pages Resident page size. Resident limit Current limit on Resident pages. Minor page faults Number of minor page faults. Major page faults Number of major page faults. Table 138 show platform software process list name and process-id Field Descriptions (continued) Field Description show platform software process list CF-911 Cisco IOS Configuration Fundamentals Command Reference April 2010 Slab : 73760 VMmalloc Chunk : 426840 VMmalloc Total : 474856 VMmalloc Used : 47372 Writeback : 0 Swap (kB) Total : 0 Used : 0 Free : 0 Cached : 0 Buffers (kB) : 6144 Load Average 1-Min : 0.00 5-Min : 0.00 15-Min : 0.00 Table 139 describes the significant fields shown in the summary keyword display. Table 139 show platform software process list summary Field Descriptions Field Description Total number of processes Total number of processes in all possible states. Running Number of processes in the running state. Sleeping Number of processes in the sleeping state. Disk sleeping Number of processes in the disk-sleeping state. Zombies Number of processes in the zombie state. Stopped Number of processes in the stopped state. Paging Number of processes in the paging state. Up time System Up time (in seconds). Idle time System Idle time (in seconds). User time System time (in seconds) spent in user mode. Kernel time System time (in seconds) spent in kernel mode. Virtual memory Virtual memory size (in bytes). Pages resident Resident page size. Major page faults Number of major page faults. Minor page faults Number of minor page faults. Architecture System CPU architecture: PowerPC (ppc). Memory (kB) System memory heading. Physical Total physical memory (in kilobytes). Total Total available memory (in kilobytes). This value represents the physical memory available for kernel use. Used Used memory (in kilobytes). Free Free memory (in kilobytes). Active Most recently used memory (in kilobytes). show platform software process list CF-912 Cisco IOS Configuration Fundamentals Command Reference April 2010 Inactive Memory (in kilobytes) that has been less recently used. It is more eligible to be reclaimed for other purposes. Inact-dirty Memory (in kilobytes) that may need to be written to persistent store (cache or disk). Inact-clean Memory (in kilobytes) that is readily available for re-use. Dirty Memory (in kilobytes) that is waiting to get written back to the disk. AnonPages Memory (in kilobytes) that is allocated when a process requests memory from the kernel via the malloc() system call. This memory has no file backing on disk. Bounce Memory (in kilobytes) that is allocated to bounce buffers. Cached Amount of physical RAM (in kilobytes) used as cache memory. Commit Limit Total amount of memory (in kilobytes) currently available to be allocated on the system. This limit is only adhered to if strict overcommit accounting is enabled. Committed As Total amount of memory (in kilobytes) presently allocated on the system. The committed memory is a sum of all of the memory that has been allocated by processes, even if it has not been used by them as of yet. High Total Total amount of memory (in kilobytes) that is not directly mapped into kernel space. The High Total value can vary based on the type of kernel used. High Free Amount of free memory (in kilobytes) that is not directly mapped into kernel space. The High Free value can vary based on the type of kernel used. Low Total Total amount of memory (in kilobytes) that is directly mapped into kernel space. The Low Total value can vary based on the type of kernel used. Low Free Amount of free memory (in kilobytes) that is directly mapped into kernel space. The Low Free value can vary based on the type of kernel used. Mapped Total amount of memory (in kilobytes) that has been used to map devices, files, or libraries using the mmap command. NFS Unstable Total amount of memory (in kilobytes) used for unstable NFS pages. Unstable NFS pages are pages that have been written into the page cache on the server, but have not yet been synchronized to disk. Page Tables Total amount of memory (in kilobytes) dedicated to the lowest page table level. Slab Total amount of memory (in kilobytes) used by the kernel to cache data structures for its own use. Table 139 show platform software process list summary Field Descriptions (continued) Field Description show platform software process list CF-913 Cisco IOS Configuration Fundamentals Command Reference April 2010 VMalloc Chunk Largest contiguous block of available virtual address space (in kilobytes) that is free. VMalloc Total Total amount of memory (in kilobytes) of total allocated virtual address space. VMalloc Used Total amount of memory (in kilobytes) of used virtual address space. Writeback Memory (in kilobytes) that is actively being written back to the disk. Swap (kB) Swap memory heading. Total Total swap memory (in kilobytes). Used Used swap memory (in kilobytes). Free Free swap memory (in kilobytes). Cached Cached swap memory (in kilobytes). Buffers (kB) Buffers heading. Load Average Indicators of system load. 1-Min Average number of processes running for the last minute. 5-Min Average number of processes running for the last 5 minutes. 15-Min Average number of processes running for the last 15 minutes. Table 139 show platform software process list summary Field Descriptions (continued) Field Description show platform software tech-support CF-914 Cisco IOS Configuration Fundamentals Command Reference April 2010 show platform software tech-support To display system information or create a technical support information tar file for Cisco Technical Support, use the show platform software tech-support command in privileged EXEC or diagnostic mode. show platform software tech-support [file {bootflash:filename.tgz | fpd:filename.tgz | harddisk:filename.tgz | obfl:filename.tgz | stby-bootflash:filename.tgz | stby-harddisk:filename.tgz | stby-obfl:filename.tgz | stby-usb0:filename.tgz | stby-usb1:filename.tgz}] Syntax Description Command Default No default behavior or values. Command Modes Privileged EXEC (#) Diagnostic (diag) file (Optional) Creates a technical support information tar file for the specified destination file path. bootflash:filename.tgz Creates a technical support information tar file for the boot flash memory file system on the active RP. fpd:filename.tgz Creates a technical support information tar file for the field-programmable device (FPD) image package on the active RP. The information displayed is for internal debugging puposes only. harddisk:filename.tgz Creates a technical support information tar file for the hard disk file system on the active RP. obfl:filename.tgz Creates a technical support information tar file for the file system for Onboard Failure Logging (obfl) files. The information displayed is for internal debugging puposes only. stby-bootflash: filename.tgz Creates a technical support information tar file for the boot flash memory file system on the standby RP. The information displayed is for internal debugging puposes only. stby-harddisk: filename.tgz Creates a technical support information tar file for the hard disk file system on the standby RP. The information displayed is for internal debugging puposes only. stby-obfl:filename.tgz Creates a technical support information tar file for the Onboard Failure Logging (obfl) files on the standby RP. The information displayed is for internal debugging puposes only. stby-usb0:filename.tgz Creates a technical support information tar file for Universal Serial Bus (USB) memory. The information displayed is for internal debugging puposes only. stby-usb1:filename.tgz Creates a technical support information tar file for Universal Serial Bus (USB) memory. The information displayed is for internal debugging puposes only. show platform software tech-support CF-915 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command History Usage Guidelines If the file keyword is specified, the specification of the bootflash: or harddisk: keyword and filename is required. The show platform software tech-support command without a destination file path specification returns a large volume of information in a short period of time. You should save the output of the show platform software tech-support command in a log file to send to Cisco Technical Support for analysis. Examples The following example displays system information for Cisco Technical Support: Router# show platform software tech-support ---- show version installed ----- Type: provisioning file, Version: unknown Provisioned on: RP0, Status: active File: packages.conf.super Modified: 2007-11-07 15:06:12.212303000 +0000 SHA1 (header): d929d995d5ba2d3dedf67137c3e0e321b1727d7b SHA1 (calculated): d929d995d5ba2d3dedf67137c3e0e321b1727d7b SHA1 (external): a16881b6a7e3a5593b63bf211f72b8af9c534063 instance address : 0X890DE9B4 fast failover address : 00000000 cpp interface handle 0 instance address : 0X890DE9B8 fast failover address : 00000000 cpp interface handle 0 instance address : 0X890DE9BC fast failover address : 00000000 ... Note The show platform software tech-support command returns a large volume of information in a short period of time. The example above has been abbreviated for the purposes of this description. The following example creates a technical support information tar file for the boot flash memory file system on the active RP: Router# show platform software tech-support file bootflash:tech_support_output.tgz Running tech support command set; please wait... Creating file 'bootflash:target_support_output.tgz.tgz' ... File 'bootflash:target_support_output.tgz.tgz' created successfully The following example creates a technical support information tar file for the hard disk file system on the active RP: Router# show platform software tech-support file harddisk:tech_support_output.tgz Running tech support command set; please wait... Creating file 'harddisk:tech_support_ouput.tgz.tgz' ... File 'harddisk:tech_support_ouput.tgz.tgz' created successfully Release Modification Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Routers. show platform supervisor CF-916 Cisco IOS Configuration Fundamentals Command Reference April 2010 show platform supervisor To display platform supervisor information, use the show platform supervisor command in privileged EXEC mode. show platform supervisor mtu slot slot-number port port-number Syntax Description Command Modes Privileged EXEC (#) Command History Examples The following is sample output from the show platform supervisor command. The fields are self-explanatory. Router# show platform supervisor mtu slot 5 port 1 User configured MTU : 9216 Real Operating MTU : 9236 Related Commands mtu Displays supervisor operating Maximum Tranmission Unit (MTU). slot slot-number Displays information for the specified slot. port port-number Displays information for the specified port. Release Modification 12.2(33)SRA This command was introduced. Command Description show platform Displays platform information. show power CF-917 Cisco IOS Configuration Fundamentals Command Reference April 2010 show power To display information about the power status, use the show power command in user EXEC or privileged EXEC mode. show power [available | inline [interface number | module number] | redundancy-mode | status {all | fan-tray fan-tray-number | module slot | power-supply pwr-supply-number} | total | used] Syntax Description Defaults This command has no default settings. Command Modes User EXEC Privileged EXEC Command History available (Optional) Displays the available system power (margin). inline (Optional) Displays the inline power status. interface number (Optional) Specifies the interface type; possible valid values are ethernet, fastethernet, gigabitethernet, tengigabitethernet, null, port-channel, and vlan. See the “Usage Guidelines” section for additional information. module number Displays the power status for a specific module. redundancy-mode (Optional) Displays the power-supply redundancy mode. status (Optional) Displays the power status. all Displays all the FRU types. fan-tray fan-tray-number Displays the power status for the fan tray. module slot Displays the power status for a specific module. power-supply pwr-supply-number Displays the power status for a specific power supply; valid values are 1 and 2. total (Optional) Displays the total power that is available from the power supplies. used (Optional) Displays the total power that is budgeted for powered-on items. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17a)SX1 The output was changed to include the total system-power information. 12.2(17b)SXA This command was changed to include information about the inline power status for a specific module. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(18)SXF The output was changed to include information about the high-capacity power supplies. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show power CF-918 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines The interface-number argument designates the module and port number. Valid values for interface-number depend on the specified interface type and the chassis and module that are used. For example, if you specify a Gigabit Ethernet interface and have a 48-port 10/100BASE-T Ethernet module that is installed in a 13-slot chassis, valid values for the module number are from 1 to 13 and valid values for the port number are from 1 to 48. Valid values for vlan-id are from 1 to 4094. The Inline power field in the show power output displays the inline power that is consumed by the modules. For example, this example shows that module 9 has consumed 0.300 A of inline power: Inline power # current module 9 0.300A Examples This example shows how to display the available system power: Router> show power available system power available = 20.470A Router> This example shows how to display power-supply redundancy mode: Router# show power redundancy-mode system power redundancy mode = redundant Router# This command shows how to display the system-power status: Router> show power system power redundancy mode = combined system power total = 3984.12 Watts (94.86 Amps @ 42V) system power used = 1104.18 Watts (26.29 Amps @ 42V) system power available = 2879.94 Watts (68.57 Amps @ 42V) Power-Capacity PS-Fan Output Oper PS Type Watts A @42V Status Status State ---- ------------------ ------- ------ ------ ------ ----- 1 WS-CAC-3000W 2830.80 67.40 OK OK on 2 WS-CAC-1300W 1153.32 27.46 OK OK on Note: PS2 capacity is limited to 2940.00 Watts (70.00 Amps @ 42V) when PS1 is not present Pwr-Allocated Oper Fan Type Watts A @42V State ---- ------------------ ------- ------ ----- 1 FAN-MOD-9 241.50 5.75 OK 2 241.50 5.75 failed Pwr-Requested Pwr-Allocated Admin Oper Slot Card-Type Watts A @42V Watts A @42V State State ---- ------------------ ------- ------ ------- ------ ----- ----- 1 WS-X6K-SUP2-2GE 145.32 3.46 145.32 3.46 on on 2 - - 145.32 3.46 - - 3 WS-X6516-GBIC 118.02 2.81 118.02 2.81 on on 5 WS-C6500-SFM 117.18 2.79 117.18 2.79 on on 7 WS-X6516A-GBIC 214.20 5.10 - - on off (insuff cooling capacity) 8 WS-X6516-GE-TX 178.50 4.25 178.50 4.25 on on 9 WS-X6816-GBIC 733.98 17.48 - - on off (connector rating exceeded) Router> This example shows how to display the power status for all FRU types: show power CF-919 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router# show power status all FRU-type # current admin state oper power-supply 1 27.460A on on module 1 4.300A on on module 2 4.300A - - (reserved) module 5 2.690A on on Router# This example shows how to display the power status for a specific module: Router# show power status module 1 FRU-type # current admin state oper module 1 -4.300A on on Router# This example shows how to display the power status for a specific power supply: Router# show power status power-supply 1 FRU-type # current admin state oper power-supply 1 27.460A on on Router# This example displays information about the high-capacity power supplies: Router# show power status power-supply 2 Power-Capacity PS-Fan Output Oper PS Type Watts A @42V Status Status State ---- ------------------ ------- ------ ------ ------ ----- 1 WS-CAC-6000W 2672.04 63.62 OK OK on 2 WS-CAC-9000W-E 2773.68 66.04 OK OK on Router# This example shows how to display the total power that is available from the power supplies: Router# show power total system power total = 27.460A Router# This example shows how to display the total power that is budgeted for powered-on items: Router# show power used system power used = -6.990A Router# This command shows how to display the inline power status on the interfaces: Router# show power inline Interface Admin Oper Power ( mWatt ) Device -------------------- ----- ---------- --------------- ----------- FastEthernet9/1 auto on 6300 Cisco 6500 IP Phone FastEthernet9/2 auto on 6300 Cisco 6500 IP Phone . . .

This command shows how to display the inline power status for a specific module: Router# show power inline mod 7 show power CF-920 Cisco IOS Configuration Fundamentals Command Reference April 2010 Interface Admin Oper Power Device Class (Watts) ---------- ----- ---------- ------- -------------- ----------- Gi7/1 auto on 6.3 Cisco IP Phone 7960 n/a Gi7/2 static power-deny 0 Ieee PD 3 . . .

Related Commands Command Description power enable Turns on power for the modules. power redundancy-mode Sets the power-supply redundancy mode. show processes CF-921 Cisco IOS Configuration Fundamentals Command Reference April 2010 show processes To display information about the active Cisco IOS processes or the Cisco IOS Software Modularity POSIX-style processes, use the show processes command in user EXEC or privileged EXEC mode. Cisco IOS Software show processes [history | process-id | timercheck] Cisco IOS Software Modularity show processes Syntax Description Command Modes User EXEC (>) Privileged EXEC (#) Command History Usage Guidelines Cisco IOS Software Modularity Although no optional keywords or arguments are supported for the base show processes command when a Software Modularity image is running, more details about processes are displayed using the show processes cpu, show processes detailed, show processes kernel, and show processes memory commands. Examples Example output varies between Cisco IOS software images and Cisco IOS Software Modularity software images. The following sections show output examples for each image: history (Optional) For Cisco IOS processes only. Displays the process history in an ordered format. process-id (Optional) For Cisco IOS processes only. An integer that specifies the process for which memory and CPU utilization data will be returned. timercheck (Optional) For Cisco IOS processes only. Displays the processes configured for a timer check. Release Modification 10.0 This command was introduced. 12.2(2)T This command was modified. The history keyword was added. 12.3(2)T This command was modified. The process-id argument was added. 12.2(18)SXF4 This command was modified. The syntax was modified to support Cisco IOS Software Modularity images. 12.3(14)T This command was modified. The timercheck keyword was added. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was integrated into Cisco IOS XE Release 2.1. show processes CF-922 Cisco IOS Configuration Fundamentals Command Reference April 2010 • Cisco IOS Software • Cisco IOS Software Modularity Cisco IOS Software The following is sample output from the show processes command: Router# show processes CPU utilization for five seconds: 21%/0%; one minute: 2%; five minutes: 2% PID QTy PC Runtime (ms) Invoked uSecs Stacks TTY Process 1 Cwe 606E9FCC 0 1 0 5600/6000 0 Chunk Manager 2 Csp 607180F0 0 121055 0 2608/3000 0 Load Meter 3 M* 0 8 90 88 9772/12000 0 Exec 4 Mwe 619CB674 0 1 023512/24000 0 EDDRI_MAIN 5 Lst 606F6AA4 82064 61496 1334 5668/6000 0 Check heaps 6 Cwe 606FD444 0 127 0 5588/6000 0 Pool Manager 7 Lwe 6060B364 0 1 0 5764/6000 0 AAA_SERVER_DEADT 8 Mst 6063212C 0 2 0 5564/6000 0 Timers 9 Mwe 600109D4 0 2 0 5560/6000 0 Serial Backgroun 10 Mwe 60234848 0 2 0 5564/6000 0 ATM Idle Timer 11 Mwe 602B75F0 0 2 0 8564/9000 0 ATM AutoVC Perio 12 Mwe 602B7054 0 2 0 5560/6000 0 ATM VC Auto Crea 13 Mwe 606068B8 0 2 0 5552/6000 0 AAA high-capacit 14 Msi 607BABA4 251264 605013 415 5628/6000 0 EnvMon 15 Mwe 607BFF8C 0 1 0 8600/9000 0 OIR Handler 16 Mwe 607D407C 0 10089 0 5676/6000 0 IPC Dynamic Cach 17 Mwe 607CD03C 0 1 0 5632/6000 0 IPC Zone Manager 18 Mwe 607CCD80 0 605014 0 5708/6000 0 IPC Periodic Tim 19 Mwe 607CCD24 0 605014 0 5704/6000 0 IPC Deferred Por 20 Mwe 607CCE2C 0 1 0 5596/6000 0 IPC Seat Manager Table 140 describes the fields shown in the display. Table 140 show processes Field Descriptions Field Description CPU utilization for five seconds CPU utilization for the last 5 seconds. The second number indicates the percentage of CPU time spent at the interrupt level. one minute CPU utilization for the last minute. five minutes CPU utilization for the last 5 minutes. PID Process ID. Q Process queue priority. Possible values: C (critical), H (high), M (medium), and L (low). show processes CF-923 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note Because platforms have a 4- to 8- millisecond clock resolution, run times are considered reliable only after a large number of invocations or a reasonable, measured run time. For a list of process descriptions, see http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_tech_note09186a00800a65d0.sht ml. The following is sample output from the show processes history command: Router# show processes history PID Exectime(ms) Caller PC Process Name 3 12 0x0 Exec 16 0 0x603F4DEC GraphIt 21 0 0x603CFEF4 TTY Background 22 0 0x6042FD7C Per-Second Jobs 67 0 0x6015CD38 SMT input 39 0 0x60178804 FBM Timer 16 0 0x603F4DEC GraphIt 21 0 0x603CFEF4 TTY Background 22 0 0x6042FD7C Per-Second Jobs 16 0 0x603F4DEC GraphIt 21 0 0x603CFEF4 TTY Background Ty Scheduler test. Possible values: • * (currently running) • E (waiting for an event) • S (ready to run, voluntarily relinquished processor) • rd (ready to run, wakeup conditions have occurred) • we (waiting for an event) • sa (sleeping until an absolute time) • si (sleeping for a time interval) • sp (sleeping for a time interval as an alternate call • st (sleeping until a timer expires) • hg (hung: the process will never execute again) • xx (dead: the process has terminated, but has not yet been deleted). PC Current program counter. Runtime (ms) CPU time that the process has used (in milliseconds). Invoked Number of times that the process has been invoked. uSecs Microseconds of CPU time for each process invocation. Stacks Low water mark/Total stack space available (in bytes). TTY Terminal that controls the process. Process Name of the process. Table 140 show processes Field Descriptions (continued) Field Description show processes CF-924 Cisco IOS Configuration Fundamentals Command Reference April 2010 22 0 0x6042FD7C Per-Second Jobs 67 0 0x6015CD38 SMT input 39 0 0x60178804 FBM Timer 24 0 0x60425070 Compute load avgs 11 0 0x605210A8 ARP Input 69 0 0x605FDAF4 DHCPD Database 69 0 0x605FD568 DHCPD Database 51 0 0x60670B3C IP Cache Ager 69 0 0x605FD568 DHCPD Database 36 0 0x606E96DC SSS Test Client 69 0 0x605FD568 DHCPD Database --More-- Table 141 describes the significant fields shown in the display. The following is sample output from the show processes process-id command: Router# show processes 6 Process ID 6 [Pool Manager], TTY 0 Memory usage [in bytes] Holding: 921148, Maximum: 940024, Allocated: 84431264, Freed: 99432136 Getbufs: 0, Retbufs: 0, Stack: 12345/67890 CPU usage PC: 0x60887600, Invoked: 188, Giveups: 100, uSec: 24 5Sec: 3.03%, 1Min: 2.98%, 5Min: 1.55%, Average: 0.58%, Age: 662314 msec, Runtime: 3841 msec State: Running, Priority: Normal Table 142 describes the fields shown in the display. Table 141 show processes history Field Descriptions Field Description PID Process ID. Exectime (ms) Execution time (in milliseconds) of the most recent run or the total execution time of the most recent consecutive runs. Caller PC Current program counter of this process before it was suspended. Process Name Name of the process. Table 142 show processes process-id Field Descriptions Field Description Process ID Process ID number and process name. TTY Terminal that controls the process. Memory usage [in bytes] This section contains fields that show the memory used by the specified process. Holding Amount of memory currently allocated to the process. Maximum Maximum amount of memory allocated to the process since its invocation. Allocated Bytes of memory allocated by the process. Freed Bytes of memory freed by the process. Getbufs Number of times that the process has requested a packet buffer. show processes CF-925 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco IOS Software Modularity The following is sample output from the show processes command when a Cisco IOS Software Modularity image is running: Router# show processes Total CPU utilization for 5 seconds: 99.7%; 1 minute: 98.9%; 5 minutes: 86.5% PID TID Prio STATE Blocked Stack CPU Name 1 1 0 Ready 0 (128K) 2m28s procnto-cisco 1 2 63 Receive 1 0 (128K) 0.000 procnto-cisco 1 3 10 Receive 1 0 (128K) 0.000 procnto-cisco 1 4 11 Receive 1 0 (128K) 1.848 procnto-cisco 1 5 63 Receive 1 0 (128K) 0.000 procnto-cisco 1 6 63 Receive 1 0 (128K) 0.000 procnto-cisco 12290 1 10 Receive 1 12288(128K) 0.080 chkptd.proc 12290 2 10 Receive 8 12288(128K) 0.000 chkptd.proc 3 1 15 Condvar 1027388 12288(128K) 0.016 qdelogger 3 2 15 Receive 1 12288(128K) 0.004 qdelogger 3 3 16 Condvar 1040024 12288(128K) 0.004 qdelogger 4 1 10 Receive 1 4096 (128K) 0.016 devc-pty 6 1 62 Receive 1 8192 (128K) 0.256 devc-ser2681 6 2 63 Intr 8192 (128K) 0.663 devc-ser2681 7 1 10 Receive 1 32768(128K) 0.080 dumper.proc 7 2 10 Receive 1 32768(128K) 0.008 dumper.proc 7 3 10 Receive 1 32768(128K) 0.000 dumper.proc 7 4 10 Receive 1 32768(128K) 0.020 dumper.proc 7 5 10 Receive 1 32768(128K) 0.008 dumper.proc 4104 2 10 Receive 1 12288(128K) 0.000 pipe 4104 3 10 Receive 1 12288(128K) 0.000 pipe 8210 1 10 Nanosleep 8192 (128K) 0.040 watchdog.proc 8211 1 10 Receive 1 16384(128K) 0.044 syslogd.proc Retbufs Number of times that the process has relinquished a packet buffer. Stack Low water mark/Total stack space available (in bytes). CPU usage This section contains fields that show the CPU resources used by the specified process. PC Current program counter of this process before it was suspended. Invoked Number of times that the process executed since its invocation. Giveups Number of times that the process voluntarily gave up the CPU. uSec Microseconds of CPU time for each process invocation. 5Sec CPU utilization by process in the last five seconds. 1Min CPU utilization by process in the last minute. 5Min CPU utilization by process in the last five minutes. Average The average amount of CPU utilization by the process since its invocation. Age Milliseconds since the process was invoked. Runtime CPU time that the process has used (in milliseconds). State Current state of the process. Possible values: Running, Waiting for Event, Sleeping (Mgd Timer), Sleeping (Periodic), Ready, Idle, Dead. Priority The priority of the process. Possible values: Low, Normal, High. Table 142 show processes process-id Field Descriptions (continued) Field Description show processes CF-926 Cisco IOS Configuration Fundamentals Command Reference April 2010 8211 2 10 Receive 7 16384(128K) 0.000 syslogd.proc 8211 3 10 Sigwaitin 16384(128K) 0.000 syslogd.proc 8212 2 10 Receive 1 24576(128K) 0.024 name_svr.proc 8212 3 10 Receive 1 24576(128K) 0.100 name_svr.proc 8212 4 10 Receive 1 24576(128K) 0.340 name_svr.proc 8212 5 10 Receive 1 24576(128K) 0.304 name_svr.proc 8213 1 10 Receive 1 24576(128K) 0.644 wdsysmon.proc 8213 2 10 Receive 5 24576(128K) 0.052 wdsysmon.proc 8213 3 10 Receive 10 24576(128K) 0.004 wdsysmon.proc 8213 4 63 Nanosleep 24576(128K) 0.000 wdsysmon.proc 8214 1 10 Receive 1 94208(128K) 0.132 sysmgr.proc 8214 2 10 Sigwaitin 94208(128K) 0.000 sysmgr.proc 8214 3 10 Receive 8 94208(128K) 0.004 sysmgr.proc 8214 4 10 Receive 1 94208(128K) 0.000 sysmgr.proc 8214 5 10 Receive 1 94208(128K) 0.000 sysmgr.proc 8214 6 10 Receive 1 94208(128K) 0.004 sysmgr.proc 8214 7 10 Receive 1 94208(128K) 0.000 sysmgr.proc 8214 8 10 Receive 1 94208(128K) 0.000 sysmgr.proc 8214 9 10 Receive 1 94208(128K) 0.000 sysmgr.proc 8214 10 10 Receive 1 94208(128K) 0.000 sysmgr.proc 12317 1 10 Receive 23 73728(128K) 2.212 ios-base 12317 2 10 Receive 1 73728(128K) 0.064 ios-base 12317 3 10 Reply 1 73728(128K) 17.800 ios-base 12317 4 11 Nanosleep 73728(128K) 0.000 ios-base 12317 5 10 Receive 1 73728(128K) 21.108 ios-base 12317 6 45 Intr 73728(128K) 0.000 ios-base 12317 7 35 Intr 73728(128K) 0.064 ios-base 12317 8 10 Reply 12336 73728(128K) 0.776 ios-base 12317 9 10 Receive 1 73728(128K) 12.608 ios-base 12317 10 25 Intr 73728(128K) 26.404 ios-base 12317 11 25 Intr 73728(128K) 0.088 ios-base 12317 12 45 Intr 73728(128K) 0.000 ios-base 12317 13 10 Receive 1 73728(128K) 6.456 ios-base 12317 14 20 Reply 6 73728(128K) 0.064 ios-base 12317 15 10 Receive 1 73728(128K) 8.064 ios-base 12324 1 10 Receive 1 40960(128K) 73.088 iprouting.iosproc 12324 2 10 Ready 40960(128K) 32.552 iprouting.iosproc 12324 4 11 Nanosleep 40960(128K) 0.000 iprouting.iosproc 12324 5 10 Receive 1 40960(128K) 4.312 iprouting.iosproc 12324 6 10 Receive 1 40960(128K) 6.988 iprouting.iosproc 12324 7 10 Reply 1 40960(128K) 41.108 iprouting.iosproc 12324 8 10 Receive 1 40960(128K) 0.032 iprouting.iosproc 12324 9 10 Reply 1 40960(128K) 0.332 iprouting.iosproc 12330 1 10 Receive 1 36864(128K) 0.000 cdp2.iosproc 12330 2 10 Receive 1 36864(128K) 0.004 cdp2.iosproc 12330 3 10 Receive 1 36864(128K) 0.024 cdp2.iosproc 12330 4 11 Nanosleep 36864(128K) 0.000 cdp2.iosproc 12330 5 10 Reply 1 36864(128K) 0.228 cdp2.iosproc 12330 6 10 Receive 1 36864(128K) 0.000 cdp2.iosproc 12330 7 10 Receive 9 36864(128K) 0.000 cdp2.iosproc 12334 1 10 Receive 1 45056(128K) 0.000 inetd.proc 12334 2 10 Sigwaitin 45056(128K) 0.000 inetd.proc 12334 3 10 Receive 1 45056(128K) 0.000 inetd.proc 12334 4 10 Receive 1 45056(128K) 0.020 inetd.proc 12334 5 10 Receive 1 45056(128K) 0.000 inetd.proc 12335 1 10 Receive 1 118784(128K) 0.000 tcp.proc 12335 2 10 Receive 1 118784(128K) 0.000 tcp.proc 12335 3 10 Sigwaitin 118784(128K) 0.000 tcp.proc 12335 4 10 Condvar 7A602080 118784(128K) 5.092 tcp.proc 12335 5 10 Ready 118784(128K) 21.092 tcp.proc 12335 6 10 Receive 1 118784(128K) 14.280 tcp.proc 12335 7 10 Receive 1 118784(128K) 0.000 tcp.proc 12336 1 10 Receive 1 53248(128K) 0.000 udp.proc 12336 3 10 Sigwaitin 53248(128K) 0.000 udp.proc show processes CF-927 Cisco IOS Configuration Fundamentals Command Reference April 2010 12336 4 10 Condvar 7A602080 53248(128K) 0.000 udp.proc 12336 5 10 Receive 11 53248(128K) 0.072 udp.proc 12336 6 10 Receive 1 53248(128K) 0.028 udp.proc 12336 7 10 Receive 1 53248(128K) 0.000 udp.proc 12336 8 10 Receive 1 53248(128K) 0.000 udp.proc Table 143 describes the significant fields shown in the display. Related Commands Table 143 show processes (Software Modularity) Field Descriptions Field Description PID Process ID. TID Task ID. Prio Process priority. STATE Current state of process. Blocked Thread (with given process ID) that is currently blocked by the process. Stack Size, in kilobytes, of the memory stack. CPU CPU time, in minutes and seconds, used by the process. Name Process name. Command Description show processes cpu Displays detailed CPU utilization statistics (CPU use per process) when a Software Modularity image is running. show processes detailed Displays detailed information about POSIX and Cisco IOS processes when a Software Modularity image is running. show processes kernel Displays information about System Manager kernel processes when a Software Modularity image is running. show processes memory Displays amount of system memory used per system process. show processes cpu CF-928 Cisco IOS Configuration Fundamentals Command Reference April 2010 show processes cpu To display detailed CPU utilization statistics (CPU use per process) when Cisco IOS or Cisco IOS Software Modularity images are running, use the show processes cpu command in user EXEC or privileged EXEC mode. Cisco IOS Software show processes cpu [history [table] | sorted [1min | 5min | 5sec]] Cisco IOS Software Modularity show processes cpu [detailed [process-id | process-name] | history] Syntax Description Command Modes User EXEC (>) Privileged EXEC (#) Command History history (Optional) Displays CPU history in a graph format. table (Optional) Displays CPU history in a table format. sorted (Optional) For Cisco IOS images only. Displays CPU utilization sorted by percentage. 1min (Optional) Sorts CPU utilization based on 1 minute utilization. 5min (Optional) Sorts CPU utilization based on 5 minutes utilization. 5sec (Optional) Sorts CPU utilization based on 5 seconds utilization. detailed (Optional) For Cisco IOS Software Modularity images only. Displays more detailed information about Cisco IOS processes (not for POSIX processes). process-id (Optional) For Cisco IOS Software Modularity images only. Process identifier. process-name (Optional) For Cisco IOS Software Modularity images only. Process name. Release Modification 12.0 This command was introduced. 12.2(2)T This command was modified. The history keyword was added. 12.3(8) This command was enhanced to display Address Resolution Protocol (ARP) output. 12.3(14)T This command was enhanced to display ARP output. 12.2(18)SXF4 This command was enhanced to support Cisco IOS Software Modularity images. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB. 12.2(33)SCB3 This command was integrated into Cisco IOS Release 12.2(33)SCB3. Support was added for Cisco uBR10012 and uBR7200 routers. Cisco IOS XE Release 2.1 This command was integrated into Cisco IOS XE Release 2.1. show processes cpu CF-929 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines Cisco IOS Software If you use the optional history keyword, three graphs are displayed for Cisco IOS images: • CPU utilization for the last 60 seconds • CPU utilization for the last 60 minutes • CPU utilization for the last 72 hours Maximum usage is measured and recorded every second; average usage is calculated on periods of more than one second. Consistently high CPU utilization over an extended period indicates a problem. Use the show processes cpu command to troubleshoot. Also, you can use the output of this command in the Cisco Output Interpreter tool to display potential issues and fixes. Output Interpreter is available to registered users of Cisco.com who are logged in and have Java Script enabled. For a list of system processes, go to http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_tech_note09186a00800a65d0.sht ml. Cisco IOS Software Modularity Cisco IOS Software Modularity images display only one graph that shows the CPU utilization for the last 60 minutes. The horizontal axis shows times (for example, 0, 5, 10, 15 minutes), and the vertical axis shows total percentage of CPU utilization (0 to 100 percent). Examples Example output varies between Cisco IOS software images and Cisco IOS Software Modularity software images. The following sections show output examples for each image: • Cisco IOS Software • Cisco IOS Software Modularity Cisco IOS Software The following is sample output from the show processes cpu command without keywords: Router# show processes cpu CPU utilization for five seconds: 5%/2%; one minute: 3%; five minutes: 2% PID Runtime (ms) Invoked uSecs 5Sec 1Min 5Min TTY Process 1 1736 58 29931 0% 0% 0% 0 Check heaps 2 68 585 116 1.00% 1.00% 0% 0 IP Input 3 0 744 0 0% 0% 0% 0 TCP Timer 4 0 2 0 0% 0% 0% 0 TCP Protocols 5 0 1 0 0% 0% 0% 0 BOOTP Server 6 16 130 123 0% 0% 0% 0 ARP Input 7 0 1 0 0% 0% 0% 0 Probe Input 8 0 7 0 0% 0% 0% 0 MOP Protocols 9 0 2 0 0% 0% 0% 0 Timers 10 692 64 10812 0% 0% 0% 0 Net Background 11 0 5 0 0% 0% 0% 0 Logger 12 0 38 0 0% 0% 0% 0 BGP Open 13 0 1 0 0% 0% 0% 0 Net Input 14 540 3466 155 0% 0% 0% 0 TTY Background 15 0 1 0 0% 0% 0% 0 BGP I/O 16 5100 1367 3730 0% 0% 0% 0 IGRP Router 17 88 4232 20 0.20% 1.00% 0% 0 BGP Router 18 152 14650 10 0% 0% 0% 0 BGP Scanner 19 224 99 2262 0% 0% 1.00% 0 Exec show processes cpu CF-930 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following is sample output of the one-hour portion of the output. The Y-axis of the graph is the CPU utilization. The X-axis of the graph is the increment within the time period displayed in the graph. This example shows the individual minutes during the previous hour. The most recent measurement is on the left of the X-axis. Router# show processes cpu history !--- One minute output omitted 6665776865756676676666667667677676766666766767767666566667 6378016198993513709771991443732358689932740858269643922613 100 90 80 * * * * * * * * 70 * * ***** * ** ***** *** **** ****** * ******* * * 60 #***##*##*#***#####*#*###*****#*###*#*#*##*#*##*#*##*****# 50 ########################################################## 40 ########################################################## 30 ########################################################## 20 ########################################################## 10 ########################################################## 0....5....1....1....2....2....3....3....4....4....5....5.... 0 5 0 5 0 5 0 5 0 5 CPU% per minute (last 60 minutes) * = maximum CPU% # = average CPU% !--- 72-hour output omitted The top two rows, read vertically, display the highest percentage of CPU utilization recorded during the time increment. In this example, the CPU utilization for the last minute recorded is 66 percent. The device may have reached 66 percent only once during that minute, or it may have reached 66 percent multiple times. The device records only the peak reached during the time increment and the average over the course of that increment. The following is sample output from the show processes cpu command on a Cisco uBR10012 router: Router# show processes cpu CPU utilization for five seconds: 2%/0%; one minute: 2%; five minutes: 2% PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process 1 8 471 16 0.00% 0.00% 0.00% 0 Chunk Manager 2 4 472 8 0.00% 0.00% 0.00% 0 Load Meter 3 0 1 0 0.00% 0.00% 0.00% 0 IPC 0x50000 Vers 4 0 10 0 0.00% 0.00% 0.00% 0 C10K Card Event 5 0 65 0 0.00% 0.00% 0.00% 0 Retransmission o 6 0 5 0 0.00% 0.00% 0.00% 0 IPC ISSU Dispatc 7 5112 472 10830 0.63% 0.18% 0.18% 0 Check heaps 8 0 1 0 0.00% 0.00% 0.00% 0 Pool Manager 9 0 2 0 0.00% 0.00% 0.00% 0 Timers 10 0 2 0 0.00% 0.00% 0.00% 0 Serial Backgroun 11 0 786 0 0.00% 0.00% 0.00% 0 WBCMTS process 12 0 1 0 0.00% 0.00% 0.00% 0 AAA_SERVER_DEADT 13 0 1 0 0.00% 0.00% 0.00% 0 Policy Manager 14 0 1 0 0.00% 0.00% 0.00% 0 Crash writer 15 0 1 0 0.00% 0.00% 0.00% 0 RO Notify Timers 16 0 1 0 0.00% 0.00% 0.00% 0 RMI RM Notify Wa 17 0 2364 0 0.00% 0.00% 0.00% 0 Facility Alarm 18 0 41 0 0.00% 0.00% 0.00% 0 IPC Dynamic Cach show processes cpu CF-931 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following is sample output from the show processes cpu command that shows an ARP probe process: Router# show processes cpu | include ARP 17 38140 389690 97 0.00% 0.00% 0.00% 0 ARP Input 36 0 1 0 0.00% 0.00% 0.00% 0 IP ARP Probe 40 0 1 0 0.00% 0.00% 0.00% 0 ATM ARP INPUT 80 0 1 0 0.00% 0.00% 0.00% 0 RARP Input 114 0 1 0 0.00% 0.00% 0.00% 0 FR ARP Table 144 describes the fields shown in the output. Note Because platforms have a 4- to 8-millisecond clock resolution, run times are considered reliable only after several invocations or a reasonable, measured run time. Cisco IOS Software Modularity The following is sample output from the show processes cpu command when a Software Modularity image is running: Router# show processes cpu Total CPU utilization for 5 seconds: 99.6%; 1 minute: 98.5%; 5 minutes: 85.3% PID 5Sec 1Min 5Min Process 1 0.0% 0.1% 0.8% kernel 3 0.0% 0.0% 0.0% qdelogger 4 0.0% 0.0% 0.0% devc-pty 6 0.7% 0.2% 0.1% devc-ser2681 7 0.0% 0.0% 0.0% dumper.proc 4104 0.0% 0.0% 0.0% pipe 8201 0.0% 0.0% 0.0% mqueue 8202 0.0% 0.0% 0.0% fsdev.proc 8203 0.0% 0.0% 0.0% flashfs_hes_slot1.proc 8204 0.0% 0.0% 0.0% flashfs_hes_slot0.proc Table 144 show processes cpu Field Descriptions Field Description CPU utilization for five seconds CPU utilization for the last 5 seconds. The second number indicates the percent of CPU time spent at the interrupt level. 1 minute CPU utilization for the last minute. 5 minutes CPU utilization for the last 5 minutes. PID Process ID. Runtime (ms) CPU time that the process has used (in milliseconds). Invoked Number of times that the process has been invoked. uSecs Microseconds of CPU time for each process invocation. 5Sec CPU utilization by task in the last 5 seconds. 1Min CPU utilization by task in the last minute. 5Min CPU utilization by task in the last 5 minutes. TTY Terminal that controls the process. Process Name of the process. show processes cpu CF-932 Cisco IOS Configuration Fundamentals Command Reference April 2010 8205 0.0% 0.0% 0.0% flashfs_hes_bootflash.proc 8206 0.0% 0.0% 0.0% dfs_disk2.proc 8207 0.0% 0.0% 0.0% dfs_disk1.proc 8208 0.0% 0.0% 0.0% dfs_disk0.proc 8209 0.0% 0.0% 0.0% ldcache.proc 8210 0.0% 0.0% 0.0% watchdog.proc 8211 0.0% 0.0% 0.0% syslogd.proc 8212 0.0% 0.0% 0.0% name_svr.proc 8213 0.0% 0.1% 0.0% wdsysmon.proc 8214 0.0% 0.0% 0.0% sysmgr.proc 8215 0.0% 0.0% 0.0% kosh.proc 12290 0.0% 0.0% 0.0% chkptd.proc 12312 0.0% 0.0% 0.0% sysmgr.proc 12313 0.0% 0.0% 0.0% syslog_dev.proc 12314 0.0% 0.0% 0.0% itrace_exec.proc 12315 0.0% 0.0% 0.0% packet.proc 12316 0.0% 0.0% 0.0% installer.proc 12317 29.1% 28.5% 19.6% ios-base 12318 0.0% 0.0% 0.0% fh_fd_oir.proc 12319 0.0% 0.0% 0.1% fh_fd_cli.proc 12320 0.0% 0.0% 0.0% fh_metric_dir.proc 12321 0.0% 0.0% 0.0% fh_fd_snmp.proc 12322 0.0% 0.0% 0.0% fh_fd_none.proc 12323 0.0% 0.0% 0.0% fh_fd_intf.proc 12324 48.5% 48.5% 35.8% iprouting.iosproc 12325 0.0% 0.0% 0.0% fh_fd_timer.proc 12326 0.0% 0.0% 0.0% fh_fd_ioswd.proc 12327 0.0% 0.0% 0.0% fh_fd_counter.proc 12328 0.0% 0.0% 0.0% fh_fd_rf.proc 12329 0.0% 0.0% 0.0% fh_server.proc 12330 0.0% 0.0% 0.0% cdp2.iosproc 12331 0.0% 0.0% 0.0% fh_policy_dir.proc 12332 0.0% 0.0% 0.0% ipfs_daemon.proc 12333 0.0% 0.0% 0.0% raw_ip.proc 12334 0.0% 0.0% 0.0% inetd.proc 12335 19.1% 20.4% 12.6% tcp.proc 12336 0.0% 0.0% 0.0% udp.proc Table 145 describes the significant fields shown in the display. Table 145 show processes cpu (Software Modularity) Field Descriptions Field Description Total CPU utilization for five seconds Total CPU utilization for the last 5 seconds. The second number indicates the percent of CPU time spent at the interrupt level. 1 minute CPU utilization for the last minute. 5 minutes CPU utilization for the last 5 minutes. PID Process ID. 5Sec Percentage of CPU time spent at the interrupt level for this process during the last five seconds. 1Min Percentage of CPU time spent at the interrupt level for this process during the last minute. 5Min Percentage of CPU time spent at the interrupt level for this process during the last five minutes. Process Process name. show processes cpu CF-933 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following is partial sample output from the show processes cpu command with the detailed keyword when a Software Modularity image is running: Router# show processes cpu detailed Total CPU utilization for 5 seconds: 99.6%; 1 minute: 99.3%; 5 minutes: 88.6% PID/TID 5Sec 1Min 5Min Process Prio STATE CPU 1 0.0% 0.7% 0.7% kernel 8.900 1 0.4% 0.7% 11.4% [idle thread] 0 Ready 2m28s 2 0.0% 0.0% 0.0% 63 Receive 0.000 3 0.0% 0.0% 0.0% 10 Receive 0.000 4 0.0% 0.0% 0.1% 11 Receive 1.848 5 0.0% 0.0% 0.0% 63 Receive 0.000 . . . PID/TID 5Sec 1Min 5Min Process Prio STATE CPU 8214 0.0% 0.0% 0.0% sysmgr.proc 0.216 1 0.0% 0.0% 0.0% 10 Receive 0.132 2 0.0% 0.0% 0.0% 10 Sigwaitin 0.000 3 0.0% 0.0% 0.0% 10 Receive 0.004 4 0.0% 0.0% 0.0% 10 Receive 0.000 5 0.0% 0.0% 0.0% 10 Receive 0.000 6 0.0% 0.0% 0.0% 10 Receive 0.004 7 0.0% 0.0% 0.0% 10 Receive 0.000 8 0.0% 0.0% 0.0% 10 Receive 0.000 9 0.0% 0.0% 0.0% 10 Receive 0.000 10 0.0% 0.0% 0.0% 10 Receive 0.000 11 0.0% 0.0% 0.0% 10 Receive 0.000 12 0.0% 0.0% 0.0% 10 Receive 0.000 13 0.0% 0.0% 0.0% 10 Receive 0.028 14 0.0% 0.0% 0.0% 10 Receive 0.040 15 0.0% 0.0% 0.0% 10 Receive 0.000 16 0.0% 0.0% 0.0% 10 Receive 0.000 17 0.0% 0.0% 0.0% 10 Receive 0.004 18 0.0% 0.0% 0.0% 10 Receive 0.000 19 0.0% 0.0% 0.0% 10 Receive 0.000 20 0.0% 0.0% 0.0% 10 Receive 0.000 21 0.0% 0.0% 0.0% 10 Receive 0.004 22 0.0% 0.0% 0.0% 10 Receive 0.000 PID/TID 5Sec 1Min 5Min Process Prio STATE CPU 8215 0.0% 0.0% 0.0% kosh.proc 0.044 1 0.0% 0.0% 0.0% 10 Reply 0.044 PID/TID 5Sec 1Min 5Min Process Prio STATE CPU 12290 0.0% 0.0% 0.0% chkptd.proc 0.080 1 0.0% 0.0% 0.0% 10 Receive 0.080 2 0.0% 0.0% 0.0% 10 Receive 0.000 PID/TID 5Sec 1Min 5Min Process Prio STATE CPU 12312 0.0% 0.0% 0.0% sysmgr.proc 0.112 1 0.0% 0.0% 0.0% 10 Receive 0.112 2 0.0% 0.0% 0.0% 10 Sigwaitin 0.000 PID/TID 5Sec 1Min 5Min Process Prio STATE CPU 12316 0.0% 0.0% 0.0% installer.proc 0.072 1 0.0% 0.0% 0.0% 10 Receive 0.000 3 0.0% 0.0% 0.0% 10 Nanosleep 0.000 4 0.0% 0.0% 0.0% 10 Sigwaitin 0.000 6 0.0% 0.0% 0.0% 10 Receive 0.000 Process sbin/ios-base, type IOS, PID = 12317 CPU utilization for five seconds: 12%/9%; one minute: 13%; five minutes: 10% Task Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Task Name 1 219 1503 145 0.00% 0.00% 0.00% 0 Hot Service Task 2 23680 42384 558 2.39% 6.72% 4.81% 0 Service Task 3 6104 11902 512 3.51% 1.99% 1.23% 0 Service Task 4 1720 5761 298 1.91% 0.90% 0.39% 0 Service Task show processes cpu CF-934 Cisco IOS Configuration Fundamentals Command Reference April 2010 5 0 5 0 0.00% 0.00% 0.00% 0 Chunk Manager 6 0 1 0 0.00% 0.00% 0.00% 0 Connection Mgr 7 4 106 37 0.00% 0.00% 0.00% 0 Load Meter 8 6240 7376 845 0.23% 0.15% 0.55% 0 Exec 9 379 62 6112 0.00% 0.07% 0.04% 0 Check heaps 10 0 1 0 0.00% 0.00% 0.00% 0 Pool Manager 11 3 2 1500 0.00% 0.00% 0.00% 0 Timers 12 0 1 0 0.00% 0.00% 0.00% 0 AAA_SERVER_DEADT 13 0 2 0 0.00% 0.00% 0.00% 0 AAA high-capacit 14 307 517 593 0.00% 0.05% 0.03% 0 EnvMon 15 0 1 0 0.00% 0.00% 0.00% 0 OIR Handler 16 283 58 4879 0.00% 0.04% 0.02% 0 ARP Input 17 0 2 0 0.00% 0.00% 0.00% 0 Serial Backgroun 18 0 81 0 0.00% 0.00% 0.00% 0 ALARM_TRIGGER_SC 19 0 2 0 0.00% 0.00% 0.00% 0 DDR Timers 20 0 2 0 0.00% 0.00% 0.00% 0 Dialer event 21 4 2 2000 0.00% 0.00% 0.00% 0 Entity MIB API 22 0 54 0 0.00% 0.00% 0.00% 0 Compute SRP rate 23 0 9 0 0.00% 0.00% 0.00% 0 IPC Dynamic Cach 24 0 1 0 0.00% 0.00% 0.00% 0 IPC Zone Manager 25 0 1 0 0.00% 0.00% 0.00% 0 IPC Punt Process 26 4 513 7 0.00% 0.00% 0.00% 0 IPC Periodic Tim 27 11 513 21 0.00% 0.00% 0.00% 0 IPC Deferred Por 28 0 1 0 0.00% 0.00% 0.00% 0 IPC Seat Manager 29 83 1464 56 0.00% 0.00% 0.00% 0 EEM ED Syslog . . . Table 146 describes the significant fields shown in the display. Table 146 show processes cpu detailed (Software Modularity) Field Descriptions Field Description Total CPU utilization for five seconds Total CPU utilization for the last 5 seconds. The second number indicates the percent of CPU time spent at the interrupt level. 1 minute CPU utilization for the last minute. 5 minutes CPU utilization for the last 5 minutes. PID/TID Process ID or task ID. 5Sec Percentage of CPU time spent at the interrupt level for this process during the last five seconds. 1Min Percentage of CPU time spent at the interrupt level for this process during the last minute. 5Min Percentage of CPU time spent at the interrupt level for this process during the last five minutes. Process Process name. Prio Priority level of the process. STATE Current state of the process. CPU CPU utilization of the process in minutes and seconds. type Type of process; can be either IOS or POSIX. Task Task sequence number. show processes cpu CF-935 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Runtime(ms) CPU time that the process has used (in milliseconds). Invoked Number of times that the process has been invoked. uSecs Microseconds of CPU time for each process invocation. 5Sec CPU utilization by task in the last 5 seconds. 1Min CPU utilization by task in the last minute. 5Min CPU utilization by task in the last 5 minutes. TTY Terminal that controls the process. Task Name Task name. Table 146 show processes cpu detailed (Software Modularity) Field Descriptions (continued) Field Description Command Description show processes Displays information about active processes. show processes memory Displays the amount of system memory used per system process. show processes interrupt mask buffer CF-936 Cisco IOS Configuration Fundamentals Command Reference April 2010 show processes interrupt mask buffer To display information in the interrupt mask buffer, use the show processes interrupt mask buffer command in privileged EXEC mode. show processes interrupt mask buffer Command Modes Privileged EXEC Command History Examples The following is sample output from the show processes interrupt mask buffer command. The output displays stack trace and relevant information about the places where interrupts have been masked more than the configured threshold time: Router# show processes interrupt mask buffer Allowable interrupt mask time : 50 micro seconds Allowable number of half pipeline ticks for this platform : 5000 Buffer Size : 50 entries NETS Disable : 3 TTY Disable : 4 ALL Disable : 4 emt_call : 11 disable_interrupts : 12 PID Level Time Spent(us) Count Stack Trace 3 11 360 1 0x608C3C14 0x60894748 0x6089437C 0x608943AC 0x609CEC88 0x609CECFC 0x609C8524 3 11 322 1 0x608C3C14 0x608943BC 0x609CEC88 0x609CECFC 0x609C8524 0x60867C28 0x607C70B0 3 4 147 1 0x6078AED4 0x6078BE94 0x6078C750 0x6078C8D4 0x607E27F0 0x607E27C0 0x607E50B0 Related Commands buffer Displays stack trace and information about the places where interrupts have been masked more than the configured threshold time. Release Modification 12.4(2)T This command was introduced. Command Description clear processes interrupt mask detail Clears the interrupt masked details for all processes and stack traces which have been dumped into the interrupt mask buffer. scheduler interrupt mask profile Enables or disables interrupt mask profiling for all processes running on the system. scheduler interrupt mask size Configures the maximum number of entries that can exist in the interrupt mask buffer. show processes interrupt mask buffer CF-937 Cisco IOS Configuration Fundamentals Command Reference April 2010 scheduler interrupt mask time Configures the maximum amount of time a process can run with interrupts masked. show processes interrupt mask detail Displays interrupt masked details for the specified process or all processes in the system. Command Description show processes interrupt mask detail CF-938 Cisco IOS Configuration Fundamentals Command Reference April 2010 show processes interrupt mask detail To display information about interrupt masking, use the show processes interrupt mask detail command in privileged EXEC mode. show processes interrupt mask detail [pid] Syntax Description Command Modes Privileged EXEC Command History Examples The following is sample output from the show processes interrupt mask detail command. the output displays information about the total amount of time and number of times interrupts have been masked by all processes: Router# show processes interrupt mask detail PID Time Spent(us) Count Process Name 2 6388 1791 Load Meter 3 7957 16831 Exec 5 6710 2813 Check heaps The following is sample output from the show processes interrupt mask detail command with the process ID specified. The output displays the total time (accumulative), number of times interrupts have been masked by a specific process: Router# show processes interrupt mask detail 2 Process ID : 2 Process Name : Load Meter Total Interrupt Masked Time : 6586 (us) Total Interrupt Masked Count : 1845 Related Commands detail Displays information about the total amount of time and the number of times interrupts have been masked by all processes. pid (Optional) An integer that specifies the process id for which to display the total accumulated time and the number of times interrupts have been masked. Release Modification 12.4(2)T This command was introduced. Command Description clear processes interrupt mask detail Clears the interrupt masked details for all processes and stack traces which have been dumped into the interrupt mask buffer. scheduler interrupt mask profile Enables or disables interrupt mask profiling for all processes running on the system. show processes interrupt mask detail CF-939 Cisco IOS Configuration Fundamentals Command Reference April 2010 scheduler interrupt mask size Configures the maximum number of entries that can exist in the interrupt mask buffer. scheduler interrupt mask time Configures the maximum amount of time a process can run with interrupts masked. show processes interrupt mask buffer Displays the information stored in the interrupt mask buffer. Command Description show processes memory CF-940 Cisco IOS Configuration Fundamentals Command Reference April 2010 show processes memory To show the amount of memory used by each system process in Cisco IOS or Cisco IOS Software Modularity images, use the show processes memory command in privileged EXEC mode. Cisco IOS Software show processes memory [process-id | sorted [allocated | getbufs | holding]] Cisco IOS Software Modularity show processes memory [detailed [process-name[:instance-id] | process-id [taskid task-id]]] [alloc-summary | sorted {start | size | caller}] Syntax Description Command Default Cisco IOS Software The memory used by all types of system processes is displayed. Cisco IOS Software Syntax process-id (Optional) Process ID (PID) of a specific process. When you specify a process ID, only details for the specified process will be shown. sorted (Optional) Displays memory data sorted by the “Allocated, ” “Getbufs,” or “Holding” column. If the sorted keyword is used by itself, data is sorted by the “Holding” column by default. allocated (Optional) Displays memory data sorted by the “Allocated” column. getbufs (Optional) Displays memory data sorted by the “Getbufs” (Get Buffers) column. holding (Optional) Displays memory data sorted by the “Holding” column. This is the default. Cisco IOS Software Modularity Syntax detailed (Optional) Displays detailed information about iosproc processes. process-name (Optional) Process name. :instance-id (Optional) Instance name of either the Cisco IOS task or POSIX process. The colon is required. process-id (Optional) Process identifier. taskid (Optional) Displays detailed memory usage of a Cisco IOS task within a process. task-id (Optional) Cisco IOS task identifier. alloc-summary (Optional) Displays summary POSIX process memory usage per allocator. sorted (Optional) Displays POSIX process memory usage sorted by start address, size, or the PC that called the process. start (Optional) Displays POSIX process memory usage sorted by start address of the process. size (Optional) Displays POSIX process memory usage sorted by size of the process. caller (Optional) Displays POSIX process memory usage sorted by the PC that called the process. show processes memory CF-941 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco IOS Software Modularity The system memory followed by a one-line summary of memory information about each Software Modularity process is displayed. Command Modes Privileged Exec (#) Command History Release Modification 10.0 This command was introduced. 12.0(23)S The sorted [allocated | getbufs | holding] syntax was introduced. [CSCdy22469] 12.2(13) The sorted [allocated | getbufs | holding] syntax was integrated in Cisco IOS Release 12.2(13). 12.2(13)S The sorted [allocated | getbufs | holding] syntax was integrated in Cisco IOS Release 12.2(13)S. 12.2(13)T The sorted [allocated | getbufs | holding] syntax was integrated in Cisco IOS Release 12.2(13)T. 12.0(28)S The output of the header line was updated to support the Memory Thresholding feature. 12.2(22)S The output of the header line was updated to support the Memory Thresholding feature. 12.3(7)T The output of the header line was updated to support the Memory Thresholding feature. 12.0(30)S The summary information (first lines of output) for this command was separated out and labeled by memory pool type (Total Process Memory, Total I/O Memory, and so on). This enhancement also corrected a total process memory mismatch error (mismatch between show processes memory, show processes memory sorted, and show memory and its variants). 12.2(28)S The summary information (first lines of output) for this command was separated out and labeled by memory pool type (Total Process Memory, Total I/O Memory, and so on). This enhancement also corrected a total process memory mismatch error (mismatch between show processes memory, show processes memory sorted, and show memory and its variants). 12.3(11)T The summary information (first lines of output) for this command was separated out and labeled by memory pool type (Total Process Memory, Total I/O Memory, and so on). This enhancement also corrected a total process memory mismatch error (mismatch between show processes memory, show processes memory sorted, and show memory and its variants). 12.2(18)SXF4 The syntax was modified to support Cisco IOS Software Modularity images. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show processes memory CF-942 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines The show processes memory command (and show processes memory sorted command) displays a summary of total, used, and free memory, followed by a list of processes and their memory impact. If the standard show processes memory process-id command is used, processes are sorted by their process ID (PID). If the show processes memory sorted command is used, the default sorting is by the Holding value. Output Prior to Releases 12.3(7)T, 12.2(22)S, and 12.0(28)S The first line (header line) of the show processes memory [sorted] command listed Total memory, Used memory, and Free memory values. Output in Releases 12.3(7)T, 12.3(8)T, 12.2(22)S Through 12.2(27)S2, 12.0(28)S, and 12.0(29)S In Releases 12.3(7)T, 12.2(22)S, and 12.0(28)S, the “Memory Thresholding” feature was introduced. This feature affected the header line and the “Holding” column of the show processes memory command as follows. The value for “Total” in the show processes memory command and the values listed in the “Holding” column, showed the total (cumulative) value for the processor memory pools and the alternate memory pool* (typically, the I/O memory pool). However, the show processes memory sorted version of this command, and other commands, such as the show memory summary command, did not include the alternate memory pool in the totals (in other words, these commands showed the total value for the Processor memory pool only). This caused an observed mismatch of memory totals between commands. If you are using these releases, use the output of show memory summary command to determine the individual amounts of Total and Free memory for the Processor memory pool and the I/O memory pool. Output in Releases 12.3(11)T, 12.2(28)S, 12.0(30)S and Later Releases Beginning in Releases 12.3(11)T, 12.2(28)S, and 12.0(30)S, the summary information (first output lines) for the show processes memory command is separated by memory pool. For example, there are now individual lines for “Total Process Memory,” “Total I/O Memory,” and “Total PCI Memory.” If using these releases or later releases, your Total Process Memory should match the total process memory shown for other commands, such as the show memory summary command. About Alternate Memory Pools An “alternate memory pool” is a memory pool which can be used as an alternative to allocate memory when the target (main) memory pool has been filled. For example, many platforms have a memory type called “Fast” that is limited to a small size (because the memory media used for Fast memory is expensive). To prevent memory allocations from failing once the available Fast memory has been used up, the normal Processor memory can be configured as an alternative memory pool for the Fast memory pool. Cisco IOS Software Modularity Use the show processes memory command without any arguments and keywords to display the system memory followed by a one-line summary of memory information about each modular Cisco IOS process. Use the detailed keyword with this command to display detailed memory information about all processes. Other arguments and keywords are used to display Cisco IOS Software Modularity process memory information for a specified process name or process ID. Examples Example output varies between Cisco IOS software releases. To view the appropriate output, choose one of the following sections: • show processes memory Command for Releases Prior to 12.3(7)T, 12.2(22)S, and 12.0(28)S show processes memory CF-943 Cisco IOS Configuration Fundamentals Command Reference April 2010 • show processes memory Command for Releases Prior to 12.3(11)T, 12.2(28)S, and 12.0(30)S • show processes memory Command for Cisco IOS Software Modularity show processes memory Command for Releases Prior to 12.3(7)T, 12.2(22)S, and 12.0(28)S The following is sample output from the show processes memory command: Router# show processes memory Processor Pool Total: 25954228 Used: 8368640 Free: 17585588 PID TTY Allocated Freed Holding Getbufs Retbufs Process 0 0 8629528 689900 6751716 0 0 *Init* 0 0 24048 12928 24048 0 0 *Sched* 0 0 260 328 68 350080 0 *Dead* 1 0 0 0 12928 0 0 Chunk Manager 2 0 192 192 6928 0 0 Load Meter 3 0 214664 304 227288 0 0 Exec 4 0 0 0 12928 0 0 Check heaps 5 0 0 0 12928 0 0 Pool Manager 6 0 192 192 12928 0 0 Timers 7 0 192 192 12928 0 0 Serial Backgroun 8 0 192 192 12928 0 0 AAA high-capacit 9 0 0 0 24928 0 0 Policy Manager 10 0 0 0 12928 0 0 ARP Input 11 0 192 192 12928 0 0 DDR Timers 12 0 0 0 12928 0 0 Entity MIB API 13 0 0 0 12928 0 0 MPLS HC Counter 14 0 0 0 12928 0 0 SERIAL A'detect . . . 78 0 0 0 12992 0 0 DHCPD Timer 79 0 160 0 13088 0 0 DHCPD Database 8329440 Total Table 147 describes the significant fields shown in the display. Table 147 show processes memory Field Descriptions Field Description Processor Pool Total Total amount of memory, in kilobytes, held for the Processor memory pool. Used Total amount of used memory, in kilobytes, in the Processor memory pool. Free Total amount of free memory, in kilobytes, in the Processor memory pool. PID Process ID. TTY Terminal that controls the process. Allocated Bytes of memory allocated by the process. Freed Bytes of memory freed by the process, regardless of who originally allocated it. Holding Amount of memory, in kilobytes, currently allocated to the process. Getbufs Number of times the process has requested a packet buffer. Retbufs Number of times the process has relinquished a packet buffer. Process Process name. *Init* System initialization process. show processes memory CF-944 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following is sample output from the show processes memory command when the sorted keyword is used. In this case, the output is sorted by the “Holding” column, from largest to smallest. Router# show processes memory sorted Processor Pool Total: 25954228 Used: 8371280 Free: 17582948 PID TTY Allocated Freed Holding Getbufs Retbufs Process 0 0 8629528 689900 6751716 0 0 *Init* 3 0 217304 304 229928 0 0 Exec 53 0 109248 192 96064 0 0 DHCPD Receive 56 0 0 0 32928 0 0 COPS 19 0 39048 0 25192 0 0 Net Background 42 0 0 0 24960 0 0 L2X Data Daemon 58 0 192 192 24928 0 0 X.25 Background 43 0 192 192 24928 0 0 PPP IP Route 49 0 0 0 24928 0 0 TCP Protocols 48 0 0 0 24928 0 0 TCP Timer 17 0 192 192 24928 0 0 XML Proxy Client 9 0 0 0 24928 0 0 Policy Manager 40 0 0 0 24928 0 0 L2X SSS manager 29 0 0 0 24928 0 0 IP Input 44 0 192 192 24928 0 0 PPP IPCP 32 0 192 192 24928 0 0 PPP Hooks 34 0 0 0 24928 0 0 SSS Manager 41 0 192 192 24928 0 0 L2TP mgmt daemon 16 0 192 192 24928 0 0 Dialer event 35 0 0 0 24928 0 0 SSS Test Client --More-- The following is sample output from the show processes memory command when a Process ID (process-id) is specified: Router# show processes memory 1 Process ID: 1 Process Name: Chunk Manager Total Memory Held: 8428 bytes Processor memory holding = 8428 bytes pc = 0x60790654, size = 6044, count = 1 pc = 0x607A5084, size = 1544, count = 1 pc = 0x6076DBC4, size = 652, count = 1 pc = 0x6076FF18, size = 188, count = 1 I/O memory holding = 0 bytes Router# show processes memory 2 Process ID: 2 Process Name: Load Meter Total Memory Held: 3884 bytes *Sched* The scheduler process. *Dead* Processes as a group that are now dead. Total Total amount of memory, in kilobytes, held by all processes (sum of the “Holding” column). Table 147 show processes memory Field Descriptions (continued) Field Description show processes memory CF-945 Cisco IOS Configuration Fundamentals Command Reference April 2010 Processor memory holding = 3884 bytes pc = 0x60790654, size = 3044, count = 1 pc = 0x6076DBC4, size = 652, count = 1 pc = 0x6076FF18, size = 188, count = 1 I/O memory holding = 0 bytes show processes memory Command for Releases Prior to 12.3(11)T, 12.2(28)S, and 12.0(30)S The following example shows the output of the show processes memory command before the changes to the summary information were made. Note that the “Total:” in the show processes summary command indicates total memory for all memory pools; in this example, the show processes memory Total of 35423840 can be obtained by adding the Processor and I/O totals shown in the output of the show memory summary command. Note also that the show processes memory sorted command lists the Total Processor Memory (matches the show memory summary Processor Total, but the show processes memory command (without the sorted keyword) lists the Total for all memory pools (Processor plus I/O memory). Router# show version | include IOS Cisco IOS Software, 3600 Software (C3660-BIN-M), Version 12.3(9) Router# show memory summary Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor 61E379A0 27035232 8089056 18946176 17964108 17963664 I/O 3800000 8388608 2815088 5573520 5561520 5573472 . . . Router# show processes memory Total: 35423840, Used: 10904192, Free: 24519648 PID TTY Allocated Freed Holding Getbufs Retbufs Process 0 0 14548868 3004980 9946092 0 0 *Init* 0 0 12732 567448 12732 0 0 *Sched* . . . Router# show processes memory sorted Total: 27035232, Used: 8089188, Free: 18946044 PID TTY Allocated Freed Holding Getbufs Retbufs Process 0 0 14548868 3004980 9946092 0 0 *Init* 64 0 76436 3084 74768 0 0 CEF process . . . Router# show version | include IOS Cisco IOS Software, 3600 Software (c3660-p-mz), Version 12.0(29)S, Router# show memory summary Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor 126CB10 49,331,668 6454676 42876992 42642208 42490796 Router# show processes memory show processes memory CF-946 Cisco IOS Configuration Fundamentals Command Reference April 2010 Total: 50,994,868, Used: 6220092, Free: 44774776 PID TTY Allocated Freed Holding Getbufs Retbufs Process 0 0 6796228 627336 5325956 0 0 *Init* 0 0 200 29792 200 0 0 *Sched* 0 0 192 744 0 349000 0 *Dead* 1 0 0 0 12896 0 0 Chunk Manager . . Router# show processes memory sorted Total: 50,994,868, Used: 6222644, Free: 44772224 PID TTY Allocated Freed Holding Getbufs Retbufs Process 0 0 6796228 627336 5325956 0 0 *Init* 13 0 39056 0 25264 0 0 Net Background 48 0 0 0 24896 0 0 L2X SSS manager 18 0 0 0 24896 0 0 IP Input . . show processes memory Command for Cisco IOS Software Modularity The following is sample output from the show processes memory command when a Cisco IOS Software Modularity image is running: Router# show processes memory System Memory : 262144K total, 113672K used, 148472K free PID Text Data Stack Dynamic Total Process 1 0 0 12 0 12 kernel 12290 52 8 28 196 284 dumper.proc 3 12 8 8 144 172 devc-pty 4 132 8 8 32 180 devc-ser2681 6 16 12 24 48 100 pipe 8199 12 12 8 48 80 mqueue 8200 16 24 48 452 540 fsdev.proc 8201 52 20 8 96 176 flashfs_hes_slot1.proc 8202 52 20 8 80 160 flashfs_hes_bootflash.proc 8203 52 20 8 128 208 flashfs_hes_slot0.proc 8204 20 68 12 164 264 dfs_disk1.proc 8205 20 68 12 164 264 dfs_disk0.proc 8206 36 4 8 144 192 ldcache.proc 8207 32 8 20 164 224 syslogd.proc 8208 24 4 28 464 520 name_svr.proc 8209 124 104 28 344 600 wdsysmon.proc 8210 100 144 52 328 624 sysmgr.proc 8211 12 4 28 64 108 kosh.proc 12308 100 144 16 144 404 sysmgr.proc 12309 24 4 12 112 152 chkptd.proc 12310 12 4 8 96 120 syslog_dev.proc 12311 44 4 24 248 320 fh_metric_dir.proc 12312 36 4 24 216 280 fh_fd_snmp.proc 12313 36 4 24 216 280 fh_fd_intf.proc 12314 32 4 24 216 276 fh_fd_timer.proc 12315 40 4 24 216 284 fh_fd_ioswd.proc 12316 28 4 24 200 256 fh_fd_counter.proc 12317 80 20 44 368 512 fh_server.proc 12326 140 40 28 280 488 tcp.proc 12327 48 4 24 256 332 udp.proc 12328 4 4 28 4660 4696 iprouting.iosproc 12329 4 4 36 600 644 cdp2.iosproc show processes memory CF-947 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 148 describes the significant fields shown in the display. The following is sample output from the show processes memory command with details about the memory of the process named cdp2.iosproc: Router# show processes memory detailed cdp2.iosproc System Memory : 262144K total, 113460K used, 148684K free Process sbin/cdp2.iosproc, type IOS, PID = 12329 640K total, 4K text, 4K data, 32K stack, 600K dynamic Memory Summary for TaskID = 1 Holding = 10032 PC Size Count 0x7322FC74 9192 1 0x73236538 640 1 0x73231E8C 200 1 The following is sample output from the show processes memory command with details about the memory of process 12322 and the task with the ID of 1: Router# show processes memory detailed 12322 taskid 1 System Memory : 262144K total, 113456K used, 148688K free Process sbin/c7200-p-blob, type IOS, PID = 12322 16568K total, 16K text, 8K data, 64K stack, 16480K dynamic Memory Summary for TaskID = 1 Holding = 10248 PC Size Count 0x7322FC74 9192 1 0x73236538 640 1 0x73231E8C 256 1 Table 148 show processes memory (Software Modularity) Field Descriptions Field Description total Total amount of memory, in kilobytes, on the device. used Amount of memory, in kilobytes, used in the system. free Amount of free memory, in kilobytes, available in the system. PID Process ID. Text Amount of memory, in kilobytes, used by the text segment of the specified process. Data Amount of memory, in kilobytes, used by the data segment of the specified process. Stack Amount of memory, in kilobytes, used by the stack segment of the specified process. Dynamic Amount of memory, in kilobytes, used by the dynamic segment of the specified process. Total Total amount of memory, in kilobytes, used by the specified process. Process Process name. show processes memory CF-948 Cisco IOS Configuration Fundamentals Command Reference April 2010 0x74175060 160 1 Table 149 describes the significant fields shown in the display that are different from Table 148 on page 947. The following is sample output from the show processes memory command with details about the memory of POSIX process ID 234567 with summary process memory usage per allocator: Router# show processes memory detailed 234567 alloc-summary System Memory : 262144K total, 113672K used, 148472K free Process sbin/sysmgr.proc, type POSIX, PID = 12308 404K total, 100K text, 144K data, 16K stack, 144K dynamic 81920 heapsize, 68620 allocated, 8896 free Allocated Blocks Address Usize Size Caller 0x0806C358 0x00000478 0x000004D0 0x721C7290 0x0806D1E0 0x00000128 0x00000130 0x72B90248 0x0806D318 0x00003678 0x000036E0 0x72B9820C 0x0806D700 0x000002A0 0x000002C0 0x72B8EB58 0x0806D770 0x00000058 0x00000060 0x72BA5488 0x0806D7D8 0x000000A0 0x000000B0 0x72B8D228 0x0806D8A8 0x00000200 0x00000208 0x721A728C 0x0806FF78 0x00000068 0x00000070 0x72BA78EC 0x08071438 0x0000005C 0x00000068 0x72B908A8 0x08071508 0x0000010E 0x00000120 0x72BA7AFC 0x08072840 0x000000A8 0x000000C0 0x7270A060 0x08072910 0x0000010C 0x00000118 0x7273A898 0x08072A30 0x000000E4 0x000000F0 0x72749074 0x08072B28 0x000000B0 0x000000B8 0x7276E87C 0x08072BE8 0x0000006C 0x00000078 0x727367A4 0x08072C68 0x000000B8 0x000000C0 0x7271E2A4 0x08072D30 0x000000D0 0x000000D8 0x7273834C 0x08072E10 0x00000250 0x00000258 0x72718A70 0x08073070 0x000002F4 0x00000300 0x72726484 0x08073378 0x000006A8 0x000006B0 0x73EA4DC4 0x08073A30 0x00000060 0x00000068 0x7352A9F8 0x08073B38 0x00000068 0x00000070 0x72B92008 0x08073BB0 0x00000058 0x00000060 0x72B9201C 0x08073EB8 0x00002FB4 0x000031C0 0x08026FEC 0x08074028 0x000020B8 0x000020C0 0x72709C9C 0x08077400 0x000000A0 0x000000A8 0x721DED94 0x08078028 0x000022B8 0x000022C0 0x727446B8 0x0807C028 0x00002320 0x00002328 0x72B907C4 Free Blocks Table 149 show processes memory detailed process-id taskid Field Descriptions Field Description type Type of process: POSIX or Cisco IOS. Memory summary for TaskID Task ID. Holding Amount of memory, in bytes, currently held by the task. PC Caller PC of the task. Size Amount of memory, in bytes, used by this task. Count Number of times that task has been called. show processes memory CF-949 Cisco IOS Configuration Fundamentals Command Reference April 2010 Address Size 0x0806FFF0 0x00000010 0x080714A8 0x00000058 0x08073E18 0x00000098 0x08073FE8 0x00000018 0x08076FA0 0x00000328 0x080774B0 0x00000B50 0x0807FFB8 0x00000048 0x08080028 0x00003FD8 Table 150 describes the significant fields shown in the display. Related Commands Table 150 show processes memory detailed alloc-summary Field Descriptions Field Description heapsize Size of the process heap, in kilobytes. allocated Amount of memory, in kilobytes, allocated from the heap. free Amount of free memory, in kilobytes, in the heap for the specified process. Address Block address, in hexadecimal. Usize Block size, in hexadecimal, without the trailer header. Size Block size, in hexadecimal. Caller Caller PC of the allocator of this block. Command Description show memory Displays statistics about memory, including memory-free pool statistics. show processes Displays information about the active processes. CF-950 Cisco IOS Configuration Fundamentals Command Reference April 2010 show protocols CF-951 Cisco IOS Configuration Fundamentals Command Reference April 2010 show protocols To display the configured protocols, use the show protocols command in user EXEC or privileged EXEC mode. show protocols [interface-name interface-number] Syntax Description interface-name (Optional) The type of interfaces. It can be one of the following values: • ATM—ATM interface • Async—Async interface • Auto-Template—Auto-Template interface • BVI—Bridge-Group Virtual Interface • CDMA-Ix—CDMA Ix interface • Container—Container interface • CTunnel—CTunnel interface • Dialer—Dialer interface • Ethernet—Institute of Electrical Electronics Engineers (IEEE) 802.3 • FastEthernet—FastEthernet IEEE 802.3 • EsconPhy—ESCON interface • fcpa—Fiber Channel • Filter—Filter interface • multiservice—Multiservice interface • Pos-channel—POS Channel interfaces • SBC—Session Border Controller • SYSCLOCK—Telecom-Bus Clock Controller • Tunnel—Tunnel interface • Vif—PGM Multicast Host interface • Virtual-Access—Virtual access interface • Virtual-PPP—Virtual PPP interface • Virtual-Template—Virtual template interface • Virtual-TokenRing—Virtual TokenRing • Vlan—Catalyst VLANs • vmi—Virtual Multipoint Interface show protocols CF-952 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Modes User EXEC (>) Privileged EXEC (#) Command History Usage Guidelines The show protocols command shows the global and interface-specific status of any configured Level 3 protocol. Examples The following is sample output from the show protocols command. The field names are self-explanatory. Router# show protocols Global values: Internet Protocol routing is enabled FastEthernet0/0 is up, line protocol is up Internet address is 10.4.9.14/24 vmi1 is down, line protocol is down FastEthernet0/1 is up, line protocol is up Internet address is 10.4.8.14/24 ATM2/0 is administratively down, line protocol is down ATM2/0.1 is administratively down, line protocol is down ATM2/0.2 is administratively down, line protocol is down ATM2/0.200 is administratively down, line protocol is down Ethernet3/0 is administratively down, line protocol is down Ethernet3/0.1 is administratively down, line protocol is down Ethernet3/1 is administratively down, line protocol is down Ethernet3/2 is administratively down, line protocol is down Ethernet3/3 is administratively down, line protocol is down ATM6/0 is administratively down, line protocol is down SSLVPN-VIF0 is up, line protocol is up Interface is unnumbered. Using address of SSLVPN-VIF0 (0.0.0.0) Virtual-Access1 is down, line protocol is down • voaBypassIn—VOA-Bypass-In interface • voaBypassOut—VOA-Bypass-Out interface • voaFilterIn—VOA-Filter-In interface • voaFilterOut—VOA-Filter-Out interface • voaIn—VOA-In interface • voaOut—VOA-Out interface interface-number (Optional) Interface number. Release Modification 10.0 This command was introduced. 12.0(3)T The command was integrated in a release earlier than Cisco IOS Release 12.0(3)T. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was integrated into Cisco IOS XE Release 2.1. show protocols CF-953 Cisco IOS Configuration Fundamentals Command Reference April 2010 Virtual-Template1 is down, line protocol is down Virtual-Access2 is up, line protocol is up Port-channel5 is down, line protocol is down Port-channel5.1 is down, line protocol is down Port-channel15 is down, line protocol is down Virtual-Template100 is down, line protocol is down Interface is unnumbered. Using address of vmi1 (0.0.0.0) Dialer3 is up, line protocol is up For more information on the parameters or protocols shown in this sample output, see the Cisco IOS IP Addressing Services Configuration Guide and the Cisco IOS IP Routing Protocols Configuration Guide. show region CF-954 Cisco IOS Configuration Fundamentals Command Reference April 2010 show region To display valid memory regions (memory mapping) in use on your system, use the show region command in privileged EXEC mode. show region [address hex-address] Syntax Description Command Default All memory regions are displayed. Command Modes Privileged EXEC (#) Command History Usage Guidelines This command can be useful for troubleshooting system bus errors. The system encounters a bus error when the processor tries to access a memory location that either does not exist (a software error) or does not respond properly (a hardware problem). To use the show region command to troubleshoot a bus error, note the memory location address from the show version command, the show context command, or from the system error message that alerted you to the bus error. The show region command can then be used to determine if that address is a valid memory location. For example, in the output of the show version command after a system restart caused by a bus error, you will see output similar to “System restarted by bus error at PC 0x30EE546, address 0xBB4C4.” In this case, the memory location that the router tried to access is 0xBB4C4. If the address falls within one of the ranges in the show region output, it means that the router was accessing a valid memory address, but the hardware corresponding to that address is not responding properly. This indicates a hardware problem. If the address reported by the bus error does not fall within the ranges displayed in the show region output, this error means that the router was trying to access an address that is not valid, which indicates that it is a Cisco IOS software problem. More detailed information is available on Cisco.com in Tech Note #7949, Troubleshooting Bus Error Crashes. address hex-address (Optional) If a hexadecimal address is specified, this command will search the region list for the specified address. Release Modification 12.2(13) This command was introduced. 12.0(23)S This command was integrated into Cisco IOS Release 12.0(23)S. 12.2(25)S This command was modified. The command output was updated to display information about free regions. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SRE This command was modified. The output was updated to display heap region memory size in chunks of 16 MB. show region CF-955 Cisco IOS Configuration Fundamentals Command Reference April 2010 Transient Memory Allocation The Transient Memory Allocation feature is enabled on platforms like the Cisco 7200 series router and the Cisco 10000 series router. This feature allocates all transient memory in a separate memory address space (separate region), so that there is no interleaving of static and transient memory blocks. Hence, the output of the show region command will have heap region memory size in chunks of 16 MB. Examples The following is sample output from the show region command: Router# show region Region Manager: Start End Size(b) Class Media Name 0x0C000000 0x0FFFFFFF 67108864 Iomem R/W iomem 0x20000000 0x2FFFFFFF 268435456 Local R/W extended_2 0x50000000 0x5FFFFFFF 268435456 Local R/W extended_1 0x60000000 0x7BFFFFFF 469762048 Local R/W main 0x600090F8 0x6200A807 33560336 IText R/O main:text 0x62014C50 0x62F5B1EF 16016800 IData R/W main:data 0x62F5B1F0 0x6333500F 4038176 IBss R/W main:bss 0x63335010 0x6359A0D3 2511044 Local R/W main:saved-data 0x6359A0D4 0x6459A0D3 16777216 Local R/W main:heap 0x7B000000 0x7BFFFFFF 16777216 Local R/W main:heap 0x80000000 0x8BFFFFFF 201326592 Local R/W main:(main_k0) 0xA0000000 0xABFFFFFF 201326592 Local R/W main:(main_k1) Free Region Manager: Start End Size(b) Class Media Name 0x6459A12C 0x7AFFFFA7 380001916 Local R/W heap Table 151 describes the significant fields shown in the display. Table 151 show region Field Descriptions Field Description Start Start address of the memory block. End End address of the memory block. Size(b) Size of the memory block. Class Class of the memory. Media Type of the region media. Read-only (R/O), read-write (R/W), and so on. Name Name of the region. Iomem Input/output (I/O) memory. It is a type of packet memory. Local Local memory. IText Image text memory. IData Image data memory. IBss Image blind source separation (BSS) memory. R/W Read and write memory. R/O Read-only memory. show region CF-956 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description show context Displays information stored in NVRAM when an unexpected system reload (system exception) occurs. show memory Displays detailed memory statistics for the system. show version Shows hardware and software information for the system. show registry CF-957 Cisco IOS Configuration Fundamentals Command Reference April 2010 show registry To display the function registry information when Cisco IOS or Cisco IOS Software Modularity images are running, use the show registry command in user EXEC or privileged EXEC mode. Cisco IOS Software show registry [registry-name [registry-number]] [brief | statistics] Cisco IOS Software Modularity show registry [name [registry-name [registry-number]]] [brief [name [registry-name [registry-number]]] | preemptions | rpcp status | statistics [brief] [name [registry-name [registry-number]]] [remote]] [process {process-name | process-id}] Syntax Description Command Default If no options are specified, registry information is displayed for all registries. Command Modes User EXEC (>) Privileged EXEC (#) Cisco IOS Software Syntax registry-name (Optional) Name of the registry to display. registry-number (Optional) Number of the registry to display. brief (Optional) Displays limited functions and services information. statistics (Optional) Displays function registry statistics. Cisco IOS Software Modularity Syntax name (Optional) Displays information about a specific registry. registry-name (Optional) Name of the registry to examine. registry-number (Optional) Number of the registry to examine. brief (Optional) Displays limited functions and services information. preemptions (Optional) Displays registry preemptions information. rpcp status (Optional) Displays status of remote procedure call (RPC) proxy. statistics (Optional) Displays function registry statistics. remote (Optional) Displays name server interactions and call statistics. process (Optional) Displays process-specific information. process-name (Optional) Process name. process-id (Optional) Process ID. Number in range from 1 to 4294967295. show registry CF-958 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command History Examples Example output varies between Cisco IOS software images and Cisco IOS Software Modularity software images. To view the appropriate output, choose one of the following sections: • Cisco IOS Software • Cisco IOS Software Modularity Cisco IOS Software The following is sample output from the show registry command using the brief keyword: Router# show registry atm 3/0/0 brief Registry objects: 1799 bytes: 213412 -- Registry 23: ATM Registry Service 23/0: Service 23/1: Service 23/2: Service 23/3: Service 23/4: Service 23/5: Service 23/6: Service 23/7: Service 23/8: Service 23/9: Service 23/10: Service 23/11: Service 23/12: Service 23/13: Service 23/14: . . . Registry 25: ATM routing Registry Service 25/0: Table 152 describes the significant fields shown in the display. Release Modification 11.1 This command was introduced. 12.2(18)SXF4 Keywords and arguments were added to support Software Modularity images and this command was integrated into Cisco IOS Release 12.2(18)SXF4. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 152 show registry brief (Cisco IOS) Field Descriptions Field Description Registry objects Number of objects in the registry. bytes Registry size, in bytes. Registry Displays the specified registry service number and type of registry service. show registry CF-959 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco IOS Software Modularity The following is partial sample output from the show registry command when running a software Modularity image: Router# show registry Registry information for ios-base:1: ===================================================== ---------------------------- AAA_ACCOUNTING : 11 services / 1 : List list[000] / 2 : List list[000] / 3 : Case size[020] list[000] default=0x7267C5D0 returnd / 4 : Case size[020] list[000] default=0x7267C5D0 returnd 16 0x72779400 / 5 : Case size[020] list[000] default=0x7267C5D0 returnd / 6 : Case size[020] list[000] default=0x7267C5D0 returnd 16 0x7277915C / 7 : Retval size[020] list[000] default=0x7267C5E4 returno / 8 : Retval size[020] list[000] default=0x7267C5E4 returno / 9 : Retval size[020] list[000] default=0x7267C5E4 returno / 10 : Stub 0x7267C5E4 return_zero / 11 : Stub 0x76545BA0 AAA_ACCOUNTING : 11 services, 140 global bytes, 160 heap bytes . . . Table 153 describes the significant fields shown in the display. Table 153 show registry (Software Modularity) Field Descriptions Field Description Registry information Displays the registry information by process name. services Number of services displayed. global bytes Number of bytes for the service, heap bytes Size of the service heap, in bytes, show reload CF-960 Cisco IOS Configuration Fundamentals Command Reference April 2010 show reload To display the reload status on the router, use the show reload command in EXEC mode. show reload Syntax Description This command has no arguments or keywords. Command Modes EXEC Command History Usage Guidelines You can use the show reload command to display a pending software reload. To cancel the reload, use the reload cancel privileged EXEC command. Examples The following sample output from the show reload command shows that a reload is schedule for 12:00 a.m. (midnight) on Saturday, April 20: Router# show reload Reload scheduled for 00:00:00 PDT Sat April 20 (in 12 hours and 12 minutes) Router# Related Commands Release Modification 11.2 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description reload Reloads the operating system. show resource-pool queue CF-961 Cisco IOS Configuration Fundamentals Command Reference April 2010 show resource-pool queue To display resource pool and queue information about the router, use the show resource-pool queue command in user EXEC or privileged EXEC mode. show resource-pool queue {description | statistics} Syntax Description Command Modes User EXEC (>) Privileged EXEC (#) Command History Usage Guidelines Use the show resource-pool queue command to display the resource pool and queue information on the router. Examples The following is sample output from the show resource-pool queue description command. The field descriptions are self-explanatory. Router# show resource-pool description Resource-management call state description State Description --------------------------- ----------- RM_DNIS_AUTHOR : Waiting for DNIS author RM_DNIS_AUTH_SUCCEEDED : Waiting for resource alloc RM_DNIS_RES_ALLOCATED : Call established RM_DNIS_REQ_IDLE : Disc while in RM_DNIS_AUTHOR/RM_DNIS_AUTH_SUCCEEDED /RM_DNIS_REQ_IDLE_AUTHOR RM_DNIS_REQ_IDLE_AUTHOR : New call while in RM_DNIS_REQ_IDLE RM_RPM_RES_AUTHOR : Waiting for RPM author RM_RPM_RES_ALLOCATING : Waiting for resource alloc RM_RPM_RES_ALLOCATED : RPM call established RM_RPM_AUTH_REQ_IDLE : Disc while in RM_RPM_RES_AUTHOR /RM_RPM_AUTH_REQ_IDLE_AUTHOR RM_RPM_RES_REQ_IDLE : Disc while in RM_RPM_RES_ALLOCATING /RM_RPM_RES_REQ_IDLE_AUTHOR RM_RPM_AUTH_REQ_IDLE_AUTHOR: New call while in RM_RPM_AUTH_REQ_IDLE RM_RPM_RES_REQ_IDLE_AUTHOR : New call while in RM_RPM_RES_REQ_IDLE RM_RPM_DISCONNECTING : RPM initiates disconnect and is waiting for ack RM_RPM_DISCONNECTING_AUTHOR: New call while in RM_RPM_DISCONNECTING 5400-XM-1#sh resource-pool queue stat description Displays information about the resource-pool queue description. statistics Displays information about the resource-pool queue statistics. Release Modification 15.0(1)M This command was introduced in a release earlier than Cisco IOS Release 15.0(1)M. show resource-pool queue CF-962 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following is sample output from the show resource-pool queue statistics command: Router# show resource-pool statistics Resource-management event queue information (queue depth 0) Event In queue Total --------------------------- ---------- ---------- DIALER_INCALL : 0 0 DIALER_DISCON : 0 0 GUARDTIMER_EXPIRY_EVENT : 0 0 RM_DNIS_AUTHOR_SUCCESS : 0 0 RM_DNIS_AUTHOR_FAIL : 0 0 RM_DNIS_RES_ALLOC_SUCCESS : 0 0 RM_DNIS_RES_ALLOC_FAIL : 0 0 RM_DNIS_RPM_REQUEST : 0 0 RM_RPM_RES_AUTHOR_SUCCESS : 0 0 RM_RPM_RES_AUTHOR_FAIL : 0 0 RM_RPM_RES_ALLOC_SUCCESS : 0 0 RM_RPM_RES_ALLOC_FAIL : 0 0 RM_RPM_DISC_ACK : 0 0 --------------------------- ---------- ---------- SUM : 0 0 Resource-management call information (0 active calls) State Active Total --------------------------- ---------- ---------- RM_DNIS_AUTHOR : 0 0 RM_DNIS_AUTH_SUCCEEDED : 0 0 RM_DNIS_RES_ALLOCATED : 0 0 RM_DNIS_REQ_IDLE : 0 0 RM_DNIS_REQ_IDLE_AUTHOR : 0 0 RM_RPM_RES_AUTHOR : 0 0 RM_RPM_RES_ALLOCATING : 0 0 RM_RPM_RES_ALLOCATED : 0 0 RM_RPM_AUTH_REQ_IDLE : 0 0 RM_RPM_RES_REQ_IDLE : 0 0 RM_RPM_AUTH_REQ_IDLE_AUTHOR: 0 0 RM_RPM_RES_REQ_IDLE_AUTHOR : 0 0 RM_RPM_DISCONNECTING : 0 0 RM_RPM_DISCONNECTING_AUTHOR: 0 0 --------------------------- ---------- ---------- SUM : 0 0 00:03:34 since last clear command Other resource-management info: Active Processes 4 Throttle limit 4 (0 calls rejected) Event queue depth 0 (peak 0) Pending calls 0 (peak 0) Buffer queue depth 648 (low watermark 648) show rom-monitor CF-963 Cisco IOS Configuration Fundamentals Command Reference April 2010 show rom-monitor To show both the read-only and the upgrade ROM monitor (ROMMON) image versions and also the ROMMON image running on the Cisco 7200 VXR or Cisco 7301 router, use the show rom-monitor command in user EXEC, privileged EXEC, or diagnostic mode. Supported Platforms Other than the Cisco ASR1000 Series Routers show rom-monitor Cisco ASR 1000 Series Routers show rom-monitor slot Syntax Description Command Modes User EXEC (>) Privileged EXEC (#) Diagnostic (diag) Command History slot Specifies the slot that contains the ROMMON. Options include: • number—The number of the SIP slot that requires the ROMMON upgrade • F0—Embedded Service Processor slot 0. • F1—Embedded Service Processor slot 1. • FP active—Active Embedded Service Processor. • FP standby—Sstandby Embedded Service Processor. • R0—Route Processor slot 0. • R1—Route Processor slot 1. • RP active—Active Route Processor. • RP standby—Standby Route Processor. Release Modification 12.0(28)S This command was introduced on the Cisco 7200 VXR router. 12.3(9) This command was integrated into Cisco IOS Release 12.3(9) and implemented on the Cisco 7301 router. 12.3(8)T This command was integrated into Cisco IOS Release 12.3(8)T. 12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware. show rom-monitor CF-964 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines Use the show rom-monitor command when the router boots a Cisco IOS software iamge. In this case, the device prompt will be something like “Router>” where “Router” is the hostname of the device. Use the showmon command when the device boot to Rom Monitor mode instead of booting a Cisco IOS image. In this case, the device prompt will be something like “rommon n >” where "n" is a number. Note On Cisco 1800 series routers, the show rom-monitor command does not show the version of the upgradable ROMMON. To view the version of the upgradable ROMMON, you may need to reload the router while using the upgradable ROMMON image. If you are using the read-only ROMMON, then the upgradable ROMMON disappears. You need to run the upgrade rom-monitor file command for the upgradable ROMMON. Otherwise, the upgrade rom-monitor preference upgrade command is rejected with the message “No Upgrade ROMMON present, cannot select it.” During ROMMON bootup, if you are running upgradable ROMMON, then the ROMMON first displays the read-only ROMMON message, “Running new upgrade for first time.” This message is followed by the upgradable ROMMON message. Examples The following sample output from the show rom-monitor command, applicable to both the Cisco 7200 VXR and Cisco 7301 routers, displays both the ROMMON images and verifies that the upgrade ROMMON image is running: Router> show rom-monitor ReadOnly ROMMON version: System Bootstrap, Version 12.2(20031011:151758) Copyright (c) 2004 by Cisco Systems, Inc. Upgrade ROMMON version: System Bootstrap, Version 12.2(20031011:151758) Copyright (c) 2004 by Cisco Systems, Inc. Currently running ROMMON from Upgrade region ROMMON from Upgrade region is selected for next boot The following is sample output from the show rom-monitor command in on Cisco 1800 series routers. To view the version of the upgradable ROMMON, you may need to reload the router while using the upgradable ROMMON image. Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Routers and the following enhancements were introduced: • This command was introduced in diagnostic mode. The command can be entered in both privileged EXEC and diagnostic mode on the Cisco ASR 1000 Series Routers. • The slot argument was introduced. 15.0(1)M The command was modified on Cisco 1800 series routers. The output of the command was modified to let you know that the upgradable ROMMON version is not visible due to the license activity and reload is required. Release Modification show rom-monitor CF-965 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router# show rom-monitor ReadOnly ROMMON version: System Bootstrap, Version 12.3(8r)YH3, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 2005 by cisco Systems, Inc. Upgrade ROMMON version is not visible due to recent license activity, such as license installation, removal, or the use of evaluation license Reload is required to show the upgrade ROMMON version Currently running ROMMON from Upgrade region ROMMON from Upgrade region is selected for next boot Router# reload Proceed with reload? [confirm] *Apr 13 18:44:08.583: %SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload Command. System Bootstrap, Version 12.3(8r)YH3, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 2005 by cisco Systems, Inc. Running new upgrade for first time System Bootstrap, Version 12.3(8r)YH13, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 2008 by cisco Systems, Inc. C1800 platform with 262144 Kbytes of main memory with parity disabled Upgrade ROMMON initialized In the following example, the ROMMON image in RP 0 of a Cisco ASR 1006 router is verified using the show rom-monitor command: Router# show rom-monitor r0 System Bootstrap, Version 12.2(33r)XN1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 2007 by cisco Systems, Inc. The fields in the examples are self-explanatory. show rom-monitor slot CF-966 Cisco IOS Configuration Fundamentals Command Reference April 2010 show rom-monitor slot To display the ROM monitor (ROMMON) status, use the show rom-monitor command in user EXEC or privileged EXEC mode. show rom-monitor slot num {sp | rp} Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines When you enter the show rom-monitor slot command, the output displays the following: • Region region1 and region2—Displays the status of the ROMMON image and the order of preference from which the region1 or region2 images should be booted. The ROMMON image status values are as follows: – First run—Indicates that a check of the new image is being run. – Invalid—Indicates that the new image has been checked and the upgrade process has started. – Approved—Indicates that the ROMMON field upgrade process has completed. • Currently running—This field displays the currently running image and the region. The sp or rp keyword is required only if a supervisor engine is installed in the specified slot. Examples This example shows how to display ROMMON information: Router# show rom-monitor slot 1 sp Region F1:APPROVED Region F2:FIRST_RUN, preferred Currently running ROMMON from F1 region Router# num Displays the slot number of the ROMMON for which the status is to be displayed. sp Displays the ROMMON status of the switch processor. rp Displays the ROMMON status of the route processor. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was integrated into Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show rom-monitor slot CF-967 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description upgrade rom-monitor Sets the execution preference on a ROMMON. show running identity policy CF-968 Cisco IOS Configuration Fundamentals Command Reference April 2010 show running identity policy To display identity policy information, use the show running identity policy command in privileged EXEC mode. show running identity policy [name] Syntax Description Command Modes Privileged EXEC (#) Command History Examples The following is output from the show running identity policy command: Router# show running identity policy Building configuration... Current configuration: identity policy p1 access-group some-acl identity policy p2 access-group another-acl redirect url http://www.foo.com/bar.html match redirect-acl end Related Commands name (Optional) Name of the identity policy. Release Modification 12.2(18)SX This command was introduced. Command Description show running-configuration Displays the running configuration for a router. show running identity profile CF-969 Cisco IOS Configuration Fundamentals Command Reference April 2010 show running identity profile To display identity profile information, use the show running identity profile command in privileged EXEC mode. show running identity profile [ default | dot1x | eapoudp] Syntax Description Command Modes Privileged EXEC (#) Command History Examples The following is output from the show running identity profile command: Router# show running identity profile Building configuration... Current configuration: identity profile default device authorize type cisco ip phone identity profile eapoudp device authorize ip-address 10.0.0.0 255.0.0.0 policy p1 identity profile dot1x device authorize mac-address 0001.0203.0405 ffff.ffff.ffff policy p2 end Related Commands default (Optional) Displays default identity profile information. dot1x (Optional) Displays 802.1x identity profile information. eapoudp (Optional) Displays EAPoUDP identity profile information. Release Modification 12.2(18)SX This command was introduced. Command Description show running-configuration Displays the running configuration for a router. show running-config CF-970 Cisco IOS Configuration Fundamentals Command Reference April 2010 show running-config To display the contents of the current running configuration file or the configuration for a specific module, Layer 2 VLAN, class map, interface, map class, policy map, or virtual circuit (VC) class, use the show running-config command in privileged EXEC mode. show running-config [options] Syntax Description options (Optional) Keywords used to customize output. • all—Expands the output to include the commands that are configured with default parameters. If the all keyword is not used, the output does not display commands configured with default parameters. • brief—Displays the configuration without certification data. The brief keyword can be used with the linenum keyword. • class-map [name] [linenum] —Displays class map information. The linenum keyword can be used with the class-map name option. • control-plane [cef-exception | host | transit] —Displays control-plane information. The cef-exception, host, and transit keywords can be used with control-plane option. • flow {exporter | monitor | record}—Displays global flow configuration commands. The exporter, monitor, and record keywords can be used with the flow option. • full—Displays the full configuration. • interface type number—Displays interface-specific configuration information. If you use the interface keyword, you must specify the interface type and the interface number (for example, interface ethernet 0). Keywords for common interfaces include async, ethernet, fastEthernet, group-async, loopback, null, serial, and virtual-template. Use the show run interface ? command to determine the interfaces available on your system. • linenum—Displays line numbers in the output. The brief or full keyword can be used with the linenum keyword. The linenum keyword can be used with the class-map, interface, map-class, policy-map, and vc-class keywords. • map-class [atm | dialer | frame-relay] [name] [linenum]—Displays map class information. This option is described separately; see the show running-config map-class command page. show running-config CF-971 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Default The default syntax, show running-config, displays the contents of the running configuration file, except commands configured with default parameters. Command Modes Privileged EXEC (#) Command History • partition types —Displays the configuration corresponding to partition. The types keyword can be used with the partition option. • policy-map [name] [linenum]—Displays policy map information. The linenum keyword can be used with the policy-map name option. • vc-class name [linenum]—Displays VC class information (display is available only on certain routers such as the Cisco 7500 series. The linenum keyword can be used with the vc-class name option. • view full—Enables the display of a full running configuration. This is for view-based users who typically can view only configuration commands that they are entitled to access for that particular view. • vrf name—Displays the VRF—aware configuration module number. • vlan [vlan-id]—Specifies the VLAN information to display; valid values are from 1 to 4094. Release Modification 11.0 This command was introduced. 12.0 This command was replaced by the more system:running-config command. 12.0(1)T This command was integrated into Cisco IOS Release 12.0(1)T, and the output modifier (|) was added. 12.2(4)T This command was modified. The linenum keyword was added. 12.3(8)T This command was modified. The view full option was added. 12.2(14)SX This command was integrated into Cisco IOS Release 12.2(14)SX. The module number and vlan vlan-id keywords and arguments were added for the Supervisor Engine 720. 12.2(17d)SXB This command was integrated into Release 12.2(17d)SXB and implemented on the Supervisor Engine 2. 12.2(33)SXH This command was modified. The all keyword was added. 12.2(31)SB2 This command was integrated into Cisco IOS Release 12.2(31)SB2. This command was enhanced to display configuration information for traffic shaping overhead accounting for ATM and was implemented on the Cisco 10000 series router for the PRE3. 12.2(33)SRC This command was integrated into Cisco IOS Release 12.2(33)SRC. 12.2(33)SB This command was modified. Support for the Cisco 7300 series router was added. 12.4(24)T This command was modified in a release earlier than Cisco IOS Release 12.4(24)T. The partition and vrf keywords were added. The module and vlan keywords were removed. show running-config CF-972 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines The show running-config command is technically a command alias (substitute or replacement syntax) of the more system:running-config command. Although more use of commands is recommended (due to their uniform structure across platforms and their expandable syntax), the show running-config command remains enabled to accommodate its widespread use, and to allow typing shortcuts such as show run. The show running-config interface command is useful when there are multiple interfaces and you want to look at the configuration of a specific interface. The linenum keyword causes line numbers to be displayed in the output. This option is useful for identifying a particular portion of a very large configuration. You can enter additional output modifiers in the command syntax by including a pipe character (|) after the optional keyword. For example, show running-config interface serial 2/1 linenum | begin 3. To display output modifiers that are available for a keyword, enter | ? after the keyword. Depending on the platform you are using, the keywords and the arguments for the options argument may vary. Prior to Cisco IOS Release 12.2(33)SXH, show running-config command output omitted configuration commands set with default values. Effective with Release 12.2(33)SXH, the show running-config all command displays more complete configuration information, including default settings and values. For example, if the Cisco Discovery Protocol (abbreviated as CDP in the output) holdtime value is set to its default of 180: • The show running-config command does not display this value. • The show running-config all displays this output: cdp holdtime 180. If the Cisco Discovery Protocol holdtime is changed to a nondefault value (for example, 100), the output of the show running-config and show running-config all commands is the same; that is, the configured parameter is displayed. Note In Release 12.2(33)SXH, implementation of the all keyword expands the output to include some of the commands that are configured with default values. In subsequent Cisco IOS releases, additional configuration commands that are configured with default values will be added to the output of the show running-config all command. Cisco 7600 Series Router In some cases, you might see a difference in the duplex mode that is displayed between the show interfaces command and the show running-config command. The duplex mode that is displayed in the show interfaces command is the actual duplex mode that the interface is running. The show interfaces command displays the operating mode for an interface, and the show running-config command displays the configured mode for an interface. The show running-config command output for an interface might display the duplex mode but no configuration for the speed. This output indicates that the interface speed is configured as auto and that the duplex mode shown becomes the operational setting once the speed is configured to something other than auto. With this configuration, it is possible that the operating duplex mode for that interface does not match the duplex mode that is displayed with the show running-config command. Examples The following example shows the configuration for serial interface 1. The field descriptions are self-explanatory. Router# show running-config interface serial 1 Building configuration... show running-config CF-973 Cisco IOS Configuration Fundamentals Command Reference April 2010 Current configuration: ! interface Serial1 no ip address no ip directed-broadcast no ip route-cache no ip mroute-cache shutdown end The following example shows the configuration for Ethernet interface 0/0. Line numbers are displayed in the output.The field descriptions are self-explanatory. Router# show running-config interface ethernet 0/0 linenum Building configuration... Current configuration : 104 bytes 1 : ! 2 : interface Ethernet0/0 3 : ip address 10.4.2.63 255.255.255.0 4 : no ip route-cache 5 : no ip mroute-cache 6 : end The following example shows how to set line numbers in the command output and then use the output modifier to start the display at line 10. The field descriptions are self-explanatory. Router# show running-config linenum | begin 10 10 : boot-start-marker 11 : boot-end-marker 12 : ! 13 : no logging buffered 14 : enable password ##### 15 : ! 16 : spe 1/0 1/7 17 : firmware location bootflash:mica-modem-pw.172.16.0.0.bin 18 : ! 19 : ! 20 : resource-pool disable 21 : ! 22 : no aaa new-model 23 : ip subnet-zero 24 : ip domain name cisco.com 25 : ip name-server 172.16.11.48 26 : ip name-server 172.16.2.133 27 : ! 28 : ! 29 : isdn switch-type primary-5ess 30 : ! . . . 126 : end The following example shows how to display the module and status configuration for all modules on a Cisco 7600 series router. The field descriptions are self-explanatory. Router# show running-config Building configuration... show running-config CF-974 Cisco IOS Configuration Fundamentals Command Reference April 2010 Current configuration: ! version 12.0 service timestamps debug datetime localtime service timestamps log datetime localtime no service password-encryption ! hostname Router ! boot buffersize 126968 boot system flash slot0:7600r boot bootldr bootflash:c6msfc-boot-mz.120-6.5T.XE1.0.83.bin enable password lab ! clock timezone Pacific -8 clock summer-time Daylight recurring redundancy main-cpu auto-sync standard ! ip subnet-zero ! ip multicast-routing ip dvmrp route-limit 20000 ip cef mls flow ip destination mls flow ipx destination cns event-service server ! spanning-tree portfast bpdu-guard spanning-tree uplinkfast spanning-tree vlan 200 forward-time 21 port-channel load-balance sdip ! ! ! shutdown ! ! . . . In the following sample output from the show running-config command, the shape average command indicates that traffic shaping overhead accounting for ATM is enabled. The BRAS-DSLAM encapsulation type is qinq and the subscriber line encapsulation type is snap-rbe based on the AAL5 service.The field descriptions are self-explanatory Router# show running-config . . . subscriber policy recording rules limit 64 no mpls traffic-eng auto-bw timers frequency 0 call rsvp-sync ! controller T1 2/0 framing sf linecode ami ! controller T1 2/1 framing sf linecode ami show running-config CF-975 Cisco IOS Configuration Fundamentals Command Reference April 2010 ! ! policy-map unit-test class class-default shape average percent 10 account qinq aal5 snap-rbe ! Related Commands Command Description bandwidth Specifies or modifies the bandwidth allocated for a class belonging to a policy map, and enables ATM overhead accounting. boot config Specifies the device and filename of the configuration file from which the router configures itself during initialization (startup). configure terminal Enters global configuration mode. copy running-config startup-config Copies the running configuration to the startup configuration. (Command alias for the copy system:running-config nvram:startup-config command.) shape Shapes traffic to the indicated bit rate according to the algorithm specified, and enables ATM overhead accounting. show interfaces Displays statistics for all interfaces configured on the router or access server. show policy-map Displays the configuration of all classes for a specified service policy map or all classes for all existing policy maps, and displays ATM overhead accounting information, if configured. show startup-config Displays the contents of NVRAM (if present and valid) or displays the configuration file pointed to by the CONFIG_FILE environment variable. (Command alias for the more:nvram startup-config command.) show running-config control-plane CF-976 Cisco IOS Configuration Fundamentals Command Reference April 2010 show running-config control-plane To display the control plane information for the running configuration, use the show running-config control-plane command in privileged EXEC mode. show running-config control-plane [cef-exception | host | transit] Syntax Description Command Default If no keyword is specified, all information about the control plane is displayed. Command Modes Privileged EXEC (#) Command History Examples The following is sample output from the show running-config control-plane command. The field descriptions are self-explanatory. Router# show running-config control-plane Building configuration... Current configuration : 14 bytes ! control-plane ! end Related Commands cef-exception (Optional) Displays information about control plane Cisco Express Forwarding exceptions. host (Optional) Displays information about the control plane host. transit (Optional) Displays information about control plane transit. Release Modification 12.4(24)T This command was introduced in a release earlier than Cisco IOS Release 12.4(24)T. Command Description show running-config Displays the contents of the current running configuration file or the configuration for a specific module. show running-config map-class CF-977 Cisco IOS Configuration Fundamentals Command Reference April 2010 show running-config map-class To display only map-class configuration information from the running configuration file, use the show running-config map-class command in privileged EXEC mode. show running-config map-class [atm [map-class-name] | dialer [map-class-name] | frame-relay [map-class-name]] [linenum] Syntax Description Defaults Displays all map-class configuration in the running configuration file. Command Modes Privileged EXEC Command History Usage Guidelines Use the show running-config map-class command to display the following information from the running configuration file: • All map classes configured on the router. • Map classes configured specifically for ATM, Frame Relay, or dialer. • A specific ATM, Frame Relay, or dialer map class. Use the linenum keyword to display line numbers in the output. This option is useful for identifying a particular portion of a very large configuration. Examples All Map Classes Configured on the Router Example The following example displays all map classes configured on the router: Router# show running-config map-class atm (Optional) Displays only ATM map-class configuration lines. dialer (Optional) Displays only dialer map-class configuration lines. frame-relay (Optional) Displays only Frame Relay map-class configuration lines. map-class-name (Optional) Displays only configuration lines for the specified map-class. linenum (Optional) Displays line numbers in the output. Release Modification 12.1 The map-class extension to the show running-config command was introduced to show only lines pertaining to dialer or Frame Relay map classes. 12.1(2)T The atm, dialer, and frame-relay keywords and map-class-name argument were introduced. 12.2(4)T The linenum keyword was added. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show running-config map-class CF-978 Cisco IOS Configuration Fundamentals Command Reference April 2010 Building configuration... Current configuration: ! map-class frame-relay cir60 frame-relay bc 16000 frame-relay adaptive-shaping becn ! map-class frame-relay cir70 no frame-relay adaptive-shaping frame-relay priority-group 2 ! map-class atm vc100 atm aal5mux ! map-class dialer dialer1 dialer idle-timeout 10 end All Frame Relay Map Classes Example The following example displays all Frame Relay map classes on the router: Router# show running-config map-class frame-relay Building configuration... Current configuration: ! map-class frame-relay cir60 frame-relay bc 16000 frame-relay adaptive-shaping becn ! map-class frame-relay cir70 no frame-relay adaptive-shaping frame-relay priority-group 2 end A Specific Map Class and Display of Line Numbers Example The following example displays a specific map class called class1. Line numbers are displayed in the output. Router# show running-config map-class frame-relay class1 linenum Building configuration... Current configuration: 1 : ! 2 : map-class frame-relay boy 3 : no frame-relay adaptive-shaping 4 : frame-relay cir 1000 5 : end Related Commands Command Description map-class atm Specifies the ATM map class for an SVC. map-class dialer Defines a class of shared configuration parameters associated with the dialer map command for outgoing calls from an ISDN interface and for PPP callback. show running-config map-class CF-979 Cisco IOS Configuration Fundamentals Command Reference April 2010 map-class frame-relay Specifies a map class to define QoS values for a Frame Relay VC. more system:running-config Displays contents of the currently running configuration file (equivalent to the show running-config command.) Command Description show running-config partition CF-980 Cisco IOS Configuration Fundamentals Command Reference April 2010 show running-config partition To display the list of commands that make up the current running configuration for a specific part of the system’s global running configuration, use the show running-config partition command in privileged EXEC mode. show running-config partition part Syntax Description part The part argument will consist of one or more keyword options. These keywords represent a partition of the system’s running configuration state, as a major-descriptor and, in some cases, one or more minor-descriptors. For example, in the command show running-config partition router eigrp 1, the major-descriptor for the part argument is the router keyword, and the minor-descriptors for the part argument are the eigrp 1 keywords. The actual list of part keyword options will depend on your system hardware, what feature set you are running, and what features are currently configured on your system. Some examples of command part keyword options are provided here for reference. Use the show running-config partition ? command on your system to view the list of command options available on your system. • access-list—Displays all running configuration commands that make up the access-list configuration partition. • boot—Displays all running configuration commands that make up the boot configuration partition. • class-map—Displays all running configuration commands that make up the class-map configuration partition. • global-cdp—Displays all running configuration commands that make up the global CDP configuration partition. • interface [type slot/port/number]—Displays all running configuration commands that make up the interfaces configuration partition or the configuration commands that are applied to the specified interface. • line—Displays all running configuration commands that make up the line command configuration partition. • policy-map—Displays all running configuration commands that make up the policy-map configuration partition. • route-map—Displays all running configuration commands that make up the route-map configuration partition. • router [protocol]—Displays all running configuration commands that make up the router configuration partition, or the configuration commands for the specified routing protocol. • service—Displays all running configuration commands that make up the services (small server) configuration partition. • snmp—Displays all running configuration commands that make up the SNMP configuration partition. • | – Allows for the addition of output modifiers. show running-config partition CF-981 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Default None Command Modes Privileged EXEC (#) Command History Usage Guidelines When the Configuration Partitioning feature is enabled, the system groups the configuration state of the device into parts (called “partitions”) for the purpose of generating the virtual running configuration file (the list of configuration commands). The selective processing of the system’s configuration state for the purpose of generating a partial running configuration is called “configuration partitioning.” Note This command is not related to hard drive or flash drive partitioning. This granular access to configuration information offers important performance benefits for high-end routing platforms with very large configuration files, as the system wide generation of a complete virtual configuration file from all components on systems with large and complex configurations can become overly resource intensive and be unacceptably slow. The show running-config partition command allows you to display only the part of the running configuration that you want to examine, while also allowing the system to process only the collection of system components (such as specific interfaces) that you need to display. This is in contrast to other existing extensions to the show running-config command, which only filter the generated list after all system components have been processed. The Configuration Partitioning feature is enabled by default in Cisco IOS software images that support the feature. To disable the feature, use the no parser config partition command. Examples In the following example, the system generates a view of the running configuration by polling only the components associated with the access-list parts of the running configuration state, and then displays only those access-list-related configuration commands. Router# show running-config partition access-list Building configuration... Current configuration : 127 bytes ! Configuration of Partition access-list ! access-list 90 permit 0.0.0.0 1.2.3.5 access-list 100 permit 10 any any ! end Release Modification 12.2(33)SRB This command was introduced for Cisco 7600 series images in Cisco IOS Release 12.2SR as part of the “Configuration Partitioning” feature. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. 12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI. show running-config partition CF-982 Cisco IOS Configuration Fundamentals Command Reference April 2010 In the following example, only the main configuration partition associated with the interface configuration is queried, and only the configuration commands associated with Fast Ethernet interface 0/1 are displayed. Router# show running-config partition interface fastethernet0/1 Building configuration... Current configuration : 213 bytes ! Configuration of Partition interface FastEthernet0/1 ! ! interface FastEthernet0/1 ip address 10.4.2.39 255.255.255.0 no ip route-cache cef no ip route-cache duplex half ipv6 enable no cdp enable ! ! end Related Commands Command Description copy running-config startup-config Copies the running configuration to the default startup configuration file. show interfaces Displays statistics for all interfaces configured on the router or access server. show running-config Generates and displays a virtual configuration file that lists all configuration commands that are in effect on the system. show startup-config Displays the contents of NVRAM (if present and valid) or displays the configuration file pointed to by the CONFIG_FILE environment variable. (Command alias for the more:nvram startup-config command.) show scp CF-983 Cisco IOS Configuration Fundamentals Command Reference April 2010 show scp To display Switch-Module Configuration Protocol (SCP) information, use the show scp in privileged EXEC mode on the Switch Processor. show scp {accounting | counters | linecards [details] | mcast {group group-id | inst} | process id | status} Syntax Description Defaults This command has no default settings. Command Modes Privileged EXEC on the Switch Processor Command History Examples This example shows how to display all the processes that have registered an SAP with SCP: Router# show module Mod Ports Card Type Model Serial No. --- ----- -------------------------------------- ------------------ ----------- 1 48 48-port 10/100 mb RJ45 WS-X6148-RJ-45 SAL091800RY 2 0 2 port adapter Enhanced FlexWAN WS-X6582-2PA JAE0940MH7Z 3 8 8 port 1000mb GBIC Enhanced QoS WS-X6408A-GBIC SAL09391KZH 5 2 Supervisor Engine 720 (Active) WS-SUP720-3BXL SAL09337UE6 accounting Displays information about the SCP accounting. counters Displays information about the SCP counter. linecards Displays information about the Optical Services Module (OSM) wide area network (WAN) modules in the chassis. details (Optional) Displays detailed information about the OSM WAN module. mcast Displays information about the SCP multicast. group group-id (Optional) Displays information for a specific group and group ID; valid values are from 1 to 127. inst (Optional) Displays information for an instance. process id Displays all the processes that have registered an SAP with SCP. status Displays information about the local SCP server status. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(18)SXE The output of the show scp process command was changed to display all the processes that have registered an SAP with SCP on the Supervisor Engine 720 only. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show scp CF-984 Cisco IOS Configuration Fundamentals Command Reference April 2010 6 2 Supervisor Engine 720 (Hot) WS-SUP720-3BXL SAL09148P59 Mod MAC addresses Hw Fw Sw Status --- ---------------------------------- ------ ------------ ------------ ------- 1 0013.c3f8.d2c4 to 0013.c3f8.d2f3 5.0 8.3(1) 8.6(0.366)TA Ok 2 0015.2bc3.5b40 to 0015.2bc3.5b7f 2.1 12.2(nightly 12.2(nightly Ok 3 0015.6324.ed48 to 0015.6324.ed4f 3.1 5.4(2) 8.6(0.366)TA Ok 5 0014.a97d.b0ac to 0014.a97d.b0af 4.3 8.4(2) 12.2(nightly Ok 6 0013.7f0d.0660 to 0013.7f0d.0663 4.3 8.4(2) 12.2(nightly Ok Mod Sub-Module Model Serial Hw Status ---- --------------------------- ------------------ ----------- ------- ------- 5 Policy Feature Card 3 WS-F6K-PFC3BXL SAL09337NVE 1.6 Ok 5 MSFC3 Daughterboard WS-SUP720 SAL09327AU6 2.3 Ok 6 Policy Feature Card 3 WS-F6K-PFC3BXL SAL1033Y0YK 1.8 Ok 6 MSFC3 Daughterboard WS-SUP720 SAL09158XB3 2.3 Ok Mod Online Diag Status ---- ------------------- 1 Pass 2 Pass 3 Pass 5 Pass 6 Pass Router# attach 5 Trying Switch ... Entering CONSOLE for Switch Type "^C^C^C" to end this session Switch-sp# show scp process Sap Pid Name === === ==== 0 180 CWAN-RP SCP Input Process 18 42 itasca 20 3 Exec 21 3 Exec 22 180 CWAN-RP SCP Input Process Total number of SAP registered = 5 Router# show slot CF-985 Cisco IOS Configuration Fundamentals Command Reference April 2010 show slot To display information about the PCMCIA flash memory cards file system, use the show slot command in user EXEC or privileged EXEC mode. show slot [all | chips | detailed | err | summary] Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines Use the show slot command to display details about the files in a particular linear PCMCIA flash memory card of less than 20 MB and some 32 MB linear PCMCIA cards. Note Use the show disk command for ATA PCMCIA cards. Other forms of this commands are show disk0: and show disk1:. For more information regarding file systems and flash cards, access the PCMCIA Filesystem Compatibility Matrix and Filesystem Information document at the following URL: http://www.cisco.com/en/US/partner/products/hw/routers/ps341/products_tech_note09186a00800a751 5.shtml To see which flash cards are used in your router, use the show version command and look at the bottom portion of the output. The following display indicates an ATA PCMCIA flash disk. Router# show version . . 46976K bytes of ATA PCMCIA card at slot 0 (Sector size 512 bytes). The following display indicates a linear PCMCIA flash card with 20480K bytes of flash memory in card at slot 1 with a sector size of 128K. Router# show version . . 20480K bytes of Flash PCMCIA card at slot 1 (Sector size 128K). all (Optional) Displays all possible flash system information for all PCMCIA flash cards in the system. chips (Optional) Displays flash chip information. detailed (Optional) Displays the flash detailed directory. err (Optional) Displays the flash chip erase and write retries. summary (Optional) Displays the flash partition summary. Release Modification 12.0 This command was introduced. show slot CF-986 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note In some cases the show slot command will not display the file systems, use show slot0: or show slot1:. Examples The following example displays information about slot 0. The output is self-explanatory. Router# show slot PCMCIA Slot0 flash directory: File Length Name/status 1 11081464 c3660-bin-mz.123-9.3.PI5b [11081528 bytes used, 9627844 available, 20709372 total] 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) The following example shows all possible flash system information for all PCMCIA flash cards in the system. Router# show slot all Partition Size Used Free Bank-Size State Copy Mode 1 20223K 10821K 9402K 4096K Read/Write Direct PCMCIA Slot0 flash directory: File Length Name/status addr fcksum ccksum 1 11081464 c3660-bin-mz.123-9.3.PI5b 0x40 0x5EA3 0x5EA3 [11081528 bytes used, 9627844 available, 20709372 total] 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) Chip Bank Code Size Name 1 1 89A0 2048KB INTEL 28F016SA 2 1 89A0 2048KB INTEL 28F016SA 1 2 89A0 2048KB INTEL 28F016SA 2 2 89A0 2048KB INTEL 28F016SA 1 3 89A0 2048KB INTEL 28F016SA 2 3 89A0 2048KB INTEL 28F016SA 1 4 89A0 2048KB INTEL 28F016SA 2 4 89A0 2048KB INTEL 28F016SA 1 5 89A0 2048KB INTEL 28F016SA 2 5 89A0 2048KB INTEL 28F016SA The following example shows flash chip information Router# show slot chips 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) Chip Bank Code Size Name 1 1 89A0 2048KB INTEL 28F016SA 2 1 89A0 2048KB INTEL 28F016SA 1 2 89A0 2048KB INTEL 28F016SA 2 2 89A0 2048KB INTEL 28F016SA 1 3 89A0 2048KB INTEL 28F016SA 2 3 89A0 2048KB INTEL 28F016SA 1 4 89A0 2048KB INTEL 28F016SA 2 4 89A0 2048KB INTEL 28F016SA 1 5 89A0 2048KB INTEL 28F016SA 2 5 89A0 2048KB INTEL 28F016SA show slot CF-987 Cisco IOS Configuration Fundamentals Command Reference April 2010 The following example show the flash detailed directory. Router# show slot detailed PCMCIA Slot0 flash directory: File Length Name/status addr fcksum ccksum 1 11081464 c3660-bin-mz.123-9.3.PI5b 0x40 0x5EA3 0x5EA3 [11081528 bytes used, 9627844 available, 20709372 total] 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) The following example shows the flash chip erase and write retries. Router# show slot err PCMCIA Slot0 flash directory: File Length Name/status 1 11081464 c3660-bin-mz.123-9.3.PI5b [11081528 bytes used, 9627844 available, 20709372 total] 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) Chip Bank Code Size Name erase write 1 1 89A0 2048KB INTEL 28F016SA 0 0 2 1 89A0 2048KB INTEL 28F016SA 0 0 1 2 89A0 2048KB INTEL 28F016SA 0 0 2 2 89A0 2048KB INTEL 28F016SA 0 0 1 3 89A0 2048KB INTEL 28F016SA 0 0 2 3 89A0 2048KB INTEL 28F016SA 0 0 1 4 89A0 2048KB INTEL 28F016SA 0 0 2 4 89A0 2048KB INTEL 28F016SA 0 0 1 5 89A0 2048KB INTEL 28F016SA 0 0 2 5 89A0 2048KB INTEL 28F016SA 0 0 The following example shows the flash partition summary. Router# show slot summary Partition Size Used Free Bank-Size State Copy Mode 1 20223K 10821K 9402K 4096K Read/Write Direct 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) Related Commands Command Description dir slot0: Directory listing of files on a PCMCIA Flash card located in slot0. dir slot1: Directory listing of files on a PCMCIA Flash card located in slot1. show slot0: Displays information about the PCMCIA flash memory card’s file system located in slot 0. show slot1: Displays information about the PCMCIA flash memory card’s file system located in slot 1. show slot0: CF-988 Cisco IOS Configuration Fundamentals Command Reference April 2010 show slot0: To display information about the PCMCIA flash memory card’s file system located in slot 0, use the show slot0: command in user EXEC or privileged EXEC mode. show slot0: [all | chips | detailed | err | summary] Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines Use the show slot0: command to display details about the files in a particular linear PCMCIA flash memory card of less than 20 MB and some 32 MB linear PCMCIA cards. Note Use the show disk command for ATA PCMCIA cards. Other forms of this commands are show disk0: and show disk1:. For more information regarding file systems and flash cards, access the PCMCIA Filesystem Compatibility Matrix and Filesystem Information document at the following URL: http://www.cisco.com/en/US/partner/products/hw/routers/ps341/products_tech_note09186a00800a751 5.shtml To see which flash cards are used in your router, use the show version command and look at the bottom portion of the output. The following display indicates an ATA PCMCIA flash disk. Router# show version . . 46976K bytes of ATA PCMCIA card at slot 0 (Sector size 512 bytes). The following display indicates a linear PCMCIA flash card with 20480K bytes of flash memory in card at slot 1 with a sector size of 128K. all (Optional) Displays all possible flash system information for all PCMCIA flash cards in the system. chips (Optional) Displays flash chip information. detailed (Optional) Displays the flash detailed directory. err (Optional) Displays the flash chip erase and write retries. summary (Optional) Displays the flash partition summary. Release Modification 12.0 This command was introduced. 12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware. show slot0: CF-989 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router# show version . . 20480K bytes of Flash PCMCIA card at slot 1 (Sector size 128K). Note In some cases the show slot command will not display the file systems, use show slot0: or show slot1:. Examples The following example displays information about slot 0. The output is self-explanatory. Router# show slot0: PCMCIA Slot0 flash directory: File Length Name/status 1 11081464 c3660-bin-mz.123-9.3.PI5b [11081528 bytes used, 9627844 available, 20709372 total] 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) Router# show slot0: all Partition Size Used Free Bank-Size State Copy Mode 1 20223K 10821K 9402K 4096K Read/Write Direct PCMCIA Slot0 flash directory: File Length Name/status addr fcksum ccksum 1 11081464 c3660-bin-mz.123-9.3.PI5b 0x40 0x5EA3 0x5EA3 [11081528 bytes used, 9627844 available, 20709372 total] 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) Chip Bank Code Size Name 1 1 89A0 2048KB INTEL 28F016SA 2 1 89A0 2048KB INTEL 28F016SA 1 2 89A0 2048KB INTEL 28F016SA 2 2 89A0 2048KB INTEL 28F016SA 1 3 89A0 2048KB INTEL 28F016SA 2 3 89A0 2048KB INTEL 28F016SA 1 4 89A0 2048KB INTEL 28F016SA 2 4 89A0 2048KB INTEL 28F016SA 1 5 89A0 2048KB INTEL 28F016SA 2 5 89A0 2048KB INTEL 28F016SA The following example shows flash chip information. Router# show slot0: chips 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) Chip Bank Code Size Name 1 1 89A0 2048KB INTEL 28F016SA 2 1 89A0 2048KB INTEL 28F016SA 1 2 89A0 2048KB INTEL 28F016SA 2 2 89A0 2048KB INTEL 28F016SA 1 3 89A0 2048KB INTEL 28F016SA 2 3 89A0 2048KB INTEL 28F016SA 1 4 89A0 2048KB INTEL 28F016SA 2 4 89A0 2048KB INTEL 28F016SA 1 5 89A0 2048KB INTEL 28F016SA 2 5 89A0 2048KB INTEL 28F016SA The following example show the flash detailed directory. Router# show slot0: detailed show slot0: CF-990 Cisco IOS Configuration Fundamentals Command Reference April 2010 PCMCIA Slot0 flash directory: File Length Name/status addr fcksum ccksum 1 11081464 c3660-bin-mz.123-9.3.PI5b 0x40 0x5EA3 0x5EA3 [11081528 bytes used, 9627844 available, 20709372 total] 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) The following example shows the flash chip erase and write retries. Router# show slot0: err PCMCIA Slot0 flash directory: File Length Name/status 1 11081464 c3660-bin-mz.123-9.3.PI5b [11081528 bytes used, 9627844 available, 20709372 total] 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) Chip Bank Code Size Name erase write 1 1 89A0 2048KB INTEL 28F016SA 0 0 2 1 89A0 2048KB INTEL 28F016SA 0 0 1 2 89A0 2048KB INTEL 28F016SA 0 0 2 2 89A0 2048KB INTEL 28F016SA 0 0 1 3 89A0 2048KB INTEL 28F016SA 0 0 2 3 89A0 2048KB INTEL 28F016SA 0 0 1 4 89A0 2048KB INTEL 28F016SA 0 0 2 4 89A0 2048KB INTEL 28F016SA 0 0 1 5 89A0 2048KB INTEL 28F016SA 0 0 2 5 89A0 2048KB INTEL 28F016SA 0 0 The following example shows the flash partition summary. Router# show slot0: summary Partition Size Used Free Bank-Size State Copy Mode 1 20223K 10821K 9402K 4096K Read/Write Direct 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) Related Commands Command Description dir slot0: Directory listing of files on a PCMCIA Flash card located in slot0. dir slot1: Directory listing of files on a PCMCIA Flash card located in slot1. show slot1: Displays information about the PCMCIA flash memory card’s file system located in slot 1. show slot Displays information about the PCMCIA flash memory cards. show slot1: CF-991 Cisco IOS Configuration Fundamentals Command Reference April 2010 show slot1: To display information about the PCMCIA flash memory card’s file system located in slot 1, use the show slot1: command in user EXEC or privileged EXEC mode. show slot1: [all | chips | detailed | err | summary] Syntax Description Command Modes User EXEC Privileged EXEC Command History Usage Guidelines Use the show slot1: command to display details about the files in a particular linear PCMCIA flash memory card of less than 20 MB and some 32 MB linear PCMCIA cards located in slot 1. Note Use the show disk command for ATA PCMCIA cards. Other forms of this commands are show disk0: and show disk1:. For more information regarding file systems and flash cards, access the PCMCIA Filesystem Compatibility Matrix and Filesystem Information document at the following URL: http://www.cisco.com/en/US/partner/products/hw/routers/ps341/products_tech_note09186a00800a751 5.shtml To see which flash cards are used in your router, use the show version command and look at the bottom portion of the output. The following display indicates an ATA PCMCIA flash disk. Router# show version . . 46976K bytes of ATA PCMCIA card at slot 0 (Sector size 512 bytes). The following display indicates a linear PCMCIA flash card with 20480K bytes of flash memory in card at slot 1 with a sector size of 128K. Router# show version . . 20480K bytes of Flash PCMCIA card at slot 1 (Sector size 128K). all (Optional) Displays all possible flash system information for all PCMCIA flash cards in the system. chips (Optional) Displays flash chip information. detailed (Optional) Displays the flash detailed directory. err (Optional) Displays the flash chip erase and write retries. summary (Optional) Displays the flash partition summary. Release Modification 12.0 This command was introduced. show slot1: CF-992 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note In some cases the show slot command will not display the file systems. Use show slot0: or show slot1:. Examples The following example displays information about slot 0 using the slot0: command form. The output is self-explanatory. Router# show slot1: PCMCIA Slot1 flash directory: File Length Name/status 1 10907068 c3660-bin-mz.123-7.9.PI4 [10907132 bytes used, 5739008 available, 16646140 total] 16384K bytes of processor board PCMCIA Slot1 flash (Read/Write) Router# show slot1: all Partition Size Used Free Bank-Size State Copy Mode 1 20223K 10821K 9402K 4096K Read/Write Direct PCMCIA Slot0 flash directory: File Length Name/status addr fcksum ccksum 1 11081464 c3660-bin-mz.123-9.3.PI5b 0x40 0x5EA3 0x5EA3 [11081528 bytes used, 9627844 available, 20709372 total] 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) Chip Bank Code Size Name 1 1 89A0 2048KB INTEL 28F016SA 2 1 89A0 2048KB INTEL 28F016SA 1 2 89A0 2048KB INTEL 28F016SA 2 2 89A0 2048KB INTEL 28F016SA 1 3 89A0 2048KB INTEL 28F016SA 2 3 89A0 2048KB INTEL 28F016SA 1 4 89A0 2048KB INTEL 28F016SA 2 4 89A0 2048KB INTEL 28F016SA 1 5 89A0 2048KB INTEL 28F016SA 2 5 89A0 2048KB INTEL 28F016SA The following example shows flash chip information. Router# show slot1: chips 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) Chip Bank Code Size Name 1 1 89A0 2048KB INTEL 28F016SA 2 1 89A0 2048KB INTEL 28F016SA 1 2 89A0 2048KB INTEL 28F016SA 2 2 89A0 2048KB INTEL 28F016SA 1 3 89A0 2048KB INTEL 28F016SA 2 3 89A0 2048KB INTEL 28F016SA 1 4 89A0 2048KB INTEL 28F016SA 2 4 89A0 2048KB INTEL 28F016SA 1 5 89A0 2048KB INTEL 28F016SA 2 5 89A0 2048KB INTEL 28F016SA The following example show the flash detailed directory. Router# show slot1: detailed PCMCIA Slot0 flash directory: show slot1: CF-993 Cisco IOS Configuration Fundamentals Command Reference April 2010 File Length Name/status addr fcksum ccksum 1 11081464 c3660-bin-mz.123-9.3.PI5b 0x40 0x5EA3 0x5EA3 [11081528 bytes used, 9627844 available, 20709372 total] 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) The following example shows the flash chip erase and write retries. Router# show slot1: err PCMCIA Slot0 flash directory: File Length Name/status 1 11081464 c3660-bin-mz.123-9.3.PI5b [11081528 bytes used, 9627844 available, 20709372 total] 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) Chip Bank Code Size Name erase write 1 1 89A0 2048KB INTEL 28F016SA 0 0 2 1 89A0 2048KB INTEL 28F016SA 0 0 1 2 89A0 2048KB INTEL 28F016SA 0 0 2 2 89A0 2048KB INTEL 28F016SA 0 0 1 3 89A0 2048KB INTEL 28F016SA 0 0 2 3 89A0 2048KB INTEL 28F016SA 0 0 1 4 89A0 2048KB INTEL 28F016SA 0 0 2 4 89A0 2048KB INTEL 28F016SA 0 0 1 5 89A0 2048KB INTEL 28F016SA 0 0 2 5 89A0 2048KB INTEL 28F016SA 0 0 The following example shows the flash partition summary. Router# show slot1: summary Partition Size Used Free Bank-Size State Copy Mode 1 20223K 10821K 9402K 4096K Read/Write Direct 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) Related Commands Command Description dir slot0: Directory listing of files on a PCMCIA Flash card located in slot0. dir slot1: Directory listing of files on a PCMCIA Flash card located in slot1. show slot0: Displays information about the PCMCIA flash memory card’s file system located in slot 0. show slot Displays information about the PCMCIA flash memory cards. show software authenticity file CF-994 Cisco IOS Configuration Fundamentals Command Reference April 2010 show software authenticity file To display information related to software authentication for a specific image file, use the show software authenticity file command in privileged EXEC mode. show software authenticity file {flash0:filename | flash1:filename | flash:filename | nvram:filename | usbflash0:filename | usbflash1:filename} Syntax Description Command Modes Privileged EXEC (#) Command History Usage Guidelines The show software authenticity file command allows you to display software authentication related information that includes image credential information, key type used for verification, signing information, and other attributes in the signature envelope, for a specific image file. The command handler will extract the signature envelope and its fields from the image file and dump the required information. Examples The following example displays software authentication related information for an image file named c3900-universalk9-mz.SSA: Router# show software authenticity file flash0:c3900-universalk9-mz.SSA File Name : flash0:c3900-universalk9-mz.SSA Image type : Development Signer Information Common Name : CiscoSystems Organization Unit : C3900 Organization Name : CiscoSystems Certificate Serial Number : 4A9F507F Hash Algorithm : SHA512 Signature Algorithm : 2048-bit RSA flash0: Displays information related to software authentication for flash 0 resources. filename Name of the filename in memory. flash1: Displays information related to software authentication for flash 1 resources. flash: Displays information related to software authentication for flash resources. nvram: Displays information related to software authentication for NVRAM resources. usbflash0: Displays information related to software authentication for Universal Serial Bus (USB) flash 0 resources. usbflash1: Displays information related to software authentication for USB flash 1 resources. Release Modification 15.0(1)M This command was introduced for the Cisco 1941, 2900sm, 2901, and 3900 routers. show software authenticity file CF-995 Cisco IOS Configuration Fundamentals Command Reference April 2010 Key Version : A Table 154 describes the significant fields shown in the display. Related Commands Table 154 show software authenticity file Field Descriptions Field Description File Name Name of the filename in the memory. For example, flash0:c3900-universalk9-mz.SSA refers to filename c3900-universalk9-mz.SSA in flash memory (flash0:). Image type Displays the type of image. Signer Information Signature information. Common Name Displays the name of the software manufacturer. Organization Unit Displays the hardware the software image is deployed on. Organization Name Displays the owner of the software image. Certificate Serial Number Displays the certificate serial number for the digital signature. Hash Algorithm Displays the type of hash algorithm used in digital signature verification. Signature Algorithm Displays the type of signature algorithm used in digital signature verification. Key Version Displays the key version used for verification. Command Description show software authenticity keys Displays the software public keys that are in the storage with the key types. show software authenticity running Displays information related to software authentication for the current ROMMON, monitor library (monlib), and Cisco IOS image used for booting. show software authenticity keys CF-996 Cisco IOS Configuration Fundamentals Command Reference April 2010 show software authenticity keys To display the software public keys that are in the storage with the key types, use the show software authenticity keys command in privileged EXEC mode. show software authenticity keys Syntax Description This command has no argument or keywords. Command Modes Privileged EXEC (#) Command History Usage Guidelines The display from this command includes the public keys that are in the storage with the key types. Examples The following is sample output from the show software authenticity keys command: Router# show software authenticity keys Public Key #1 Information ------------------------- Key Type : Release (Primary) Public Key Algorithm : RSA Modulus (256 bytes) : CC:CA:40:55:8C:71:E2:4A:3A:B6:9D:5C:94:1D:02:BA: 63:CD:F0:20:2F:C6:CB:C1:D7:3E:8F:27:E3:DA:6D:C6: 15:EB:2F:D0:A6:66:43:D8:00:2B:E1:7F:3C:E8:5F:28: DF:CE:D2:99:FE:02:AB:9E:4E:E2:90:08:F7:1B:BB:AD: 68:96:20:9C:D6:54:DA:E3:90:61:B0:F9:57:04:FC:DC: 2F:63:61:E0:6F:2B:23:9B:75:97:0A:E9:D7:9E:39:9A: 21:FD:AD:52:F9:DC:B4:A8:66:0F:7F:81:EA:7B:24:8A: F1:98:39:8C:66:49:5A:C5:F5:D2:67:25:17:FA:FB:17: 8B:90:D0:5D:4A:0E:B6:76:3B:9F:AD:DE:0A:B5:34:AC: 40:C2:2D:58:8D:CE:59:C4:5D:B9:21:8E:31:0E:D9:9F: 92:A4:7A:E5:13:59:55:C5:8B:16:43:20:B9:25:60:8D: A4:00:2B:75:FB:01:EF:EC:26:91:B1:88:D6:FB:2E:3A: FE:8F:45:38:88:FE:06:3B:43:04:DD:C2:0E:B2:5B:EF: 8A:E1:97:F5:F5:23:76:9F:47:3E:3B:F7:2E:47:C1:01: CE:70:3A:8C:11:02:43:2B:5B:26:49:6D:15:42:2E:F5: 26:04:6B:33:EB:70:2B:18:24:C7:D9:31:3E:77:24:85 Exponent (4 bytes) : 10001 Key Version : A Public Key #2 Information ------------------------- Key Type : Development (Primary) Public Key Algorithm : RSA Modulus (256 bytes) : CC:CA:40:55:8C:71:E2:4A:3A:B6:9D:5C:94:1D:02:BA: Release Modification 15.0(1)M This command was introduced for the Cisco 1941, 2900sm, 2901, and 3900 routers. show software authenticity keys CF-997 Cisco IOS Configuration Fundamentals Command Reference April 2010 63:CD:F0:20:2F:C6:CB:C1:D7:3E:8F:27:E3:DA:6D:C6: 15:EB:2F:D0:A6:66:43:D8:00:2B:E1:7F:3C:E8:5F:28: DF:CE:D2:99:FE:02:AB:9E:4E:E2:90:08:F7:1B:BB:AD: 68:96:20:9C:D6:54:DA:E3:90:61:B0:F9:57:04:FC:DC: 2F:63:61:E0:6F:2B:23:9B:75:97:0A:E9:D7:9E:39:9A: 21:FD:AD:52:F9:DC:B4:A8:66:0F:7F:81:EA:7B:24:8A: F1:98:39:8C:66:49:5A:C5:F5:D2:67:25:17:FA:FB:17: 8B:90:D0:5D:4A:0E:B6:76:3B:9F:AD:DE:0A:B5:34:AC: 40:C2:2D:58:8D:CE:59:C4:5D:B9:21:8E:31:0E:D9:9F: 92:A4:7A:E5:13:59:55:C5:8B:16:43:20:B9:25:60:8D: A4:00:2B:75:FB:01:EF:EC:26:91:B1:88:D6:FB:2E:3A: FE:8F:45:38:88:FE:06:3B:43:04:DD:C2:0E:B2:5B:EF: 8A:E1:97:F5:F5:23:76:9F:47:3E:3B:F7:2E:47:C1:01: CE:70:3A:8C:11:02:43:2B:5B:26:49:6D:15:42:2E:F5: 26:04:6B:33:EB:70:2B:18:24:C7:D9:31:3E:77:24:85 Exponent (4 bytes) : 10001 Key Version : A Table 155 describes the significant fields shown in the display. Related Commands Table 155 show software authenticity running Field Descriptions Field Description Public Key # Public key number. Key Type Displays the key type used for image verification. Public Key Algorithm Displays the name of the algorithm used for public key cryptography. Modulus Modulus of the public key algorithm. Exponent Exponent of the public key algorithm Key Version Displays the key version used for verification. Command Description show software authenticity file Displays information related to software authentication for the loaded image file. show software authenticity running Displays information related to software authentication for the current ROM monitor (ROMMON), monitor library (monlib), and Cisco IOS image used for booting. show software authenticity running CF-998 Cisco IOS Configuration Fundamentals Command Reference April 2010 show software authenticity running To display information related to software authentication for the current ROM monitor (ROMMON), monitor library (monlib), and Cisco IOS image used for booting, use the show software authenticity running command in privileged EXEC mode. show software authenticity running Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC (#) Command History Usage Guidelines The information displayed by the show software authenticity running command about the current ROMMON, monlib and Cisco IOS image used for booting includes: • Image credential information • Key type used for verification • Signing information • Any other attributes in the signature envelope Examples The following example displays software authentication related information for the current ROM monitor (ROMMON), monitor library (monlib), and Cisco IOS image used for booting: Router(mode-prompt)# show software authenticity running SYSTEM IMAGE ------------------- Image type : Development Signer Information Common Name : CiscoSystems Organization Unit : C2900 Organization Name : CiscoSystems Certificate Serial Number : 4A64A00E Hash Algorithm : SHA512 Signature Algorithm : 2048-bit RSA Key Version : A Verifier Information Verifier Name : ROMMON 2 Verifier Version : System Bootstrap, Version 12.4(20090409:084310) [BLD-xformers_dev.XFR_20090409-20090409_0101-24 103], DEVELOPMENT SOFTWARE ROMMON 2 --------------- Image type : Development Signer Information Release Modification 15.0(1)M This command was introduced for the Cisco 1941, 2900sm, 2901, and 3900 routers. show software authenticity running CF-999 Cisco IOS Configuration Fundamentals Command Reference April 2010 Common Name : CiscoSystems Organization Unit : C2900 Organization Name : CiscoSystems Certificate Serial Number : 49DE2B5D Hash Algorithm : SHA512 Signature Algorithm : 2048-bit RSA Key Version : A Verifier Information Verifier Name : ROMMON 2 Verifier Version : System Bootstrap, Version 12.4(20090409:084310) [BLD-xformers_dev.XFR_20090409-20090409_0101-24 103], DEVELOPMENT SOFTWARE Table 156 describes the significant fields shown in the display. Related Commands Table 156 show software authenticity running Field Descriptions Field Description SYSTEM IMAGE Section of the output displaying the system image information. Image type Displays the type of image. Common Name Displays the name of the software manufacturer. Organization Unit Displays the hardware the software image is deployed on. Organization Name Displays the owner of the software image. Certificate Serial Number Displays the certificate serial number for the digital signature. Hash Algorithm Displays the type of hash algorithm used in digital signature verification. Signature Algorithm Displays the type of signature algorithm used in digital signature verification. Key Version Displays the key version used for verification. Verifier Name Name of the program responsible for performing the digital signature verification. Verifier Version Version of the program responsible for performing the digital signature verification. ROMMON 2 Section of the output displaying the current ROM monitor (ROMMON) information. Command Description show software authenticity file Displays the software authenticity related information for the loaded image file. show software authenticity keys Displays the software public keys that are in the storage with the key types. show software authenticity upgrade-status CF-1000 Cisco IOS Configuration Fundamentals Command Reference April 2010 show software authenticity upgrade-status To display software authenticity information indicating if the digitally signed software has been signed with a new production key after a production key revocation, use the show software authenticity upgrade-status command in privileged EXEC mode. show software authenticity upgrade-status Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC (#) Command History Usage Guidelines The show software authenticity upgrade-status command is used to verify that digitally signed Cisco software, that has undergone key revocation, has been signed with the newly added key. Key revocation is the process of removing a key from operational use in digitally signed Cisco software. Key revocation takes place when a key becomes compromised or is no longer used. The key upgrade verification verifies that ROM monitor (ROMmon) and Cisco IOS image keys have been updated. Note The show software authenticity upgrade-status command will work only with a revocation image and thus the output from this command is useful only during a production key revocation process. Examples The following example displays the show software authenticity upgrade-status command being used during a production key revocation process, with sample output displayed: Router> enable Router# software authenticity key add production Router# show software authenticity upgrade-status The new production key version is B The new production key is present in the primary key storage The new production key is present in the backup key storage The image tftp:flash0:c3900-universalk9-mz.SPB 209.165.200.224 is a netbooted image Upgradeable rommon is Special software signed using key version B The command ouput displays that the version of the new production key for the Cisco IOS image is B and that the ROMmon image is signed with a key with version B. Related Commands Release Modification 15.0(M)2 This command was introduced for the Cisco 1941, 2900, and 3900 routers. 15.1(1)T This command was integrated into Cisco IOS Release 15.1(1)T. show software authenticity upgrade-status CF-1001 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Description debug software authenticity Enables the display of all debugging output related to software authentication events. show software authenticity file Displays the software authenticity related information for the loaded image file. show software authenticity keys Displays the software public keys that are in the key storage with the key types. show software authenticity running Displays information related to software authentication for the current ROMMON and Cisco IOS image used for booting. software authenticity key add Adds a release key to the key storage for a digitally signed software image during a key revocation process. software authenticity key revoke Revokes an invalidated key from the key storage for a digitally signed software image during a key revocation process. show stacks CF-1002 Cisco IOS Configuration Fundamentals Command Reference April 2010 show stacks To monitor the stack usage of processes and interrupt routines, use the show stacks command in EXEC mode. show stacks Syntax Description This command has no arguments or keywords. Command Modes EXEC Command History Usage Guidelines The display from this command includes the reason for the last system reboot. If the system was reloaded because of a system failure, a saved system stack trace is displayed. This information is of use only to your technical support representative in analyzing crashes in the field. It is included here in case you need to read the displayed statistics to an engineer over the phone. Examples The following is sample output from the show stacks command following a system failure: Router# show stacks Minimum process stacks: Free/Size Name 652/1000 Router Init 726/1000 Init 744/1000 BGP Open 686/1200 Virtual Exec Interrupt level stacks: Level Called Free/Size Name 1 0 1000/1000 env-flash 3 738 900/1000 Multiport Communications Interfaces 5 178 970/1000 Console UART System was restarted by bus error at PC 0xAD1F4, address 0xD0D0D1A GS Software (GS3), Version 9.1(0.16), BETA TEST SOFTWARE Compiled Tue 11-Aug-92 13:27 by jthomas Stack trace from system failure: FP: 0x29C158, RA: 0xACFD4 FP: 0x29C184, RA: 0xAD20C FP: 0x29C1B0, RA: 0xACFD4 FP: 0x29C1DC, RA: 0xAD304 FP: 0x29C1F8, RA: 0xAF774 FP: 0x29C214, RA: 0xAF83E FP: 0x29C228, RA: 0x3E0CA FP: 0x29C244, RA: 0x3BD3C Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show stacks CF-1003 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description show processes Displays information about the active processes. show startup-config CF-1004 Cisco IOS Configuration Fundamentals Command Reference April 2010 show startup-config The more nvram:startup-config command has been replaced by the show startup-config command. See the description of the more command in the “Cisco IOS File System Commands” chapter for more information. show subsys CF-1005 Cisco IOS Configuration Fundamentals Command Reference April 2010 show subsys To display the subsystem information, use the show subsys command in privileged EXEC mode. show subsys [class class | name name] Syntax Description Command Modes Privileged EXEC (#) Command History Usage Guidelines Use the show subsys command to confirm that all required features are in the running image. Examples The following is sample output from the show subsys command: Router# show subsys Name Class Version static_map Kernel 1.000.001 arp Kernel 1.000.001 ether Kernel 1.000.001 compress Kernel 1.000.001 alignment Kernel 1.000.002 monvar Kernel 1.000.001 slot Kernel 1.000.001 oir Kernel 1.000.001 atm Kernel 1.000.001 ip_addrpool_sys Library 1.000.001 chat Library 1.000.001 dialer Library 1.000.001 class class (Optional) Displays the subsystems of the specified class. Valid classes are driver, ehsa, ifs, kernel, library, license, management, microcode, pre-ehsa, predriver, protocol, registry, and sysinit. name name (Optional) Displays the specified subsystem. Use the asterisk character (*) as a wildcard at the end of the name to list all subsystems, starting with the specified characters. Release Modification 11.1 This command was introduced. 12.3 The following classes were added: ehsa, ifs, microcode, predriver, and sysinit. 12.3T The pre-ehsa class was added. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.The following classes were supported: driver, ehsa, kernel, library, management, pre-driver, pre-ehsa, protocol, and registry. 12.2(35)SE2 This command was integrated into Cisco IOS Release 12.2(35)SE2. The following classes were supported: driver, ehsa, kernel, library, license, management, pre-driver, pre-ehsa, protocol, and registry. show subsys CF-1006 Cisco IOS Configuration Fundamentals Command Reference April 2010 flash_services Library 1.000.001 ip_localpool_sys Library 1.000.001 nvram_common Driver 1.000.001 ASP Driver 1.000.001 sonict Driver 1.000.001 oc3suni Driver 1.000.001 oc12suni Driver 1.000.001 ds3suni Driver 1.000.001 The following is sample output from the show subsys command that includes the license class: Router# show subsys name license Name Class Version license_mgmt_local Management 1.000.001 license_admin_local Management 1.000.001 license_debug_core Management 1.000.001 license_test_ui Management 1.000.001 test_license_parser Management 1.000.001 license_ui Management 1.000.001 license_parser Management 1.000.001 license_registry Registry 1.000.001 license_client License 1.000.001 Table 157 describes the fields shown in the display. Table 157 show subsys Field Descriptions Field Description Name Name of the subsystem. Class Class of the subsystem. Possible classes include Driver, Ehsa, Ifs, Kernel, Library, License, Management, Microcode, Pre-Ehsa, Pre-driver, Protocol, Registry, and Sysinit. Version Version of the subsystem. show sup-bootflash CF-1007 Cisco IOS Configuration Fundamentals Command Reference April 2010 show sup-bootflash To display information about the sup-bootflash file system, use the show sup-bootflash command in privileged EXEC mode. show sup-bootflash [all | chips | filesys] Syntax Description Defaults This command has no default settings. Command Modes Privileged EXEC Command History Examples This example shows how to display a summary of bootflash information: Router# show sup-bootflash -#- ED --type-- --crc--- -seek-- nlen -length- -----date/time------ name 1 .. image EBC8FC4D A7487C 6 10700796 Nov 19 1999 07:07:37 halley 2 .. unknown C7EB077D EE2620 25 4644130 Nov 19 1999 07:50:44 cat6000-sup_ 5-3-3-CSX.bin 645600 bytes available (15345184 bytes used) Router# This example shows how to display all bootflash information: Router# show sup-bootflash all -#- ED --type-- --crc--- -seek-- nlen -length- -----date/time------ name 1 .. image EBC8FC4D A7487C 6 10700796 Nov 19 1999 07:07:37 halley 2 .. unknown C7EB077D EE2620 25 4644130 Nov 19 1999 07:50:44 cat6000-sup_ 5-3-3-CSX.bin 645600 bytes available (15345184 bytes used) -------- F I L E S Y S T E M S T A T U S -------- Device Number = 2 DEVICE INFO BLOCK: bootflash Magic Number = 6887635 File System Vers = 10000 (1.0) all (Optional) Displays all possible Flash information. chips (Optional) Displays information about the Flash chip. filesys (Optional) Displays information about the file system. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. show sup-bootflash CF-1008 Cisco IOS Configuration Fundamentals Command Reference April 2010 Length = 1000000 Sector Size = 40000 Programming Algorithm = 19 Erased State = FFFFFFFF File System Offset = 40000 Length = F40000 MONLIB Offset = 100 Length = F568 Bad Sector Map Offset = 3FFF8 Length = 8 Squeeze Log Offset = F80000 Length = 40000 Squeeze Buffer Offset = FC0000 Length = 40000 Num Spare Sectors = 0 Spares: STATUS INFO: Writable NO File Open for Write Complete Stats No Unrecovered Errors No Squeeze in progress USAGE INFO: Bytes Used = EA2620 Bytes Available = 9D9E0 Bad Sectors = 0 Spared Sectors = 0 OK Files = 2 Bytes = EA2520 Deleted Files = 0 Bytes = 0 Files w/Errors = 0 Bytes = 0 ******** Intel SCS Status/Register Dump ******** COMMON MEMORY REGISTERS: Bank 0 Intelligent ID Code : 890089 Compatible Status Reg: 800080 DEVICE TYPE: Layout : Paired x16 Mode Write Queue Size : 64 Queued Erase Supported : No Router# This example shows how to display information about the Flash chip: Router# show sup-bootflash chips ******** Intel SCS Status/Register Dump ******** COMMON MEMORY REGISTERS: Bank 0 Intelligent ID Code : 890089 Compatible Status Reg: 800080 DEVICE TYPE: Layout : Paired x16 Mode Write Queue Size : 64 Queued Erase Supported : No Router# This example shows how to display information about the file system: Router# show sup-bootflash filesys -------- F I L E S Y S T E M S T A T U S -------- Device Number = 2 DEVICE INFO BLOCK: bootflash Magic Number = 6887635 File System Vers = 10000 (1.0) Length = 1000000 Sector Size = 40000 Programming Algorithm = 19 Erased State = FFFFFFFF File System Offset = 40000 Length = F40000 MONLIB Offset = 100 Length = F568 show sup-bootflash CF-1009 Cisco IOS Configuration Fundamentals Command Reference April 2010 Bad Sector Map Offset = 3FFF8 Length = 8 Squeeze Log Offset = F80000 Length = 40000 Squeeze Buffer Offset = FC0000 Length = 40000 Num Spare Sectors = 0 Spares: STATUS INFO: Writable NO File Open for Write Complete Stats No Unrecovered Errors No Squeeze in progress USAGE INFO: Bytes Used = EA2620 Bytes Available = 9D9E0 Bad Sectors = 0 Spared Sectors = 0 OK Files = 2 Bytes = EA2520 Deleted Files = 0 Bytes = 0 Files w/Errors = 0 Bytes = 0 Router# show sysctrl CF-1010 Cisco IOS Configuration Fundamentals Command Reference April 2010 show sysctrl To display system controller information, use the show sysctrl command in user EXEC or privileged EXEC mode. show sysctrl Syntax Description This command has no arguments or keywords. Command Modes User EXEC (>) Privileged EXEC (#) Command History Examples The following is sample output from the show sysctrl command: Router# show sysctrl BCM1250 HT Host Bridge, handle=0 BCM bridge, config=0x0 (0x00):dev, vendor id = 0x0002166D (0x04):status, command = 0x00100107 (0x08):class code, revid = 0x06000003 (0x0C):hdr, lat timer, cls = 0x00010000 (0x18):bus id registers = 0x00250100 (0x1C):secondary status = 0x00000141 (0x20):mem base/limit = 0x5DF05000 (0x30):io upper limit/base = 0x00010001 (0x34):capabilities ptr = 0x00000040 (0x38):expansion rom bar = 0x00000000 (0x3C):bridge ctrl = 0x00020000 (0x40):LDT cmd, cap id, = 0x20000008 (0x44):Link config/control = 0x00000020 (0x48):Link frequency = 0x801F0423 (0x50):SRIcmd, srirxden, sritxden = 0x50211010 (0x54):SRI tx numerator = 0x0000FFFF (0x58):SRI rx numerator = 0x0000FFFF (0x68):Error status/control = 0x00009A49 (0x6C):Tx ctrl, databufalloc = 0x00041515 (0xC8):Tx buffer count max = 0x00FFFFFF (0xDC):Rx CRC expected = 0xFB5FF7F7 (0xF0):Rx CRC received = 0xEDDF7FE3 BCM PCI Host Bridge: bus_no=0, device_no=0 DeviceID=0x0001, VendorID=0x166D, Cmd=0x0146, Status=0x02A0 Cls=0x06/0x00/0x00, Rev=0x03, LatencyTimer=0x2C, CacheLineSize=0x10 BaseAddr0=0x60000008, BaseAddr1=0x00000000, MaxLat=0x00, MinGnt=0x00 SubsysDeviceID=0x0000, SubsysVendorID=0xFFFF, ErrorAddr=0x2E173900 Additional Status = 0x00000020 Release Modification 12.4(24)T This command was introduced in a release earlier than Cisco IOS Release 12.4(24)T on the Cisco 3845 series router. show sysctrl CF-1011 Cisco IOS Configuration Fundamentals Command Reference April 2010 Bus Watcher Counters cor_l2cache_data_ecc_count = 0 bad_l2cache_data_ecc_count = 0 cor_l2cache_tag_ecc_count = 0 bad_l2cache_tag_ecc_count = 0 cor_memory_data_ecc_count = 0 bad_memory_data_ecc_count = 0 bus_errors = 0 BCM Status Registers A_SCD_BUS_ERR_STATUS = 0000000080000000 A_BUS_ERR_DATA_0 = FFFDFFD7B3FB3FFF A_BUS_ERR_DATA_1 = BF6CF8DF3FBFBFBE A_BUS_ERR_DATA_2 = DFDF1F7B3DFDCB7C A_BUS_ERR_DATA_3 = FF7FF7CFCBFF7DEE A_SCD_SYSTEM_REVISION = 00000001112423FF A_IO_INTERRUPT_STATUS = 0000000000000000 A_IO_INTERRUPT_ADDR0 = 0000000000000000 A_IO_INTERRUPT_ADDR1 = 0000000000000000 Data Mover Channel 1 (Packet moving DMA engine 1): channel=0x6860D0E4, ring=0x2D200080, context=0x7004BC84, entries=1024 dma_used=0, dma_head=0, dma_tail=0 exhausted_dma_entries=0 Data Mover Channel 2 (Packet moving DMA engine 2): channel=0x6860D158, ring=0x2D2040C0, context=0x6860E968, entries=1024 dma_used=0, dma_head=0, dma_tail=0 exhausted_dma_entries=0 Table 151 describes the significant fields shown in the display. Table 158 show sysctlr Field Descriptions Field Description bus id registers Location of the bus ID registers. secondary status Location where the secondary status is available. mem base/limit Memory limit. io upper limit/base Upper limit of the input output. capabilities ptr Location of the capabilities pointer. bridge ctrl Location of the bridge control. SRI tx numerator SRI transmitter numerator. SRI rx numerator SRI receiver numerator. Tx buffer count max Maximum transmitter buffer count. Rx CRC expected Number of cyclic redundancy checks (CRC) expected on a receiver. Rx CRC received Number of CRCs received on a receiver. bus_no Identification number of the bus. device_no Identification number of the device. DeviceID Identification number of the device. VendorID Identification number of the vendor. Cmd Location where the command details are stored. show sysctrl CF-1012 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Status Location where the status is stored. Cls Location of the call details. LatencyTimer Location of the Latency timer. BaseAddr0 Base address 0 pointer. BaseAddr1 Base address 1 pointer. MaxLat Maximum latency. SubsysDeviceID Identification number of the subsystem device. SubsysVendorID Identification number of the subsystem vendor. ErrorAddr Location where the error message is stored. Additional Status Location where additional status information is stored. bus_errors Number of errors related to the bus. A_SCD_BUS_ERR_STATUS Error status of the SCD bus. A_IO_INTERRUPT_STATUS Input output interruption status. A_IO_INTERRUPT_ADDR0 Input output interruption address 0. A_IO_INTERRUPT_ADDR1 Input output interruption address 1. channel Location of the channel. ring Location of the ring. entries Total number of entries. dma_used Total number of Data Migration Assistant (DMA) entries used. exhausted_dma_entries Total number of DMA entries exhausted. Table 158 show sysctlr Field Descriptions (continued) Field Description Command Description syscon monitor Specifies attributes for the health monitor on the system controller to monitor. show system jumbomtu CF-1013 Cisco IOS Configuration Fundamentals Command Reference April 2010 show system jumbomtu To display the global maximum transmission unit (MTU) setting, use the show system jumbomtu command in privileged EXEC mode. show system jumbomtu Syntax Description This command has no arguments or keywords. Defaults This command has no default settings. Command Modes Privileged EXEC Command History Examples This example shows how to display the global MTU setting: Router# show system jumbomtu Global Ethernet MTU is 1550 bytes. Router# Related Commands Release Modification 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description system jumbomtu Sets the maximum size of the Layer 2 and Layer 3 packets. show tech-support CF-1014 Cisco IOS Configuration Fundamentals Command Reference April 2010 show tech-support To display general information about the router when it reports a problem, use the show tech-support command in privileged EXEC mode. show tech-support [page] [password] [cef | ipc | ipmulticast [vrf vrf-name] | isis | mpls | ospf [process-id | detail] | rsvp | voice | wccp] Cisco 7600 Series show tech-support [cef | ipmulticast [vrf vrf-name] | isis | password [page] | platform | page | rsvp] Syntax Description Defaults The output scrolls without page breaks. Passwords and other security information are removed from the output. Command Modes Privileged EXEC (#) page (Optional) Causes the output to display a page of information at a time. password (Optional) Leaves passwords and other security information in the output. cef (Optional) Displays show command output specific to Cisco Express Forwarding. ipc (Optional) Displays show command output specific to Inter-Process Communication (IPC). ipmulticast (Optional) Displays show command output related to the IP Multicast configuration, including Protocol Independent Multicast (PIM) information, Internet Group Management Protocol (IGMP) information, and Distance Vector Multicast Routing Protocol (DVMRP) information. vrf vrf-name (Optional) Specifies a multicast Virtual Private Network (VPN) routing and forwarding instance (VRF). isis (Optional) Displays show command output specific to Connectionless Network Service (CLNS) and Intermediate System-to-Intermediate System Protocol (IS-IS). mpls (Optional) Displays show command output specific to Multiprotocol Label Switching (MPLS) forwarding and applications. ospf [process-id | detail] (Optional) Displays show command output specific to Open Shortest Path First Protocol (OSPF) networking. rsvp (Optional) Displays show command output specific to Resource Reservation Protocol (RSVP) networking. voice (Optional) Displays show command output specific to voice networking. wccp (Optional) Displays show command output specific to Web Cache Communication Protocol (WCCP). platform (Optional) Displays platform-specific show command output. show tech-support CF-1015 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command History Release Modification 11.2 This command was introduced. 11.3(7), 11.2(16) The output for this command was expanded to show additional information for boot, bootflash, context, and traffic for all enabled protocols. 12.0 The output for this command was expanded to show additional information for boot, bootflash, context, and traffic for all enabled protocols. The cef, ipmulticast, isis, mlps, and ospf keywords were added to this command. 12.2(13)T Support for AppleTalk EIGRP, Apollo Domain, Banyan VINES, Novell Link-State Protocol, and XNS was removed from Cisco IOS software. 12.2(14)SX Support for this command was added for the Supervisor Engine 720. 12.3(4)T The output of this command was expanded to include the output from the show inventory command. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(30)S The show tech-support ipmulticast command was changed as follows: • Support for bidirectional PIM and Multicast VPN (MVPN) was added. • The vrf vrf-name option was added. The output of the show tech-support ipmulticast command (without the vrf vrf-name keyword and argument) was changed to include the output from these commands: • show ip pim int df • show ip pim mdt • show ip pim mdt bgp • show ip pim rp metric 12.3(16) This command was integrated into Cisco IOS Release 12.3(16). 12.2(18)SXF The show tech-support ipmulticast command was changed as follows: • Support for bidirectional PIM and MVPN was added. • The vrf vrf-name option was added. The output of the show tech-support ipmulticast vrf command was changed to include the output from these commands: • show mls ip multicast rp-mapping gm-cache • show mmls gc process • show mmls msc rpdf-cache The output of the show tech-support ipmulticast command (without the vrf vrf-name keyword and argument) was changed to include the output from these commands: • show ip pim int df • show ip pim mdt • show ip pim mdt bgp • show ip pim rp metric Support to interrupt and terminate the show tech-support output was added. show tech-support CF-1016 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines To interrupt and terminate the show tech-support output, simultaneously press and release the CTRL, ALT, and 6 keys. Press the Return key to display the next line of output, or press the Spacebar to display the next page of information. If you do not enter the page keyword, the output scrolls (that is, it does not stop for page breaks). If you do not enter the password keyword, passwords and other security-sensitive information in the output are replaced with the label “.” The show tech-support command is useful for collecting a large amount of information about your routing device for troubleshooting purposes. The output of this command can be provided to technical support representatives when reporting a problem. Note This command can generate a very large amount of output. You may want to redirect the output to a file using the show inventory | redirect url command syntax extension. Redirecting the output to a file also makes sending this output to your technical support representative easier. See the command documentation for show | redirect for more information on this option. The show tech-support command displays the output of a number of show commands at once. The output from this command varies depending on your platform and configuration. For example, access servers display voice-related show command output. Additionally, the show protocol traffic commands are displayed for only the protocols enabled on your device. For a sample display of the output of the show tech-support command, see the individual show command listed. If you enter the show tech-support command without arguments, the output displays, but is not limited to, the equivalent of these show commands: • show appletalk traffic • show bootflash • show bootvar • show buffers • show cdp neighbors • show cef • show clns traffic • show context • show controllers • show decnet traffic 12.4(4)T This command was integrated into Cisco IOS Release 12.4(4)T. 12.4(7) This command was integrated into Cisco IOS Release 12.4(7). 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.4(9)T The output of this command was expanded to include partial show dmvpn details command output. 15.0(1)M This command was modified. The wccp and voice keywords were added. 12.2(33)SRE This command was modified. The wccp keyword was added. Release Modification show tech-support CF-1017 Cisco IOS Configuration Fundamentals Command Reference April 2010 • show disk0: all • show dmvpn details • show environment • show fabric channel-counters • show file systems • show interfaces • show interfaces switchport • show interfaces trunk • show ip interface • show ip traffic • show logging • show mac-address-table • show module • show power • show processes cpu • show processes memory • show running-config • show spanning-tree • show stacks • show version • show vlan Note Crypto information is not duplicated by the show dmvpn details command output. When the show tech-support command is entered on a virtual switch (VS), the output displays the output of the show module command and the show power command for both the active and standby switches. Use of the optional cef, ipc, ipmulticast, isis, mpls, ospf, or rsvp keywords provides a way to display a number of show commands specific to a particular protocol or process in addition to the show commands listed previously. For example, if your Technical Assistance Center (TAC) support representative suspects that you may have a problem in your Cisco Express Forwarding (CEF) configuration, you may be asked to provide the output of the show tech-support cef command. The show tech-support [page] [password] cef command will display the output from the following commands in addition to the output for the standard show tech-support command: • show adjacency summary • show cef drop • show cef events • show cef interface • show cef not-cef-switched show tech-support CF-1018 Cisco IOS Configuration Fundamentals Command Reference April 2010 • show cef timers • show interfaces stats • show ip cef events summary • show ip cef inconsistency records detail • show ip cef summary If you enter the ipmulticast keyword, the output displays, but is not limited to, these show commands: • show ip dvmrp route • show ip igmp groups • show ip igmp interface • show ip mcache • show ip mroute • show ip mroute count • show ip pim interface • show ip pim interface count • show ip pim interface df • show ip pim mdt • show ip pim mdt bgp • show ip pim neighbor • show ip pim rp • show ip pim rp metric • show mls ip multicast rp-mapping gm-cache • show mmls gc process • show mmls msc rpdf-cache If you enter the wccp keyword, the output displays, but is not limited to, these show commands: • show ip wccp service-number • show ip wccp interfaces cef Examples For a sample display of the output from the show tech-support command, refer to the documentation for the show commands listed in the “Usage Guidelines” section. Related Commands Command Description dir Displays a list of files on a file system. show appletalk traffic Displays statistics about AppleTalk traffic, including MAC IP traffic. show bootflash Displays the contents of boot flash memory. show tech-support CF-1019 Cisco IOS Configuration Fundamentals Command Reference April 2010 show bootvar Displays the contents of the BOOT environment variable, the name of the configuration file pointed to by the CONFIG_FILE environment variable, the contents of the BOOTLDR environment variable, and the configuration register setting. show buffers Displays statistics for the buffer pools on the network server. show cdp neighbors Displays detailed information about neighboring devices discovered using Cisco Discovery Protocol. show cef Displays information about packets forwarded by Cisco Express Forwarding. show clns traffic Displays a list of the CLNS packets this router has seen. show | redirect Redirects the output of any show command to a file. show context Displays context data. show controllers Displays information that is specific to the hardware. show controllers tech-support Displays general information about a VIP card for problem reporting. show decnet traffic Displays the DECnet traffic statistics (including datagrams sent, received, and forwarded). show disk:0 Displays flash or file system information for a disk located in slot 0: show dmvpn details Displays detail DMVPN information for each session, including Next Hop Server (NHS) and NHS status, crypto session information, and socket details. show environment Displays temperature, voltage, and blower information on the Cisco 7000 series routers, Cisco 7200 series routers, Cisco 7500 series routers, Cisco 7600 series routers, Cisco AS5300 series access servers, and the Gigabit Switch Router. show fabric channel counters Displays the fabric channel counters for a module. show file system Lists available file systems. show interfaces Displays statistics for all interfaces configured on the router or access server. show interfaces switchport Displays the administrative and operational status of a switching (nonrouting) port. show interfaces trunk Displays the interface-trunk information. show inventory Displays the product inventory listing and UDI of all Cisco products installed in the networking device. show ip interface Displays the usability status of interfaces configured for IP. show ip traffic Displays statistics about IP traffic. show ip wccp Displays global statistics related to WCCP. show logging Displays the state of syslog and the contents of the standard system logging buffer. show mac-address table Displays the MAC address table. show module Displays module status and information. show power Displays the current power status of system components. show processes cpu Displays information about the active processes. show processes memory Displays the amount of memory used. Command Description show tech-support CF-1020 Cisco IOS Configuration Fundamentals Command Reference April 2010 show running-config Displays the current configuration of your routing device. show spanning-tree Displays information about the spanning tree state. show stacks Displays the stack usage of processes and interrupt routines. show version Displays the configuration of the system hardware, the software version, the names and sources of configuration files, and the boot images. show vlan Displays VLAN information. Command Description show template CF-1021 Cisco IOS Configuration Fundamentals Command Reference April 2010 show template To display template information, use the show template command in user EXEC or privileged EXEC mode. show template [template-name] Syntax Description Command Modes User EXEC (>) Privileged EXEC (#) Command History Examples The following is sample output from the show template command displaying template information. The fields are self-explanatory. Router# show template Template class/type Component(s) template1 owner ppp peer dialer Related Commands template-name (Optional) The template name. Release Modification 12.2(33)SRE This command was introduced in a release earlier than Cisco IOS Release 12.2(33)SRE. 12.2(33)SXI This command was introduced in a release earlier than Cisco IOS Release 12.2(33)SXI. 12.4(24)T This command was introduced in a release earlier than Cisco IOS Release 12.4(24)T. Cisco IOS 2.1 XE This command was integrated into Cisco IOS XE Release 2.1 on the Cisco ASR 1000 Series Aggregation Services Router. Command Description template Configures a particular customer profile template. show usb controllers CF-1022 Cisco IOS Configuration Fundamentals Command Reference April 2010 show usb controllers To display USB host controller information, use the show usb controllers command in privileged EXEC mode. show usb controllers [controller-number] Syntax Description Defaults Information about all controllers on the system are displayed. Command Modes Privileged EXEC Command History Usage Guidelines Use the show usb controllers command to display content such as controller register specific information, current asynchronous buffer addresses, and period scheduling information. You can also use this command to verify that copy operations are occurring successfully onto a USB flash module. Examples The following example is sample output from the show usb controllers command: Router# show usb controllers Name:1362HCD Controller ID:1 Controller Specific Information: Revision:0x11 Control:0x80 Command Status:0x0 Hardware Interrupt Status:0x24 Hardware Interrupt Enable:0x80000040 Hardware Interrupt Disable:0x80000040 Frame Interval:0x27782EDF Frame Remaining:0x13C1 Frame Number:0xDA4C LSThreshold:0x628 RhDescriptorA:0x19000202 RhDescriptorB:0x0 RhStatus:0x0 RhPort1Status:0x100103 RhPort2Status:0x100303 Hardware Configuration:0x3029 DMA Configuration:0x0 Transfer Counter:0x1 Interrupt:0x9 controller-number (Optional) Displays information only for the specified controller. Release Modification 12.3(14)T This command was introduced. 12.4(11)T This command was integrated into the Cisco 7200VXR NPE-G2 platform. show usb controllers CF-1023 Cisco IOS Configuration Fundamentals Command Reference April 2010 Interrupt Enable:0x196 Chip ID:0x3630 Buffer Status:0x0 Direct Address Length:0x80A00 ATL Buffer Size:0x600 ATL Buffer Port:0x0 ATL Block Size:0x100 ATL PTD Skip Map:0xFFFFFFFF ATL PTD Last:0x20 ATL Current Active PTD:0x0 ATL Threshold Count:0x1 ATL Threshold Timeout:0xFF Int Level:1 Transfer Completion Codes: Success :920 CRC :0 Bit Stuff :0 Stall :0 No Response :0 Overrun :0 Underrun :0 Other :0 Buffer Overrun :0 Buffer Underrun :0 Transfer Errors: Canceled Transfers :2 Control Timeout :0 Transfer Failures: Interrupt Transfer :0 Bulk Transfer :0 Isochronous Transfer :0 Control Transfer:0 Transfer Successes: Interrupt Transfer :0 Bulk Transfer :26 Isochronous Transfer :0 Control Transfer:894 USBD Failures: Enumeration Failures :0 No Class Driver Found:0 Power Budget Exceeded:0 USB MSCD SCSI Class Driver Counters: Good Status Failures :3 Command Fail :0 Good Status Timed out:0 Device not Found:0 Device Never Opened :0 Drive Init Fail :0 Illegal App Handle :0 Bad API Command :0 Invalid Unit Number :0 Invalid Argument:0 Application Overflow :0 Device in use :0 Control Pipe Stall :0 Malloc Error :0 Device Stalled :0 Bad Command Code:0 Device Detached :0 Unknown Error :0 Invalid Logic Unit Num:0 USB Aladdin Token Driver Counters: Token Inserted :1 Token Removed :0 Send Insert Msg Fail :0 Response Txns :434 Dev Entry Add Fail :0 Request Txns :434 Dev Entry Remove Fail:0 Request Txn Fail:0 Response Txn Fail :0 Command Txn Fail:0 Txn Invalid Dev Handle:0 USB Flash File System Counters: Flash Disconnected :0 Flash Connected :1 Flash Device Fail :0 Flash Ok :1 Flash startstop Fail :0 Flash FS Fail :0 USB Secure Token File System Counters: Token Inserted :1 Token Detached :0 Token FS success :1 Token FS Fail :0 Token Max Inserted :0 Create Talker Failures:0 Token Event :0 Destroy Talker Failures:0 Watched Boolean Create Failures:0 show usb device CF-1024 Cisco IOS Configuration Fundamentals Command Reference April 2010 show usb device To display USB device information, use the show usb device command in privileged EXEC mode. show usb device [controller-ID [device-address]] Syntax Description Defaults Information for all devices attached to the system are displayed. Command Modes Privileged EXEC Command History Usage Guidelines Use the show usb device command to display information for either a USB flash drive or a USB eToken, as appropriate. Examples The following example is sample output from the show usb device command: Router# show usb device Host Controller:1 Address:0x1 Device Configured:YES Device Supported:YES Description:DiskOnKey Manufacturer:M-Sys Version:2.0 Serial Number:0750D84030316868 Device Handle:0x1000000 USB Version Compliance:2.0 Class Code:0x0 Subclass Code:0x0 Protocol:0x0 Vendor ID:0x8EC Product ID:0x15 Max. Packet Size of Endpoint Zero:64 Number of Configurations:1 Speed:Full Selected Configuration:1 Selected Interface:0 controller-ID (Optional) Displays information only for the devices under the specified controller. device-address (Optional) Displays information only for the device with the specified address. Release Modification 12.3(14)T This command was introduced. 12.4(11)T This command was integrated into the Cisco 7200VXR NPE-G2 platform. show usb device CF-1025 Cisco IOS Configuration Fundamentals Command Reference April 2010 Configuration: Number:1 Number of Interfaces:1 Description: Attributes:None Max Power:140 mA Interface: Number:0 Description: Class Code:8 Subclass:6 Protocol:80 Number of Endpoints:2 Endpoint: Number:1 Transfer Type:BULK Transfer Direction:Device to Host Max Packet:64 Interval:0 Endpoint: Number:2 Transfer Type:BULK Transfer Direction:Host to Device Max Packet:64 Interval:0 Host Controller:1 Address:0x11 Device Configured:YES Device Supported:YES Description:eToken Pro 4254 Manufacturer:AKS Version:1.0 Serial Number: Device Handle:0x1010000 USB Version Compliance:1.0 Class Code:0xFF Subclass Code:0x0 Protocol:0x0 Vendor ID:0x529 Product ID:0x514 Max. Packet Size of Endpoint Zero:8 Number of Configurations:1 Speed:Low Selected Configuration:1 Selected Interface:0 Configuration: Number:1 Number of Interfaces:1 Description: Attributes:None Max Power:60 mA Interface: Number:0 Description: Class Code:255 Subclass:0 Protocol:0 Number of Endpoints:0 show usb device CF-1026 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 159 describes the significant fields shown in the display. Table 159 show usb device Field Descriptions Field Description Device handle Internal memory handle allocated to the device. Device Class code The class code supported by the device. This number is allocated by the USB-IF. If this field is reset to 0, each interface within a configuration specifies its own class information, and the various interfaces operate independently. If this field is set to a value between 1 and FEH, the device supports different class specifications on different interfaces, and the interfaces may not operate independently. This value identifies the class definition used for the aggregate interfaces. If this field is set to FFH, the device class is vendor-specific. Device Subclass code The subclass code supported by the device. This number is allocated by the USB-IF. Device Protocol The protocol supported by the device. If this field is set to 0, the device does not use class-specific protocols on a device basis. If this field is set to 0xFF, the device uses a vendor-specific protocol on a device basis. Interface Class code The class code supported by the interface. If the value is set to 0xFF, the interface class is vendor specific. All other values are allocated by the USB-IF. Interface Subclass code The subclass code supported by the interface. All values are allocated by the USB-IF. Interface Protocol The protocol code supported by the interface. If this field is set to 0, the device does not use a class-specific protocol on this interface. If this field is set to 0xFF, the device uses a vendor-specific protocol for this interface. Max Packet Maximum data packet size, in bytes. show usb driver CF-1027 Cisco IOS Configuration Fundamentals Command Reference April 2010 show usb driver To display information about registered USB class drivers and vendor-specific drivers, use the show usb driver command in privileged EXEC mode. show usb driver [index] Syntax Description Defaults Information about all drivers is displayed. Command Modes Privileged EXEC Command History Examples The following example is sample output for the show usb driver command: Router# show usb driver Index:0 Owner Mask:0x6 Class Code:0x0 Subclass Code:0x0 Protocol:0x0 Interface Class Code:0x8 Interface Subclass Code:0x6 Interface Protocol Code:0x50 Product ID:0x655BD598 Vendor ID:0x64E90000 Attached Devices: Controller ID:1, Device Address:1 Index:1 Owner Mask:0x1 Class Code:0x0 Subclass Code:0x0 Protocol:0x0 Interface Class Code:0x0 Interface Subclass Code:0x0 Interface Protocol Code:0x0 Product ID:0x514 Vendor ID:0x529 Attached Devices: Controller ID:1, Device Address:17 Index:2 Owner Mask:0x5 Class Code:0x9 index (Optional) Displays information only for drivers on the specified index. Release Modification 12.3(14)T This command was introduced. 12.4(11)T This command was integrated into the Cisco 7200VXR NPE-G2 platform. show usb driver CF-1028 Cisco IOS Configuration Fundamentals Command Reference April 2010 Subclass Code:0x6249BD58 Protocol:0x2 Interface Class Code:0x5DC0 Interface Subclass Code:0x5 Interface Protocol Code:0xFFFFFFFF Product ID:0x2 Vendor ID:0x1 Attached Devices: None Index:3 Owner Mask:0x10 Class Code:0x0 Subclass Code:0x0 Protocol:0x0 Interface Class Code:0x0 Interface Subclass Code:0x0 Interface Protocol Code:0x0 Product ID:0x0 Vendor ID:0x0 Attached Devices: None Table 160 describes the significant field shown in the display. Table 160 show usb driver Field Descriptions Field Description Owner Mask Indicates the fields that are used in enumeration comparison. The driver can own different devices on the basis of their product or vendor IDs and device or interface class, subclass, and protocol codes. show usb port CF-1029 Cisco IOS Configuration Fundamentals Command Reference April 2010 show usb port To sisplay USB root hub port information, use the show usb port command in privileged EXEC mode. show usb port [port-number] Syntax Description Command Modes Privileged EXEC Command History Examples The following sample from the show usb port command shows the status of the port 1 on the router: Router# show usb port Port Number:0 Status:Enabled Connection State:Connected Speed:Full Power State:ON Port Number:1 Status:Enabled Connection State:Connected Speed:Low Power State:ON port-number (Optional) Displays information only for a specified. If the port-number is not issued, information for all root ports will be displayed. Release Modification 12.3(14)T This command was introduced. show usb tree CF-1030 Cisco IOS Configuration Fundamentals Command Reference April 2010 show usb tree To display information about the port state and all attached devices, use the show usb tree command in privileged EXEC mode. show usb tree Syntax Description This command has no arguments or keywords. Command Modes EXEC Command History Examples The following example is sample output from the show usb tree command. This output shows that both a USB flash module and a USB eToken are currently enabled. Router# show usb tree [Host Id:1, Host Type:1362HCD, Number of RH-Port:2] Port0:(DiskOnKey) Addr:0x1 VID:0x08EC PID:0x0015 Configured (0x1000000) Port1:(eToken Pro 4254) Addr:0x11 VID:0x0529 PID:0x0514 Configured (0x1010000) Release Modification 12.3(14)T This command was introduced. show usbtoken CF-1031 Cisco IOS Configuration Fundamentals Command Reference April 2010 show usbtoken To display information about the USB eToken (such as the eToken ID), use the show usbtoken command in privileged EXEC mode. show usbtoken[0-9]:[all | filesystem] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Use the show usbtoken command to verify whether a USB eToken is inserted in the router. Examples The following example is sample output from the show usbtoken command: Router# show usbtoken0 Token ID :43353334 Token device name : token0 Vendor name : Vendor34 Product Name :Etoken Pro Serial number : 22273a334353 Firmware version : 4.1.3.2 Total memory size : 32 KB Free memory size : 16 KB FIPS version : Yes/No Token state : “Active” | “User locked” | “Admin locked” | “System Error” | “Uknown” ATR (Answer To Reset) :"3B F2 98 0 FF C1 10 31 FE 55 C8 3" Table 161 describes the significant fields shown in the display. 0-9 (Optional) One of the ten available flash drives you can choose from; valid values: 0-9. If you do not specify a number, 0 is used by default all (Optional) All configuration files stored on the eToken. filesystem (Optional) Name of a configuration file. Release Modification 12.3(14)T This command was introduced. 12.4(11)T This command was integrated into the Cisco 7200VXR NPE-G2 platform. Table 161 show usbtoken Field Descriptions Field Description Token ID Token identifier. show usbtoken CF-1032 Cisco IOS Configuration Fundamentals Command Reference April 2010 Token device name A unique name derived by the token driver. ATR (Answer to Reset) Information replied by Smart cards when a reset command is issued. Table 161 show usbtoken Field Descriptions (continued) Field Description show version CF-1033 Cisco IOS Configuration Fundamentals Command Reference April 2010 show version To display information about the currently loaded software along with hardware and device information, use the show version command in user EXEC, privileged EXEC, or diagnostic mode. show version Cisco ASR 1000 Series Routers show version [rp-slot] [installed [user-interface] | provisioned | running] Cisco Catalyst 6500 Series Routers show version [epld slot] Syntax Description Defaults No default behavior or values. Command Modes User EXEC (>) Privileged EXEC (#) Diagnostic (diag)—Cisco ASR 1000 Series Routers only Command History rp-slot Specifies the software of the RP in a specific RP slot of a Cisco ASR 1000 Series Router. Options include: • r0—the RP in RP slot 0. • r1—the RP in RP slot 1. • rp active—the active RP. • rp standby—the standby RP. installed Specifies information on the software installed on the RP user-interface Specifies information on the files related to the user-interface. provisioned Specifies information on the software files that are provisioned. running Specifies information on the files currently running. epld slot (Optional) Specifies the software of the EPLD slot of a Cisco Catalyst 6500 Series Router. Release Modification 9.0 This command was introduced. 12.1EC This command was integrated into Cisco IOS Release 12.1EC. 12.1(1a)T1 This command was modified to include information about the clock card on CMTS routers. 12.3BC This command was integrated into Cisco IOS Release 12.3BC. 12.3(4)T The output format of this command was updated. 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. show version CF-1034 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines This command displays information about the Cisco IOS software version currently running on a routing device, the ROM Monitor and Bootflash software versions, and information about the hardware configuration, including the amount of system memory. Because this command displays both software and hardware information, the output of this command is the same as the output of the show hardware command. (The show hardware command is a command alias for the show version command.) Specifically, the show version command provides the following information: • Software information – Main Cisco IOS image version – Main Cisco IOS image capabilities (feature set) – Location and name of bootfile in ROM – Bootflash image version (depending on platform) • Device-specific information – Device name – System uptime – System reload reason – Config-register setting – Config-register settings for after the next reload (depending on platform) • Hardware information – Platform type – Processor type – Processor hardware revision – Amount of main (processor) memory installed – Amount I/O memory installed – Amount of Flash memory installed on different types (depending on platform) – Processor board ID The output of this command uses the following format: 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to 12.2(17d)SXB. 12.2(25)S The output format of this command was updated. 12.2(33)SCA This command was integrated into Cisco IOS Release 12.2(33)SCA. Support for the Cisco uBR7225VXR router was added. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Routers, and the following enhancements were introduced: • the command became available in diagnostic mode. • the rp-slot, installed, user-interface, provisioned, and running options all became available for the first time. 12.2(18)SX Added ELPD keyword and output for the Cisco Catalyst 6500 Series Router. Release Modification show version CF-1035 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco IOS Software, Software (), Version , Technical Support: http://www.cisco.com/techsupport Copyright (c) by Cisco Systems, Inc. Compiled by ROM: System Bootstrap, Version , BOOTLDR: Software (image-id), Version , uptime is weeks, days, hours, minutes System returned to ROM by reload at System image file is "/" Last reload reason: Cisco processor (revision ) with K/K bytes of memory. Processor board ID CPU at Mhz, Implementation , Rev , KB Cache See the Examples section for descriptions of the fields in this output. Cisco ASR 1000 Series Routers Entering show version without any of the options on the Cisco ASR 1000 Series Router will generate output similar to show version on other Cisco routers. In order to understand the show version output on Cisco ASR 1000 Series Routers, it is important to understand that the individual sub-packages run the processes on the router. Among other things, the output of this command provides information on where various individual sub-packages are stored on the router, and which processes these individual sub-packages are and are not currently running. More specifically, the show version installed command displays each individual sub-package file on the router, the hardware where the sub-package could be running, and whether the sub-package is currently being run on that hardware. The show version provisioned command displays only the individual sub-packages that can be provisioned, which are the RP-specific sub-packages (RP Access, RP Base, RP Control, and RP IOS) and the provisioning file. The output includes the individual sub-package file, the hardware where the sub-package could be running, and whether the sub-package is currently being run on that hardware. The show version running command displays only the individual sub-packages that are currently active. The output includes the individual sub-package file and the hardware where the sub-package is running. Examples Cisco 3660 Router The following is sample output from the show version command issued on a Cisco 3660 running Cisco IOS Release 12.3(4)T: Router# show version Cisco IOS Software, 3600 Software (C3660-I-M), Version 12.3(4)T TAC Support: http://www.cisco.com/tac Copyright (c) 1986-2003 by Cisco Systems, Inc. Compiled Thu 18-Sep-03 15:37 by ccai ROM: System Bootstrap, Version 12.0(6r)T, RELEASE SOFTWARE (fc1) ROM: C3660-1 uptime is 1 week, 3 days, 6 hours, 41 minutes show version CF-1036 Cisco IOS Configuration Fundamentals Command Reference April 2010 System returned to ROM by power-on System image file is "slot0:tftpboot/c3660-i-mz.123-4.T" Cisco 3660 (R527x) processor (revision 1.0) with 57344K/8192K bytes of memory. Processor board ID JAB055180FF R527x CPU at 225Mhz, Implementation 40, Rev 10.0, 2048KB L2 Cache 3660 Chassis type: ENTERPRISE 2 FastEthernet interfaces 4 Serial interfaces DRAM configuration is 64 bits wide with parity disabled. 125K bytes of NVRAM. 16384K bytes of processor board System flash (Read/Write) Flash card inserted. Reading filesystem...done. 20480K bytes of processor board PCMCIA Slot0 flash (Read/Write) Configuration register is 0x2102 Cisco 7200 Router The following is sample output from the show version command issued on a Cisco 7200 router running Cisco IOS Release 12.4(4)T. This output shows the total bandwidth capacity and the bandwith capacity that is configured on the Cisco 7200. Displaying bandwidth capacity is available in Cisco IOS Release 12.2 and later releases. Router# show version Cisco IOS Software, 7200 Software (C7200-JS-M), Version 12.4(4)T, RELEASE SOFTW) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2005 by Cisco Systems, Inc. Compiled Thu 27-Oct-05 05:58 by ccai ROM: System Bootstrap, Version 12.1(20000710:044039) [nlaw-121E_npeb 117], DEVEE BOOTLDR: 7200 Software (C7200-KBOOT-M), Version 12.3(16), RELEASE SOFTWARE (fc4) router uptime is 5 days, 18 hours, 2 minutes System returned to ROM by reload at 02:45:12 UTC Tue Feb 14 2006 System image file is "disk0:c7200-js-mz.124-4.T" Last reload reason: Reload Command Cisco 7206VXR (NPE400) processor (revision A) with 491520K/32768K bytes of memo. Processor board ID 26793934 R7000 CPU at 350MHz, Implementation 39, Rev 3.2, 256KB L2 Cache 6 slot VXR midplane, Version 2.6 Last reset from power-on PCI bus mb0_mb1 (Slots 0, 1, 3 and 5) has a capacity of 600 bandwidth points. Current configuration on bus mb0_mb1 has a total of 440 bandwidth points. This configuration is within the PCI bus capacity and is supported. PCI bus mb2 (Slots 2, 4, 6) has a capacity of 600 bandwidth points. Current configuration on bus mb2 has a total of 390 bandwidth points This configuration is within the PCI bus capacity and is supported. Please refer to the following document "Cisco 7200 Series Port Adaptor Hardware Configuration Guidelines" on Cisco.com for c7200 bandwidth points oversubscription and usage guidelines. show version CF-1037 Cisco IOS Configuration Fundamentals Command Reference April 2010 4 Ethernet interfaces 2 FastEthernet interfaces 2 ATM interfaces 125K bytes of NVRAM. 62976K bytes of ATA PCMCIA card at slot 0 (Sector size 512 bytes). 125952K bytes of ATA PCMCIA card at slot 1 (Sector size 512 bytes). 8192K bytes of Flash internal SIMM (Sector size 256K). Configuration register is 0x2002 Router# For information about PCI buses and bandwidth calculation, go to http://www.cisco.com/univercd/cc/td/doc/product/core/7206/port_adp/config/3875in.htm#wp1057192. Table 162 describes the significant fields shown in the display. Table 162 show version Field Descriptions Field Description Cisco IOS Software, platform Software (image-id), Version software-version, release-type For example: Cisco IOS Software, 7200 Software (C7200-G4JS-M), Version 12.3(4)T platform—Cisco hardware device name. image-id—The coded software image identifier, in the format platform-features-format (for example, “c7200-g4js-mz”. software-version—The Cisco IOS software release number, in the format x.y(z)A, where x.y is the main release identifier, z is the maintenance release number, and A, where applicable, is the special release train identifier. For example, 12.3(4)T indicates the fourth maintenance release of the 12.3T special technology release train. Note In the full software image filename, 12.3(4)T appears as 123-4.T. In the IOS Upgrade Planner, 12.3(4)T appears as 12.3.4T (ED). release-type—The description of the release type. Possible values include MAINTENANCE [for example, 12.3(3)] or INTERIM [for example, 12.3(3.2)]. Tip Refer to “The ABC’s of Cisco IOS Networking” (available on Cisco.com) for more information on Cisco IOS software release numbering and software versions. Cisco IOS is a registered trademark (R) of Cisco Systems, Inc. Technical Support: http://www.cisco.com/techsupp ort Copyright (c) date-range by Cisco Systems, Inc. The Cisco Technical Support & Documentation website contains thousands of pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content. Cisco IOS software, including the source code, user-help, and documentation, is copyrighted by Cisco Systems, Inc. It is Cisco’s policy to enforce its copyrights against any third party who infringes on its copyright. show version CF-1038 Cisco IOS Configuration Fundamentals Command Reference April 2010 ROM: System Bootstrap, Version 12.0(6r)T, RELEASE SOFTWARE (fc1) The system “bootstrap” software, stored in ROM memory. BOOTFLASH: The system “bootflash” software, stored in Flash memory (if applicable). device uptime is ... For example: C3660-1 uptime is 1 week, 3 days, 6 hours, 41 minutes The amount of time the system has been up and running. System returned to ROM by reload-reason at time day date For example: System returned to ROM by reload at 20:56:53 UTC Tue Nov 4 2003 Shows the last recorded reason for a system reload, and time of last reload. Last reload reason: reload-reason For example: Last reload reason: Reload command Shows the last recorded reason for a system reload. Last reset from reset-reason For example: Last reset from power-on Shows the last recorded reason for a system reset. Possible reset-reason values include: • power-on—System was reset with the initial power on or a power cycling of the device. • s/w peripheral—System was reset due to a software peripheral. • s/w nmi—System was reset by a nonmaskable interrupt (NMI) originating in the system software. For example, on some systems, you can configure the device to reset automatically if two or more fans fail. • push-button—System was reset by manual activation of a RESET push-button (also called a hardware NMI). • watchdog—System was reset due to a watchdog process. • unexpected value—May indicate a bus error, such as for an attempt to access a nonexistent address (for example, “System restarted by bus error at PC 0xC4CA, address 0x210C0C0”). (This field was formerly labeled as the “System restarted by” field.”) Table 162 show version Field Descriptions (continued) Field Description show version CF-1039 Cisco IOS Configuration Fundamentals Command Reference April 2010 System image file is “file-location/file-name” For example: System image file is "slot0:tftpboot/c3660-i-mz.123- 3.9.T2" Displays the file location (local or remote filesystem) and the system image name. Table 162 show version Field Descriptions (continued) Field Description show version CF-1040 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco platform (processor-type) processor (revision processor-revision-id) with free-DRAM-memory K/ packet-memory K bytes of memory. Example—Separate DRAM and Packet Memory: Cisco RSP4 (R5000) processor with 65536K/2072K bytes of memory Example—Combined DRAM and Packet Memory: Cisco 3660 (R527x) processor (revision 1.0) with 57344K/8192K bytes of memory. This line can be used to determine how much Dynamic RAM (DRAM) is installed on your system, in order to determine if you meet the “Min. Memory” requirement for a software image. DRAM (including SDRAM) is used for system processing memory and for packet memory. Two values, separated by a slash, are given for DRAM: The first value tells you how DRAM is available for system processing, and the second value tells you how much DRAM is being used for Packet memory. The first value, Main Processor memory, is either: • The amount of DRAM available for the processor, or • The total amount of DRAM installed on the system. The second value, Packet memory, is either: • The total physical input/output (I/O) memory (or “Fast memory”) installed on the router (Cisco 4000, 4500, 4700, and 7500 series), or • The amount of “shared memory” used for packet buffering. In the shared memory scheme (Cisco 2500, 2600, 3600, and 7200 Series), a percentage of DRAM is used for packet buffering by the router's network interfaces. Note The terms “I/O memory” or “iomem”; “shared memory”; “Fast memory” and “PCI memory” all refer to “Packet Memory”. Packet memory is either separate physical RAM or shared DRAM. Separate DRAM and Packet Memory The 4000, 4500, 4700, and 7500 series routers have separate DRAM and Packet memory, so you only need to look at the first number to determine total DRAM. In the example to the left for the Cisco RSP4, the first value shows that the router has 65536K (65,536 kilobytes, or 64 megabytes) of DRAM. The second value, 8192K, is the Packet memory. Combined DRAM and Packet Memory The 2500, 2600, 3600, and 7200 series routers require a minimum amount of I/O memory to support certain interface processors. The 1600, 2500, 2600, 3600, and 7200 series routers use a fraction of DRAM as Packet memory, so you need to add both numbers to find out the real amount of DRAM. In the example to the left for the Cisco 3660, the router has 57,344 kilobytes (KB) of free DRAM and 8,192 KB dedicated to Packet memory. Adding the two numbers together gives you 57,344K + 8,192K = 65,536K, or 64 megabytes (MB) of DRAM. Table 162 show version Field Descriptions (continued) Field Description show version CF-1041 Cisco IOS Configuration Fundamentals Command Reference April 2010 Catalyst 6500 Series Switches and Cisco 7600 Series Routers This example shows how to display the configuration of the system hardware, the software version, the names and sources of configuration files, and the boot images: Router# show version Cisco Internetwork Operating System Software IOS (tm) c6sup2_rp Software (c6sup2_rp-JSV-M), Version 12.1 (nightly.E020626) NIG HTLY BUILD Copyright (c) 1986-2002 by cisco Systems, Inc. Compiled Wed 26-Jun-02 06:20 by Image text-base: 0x40008BF0, data-base: 0x419BA000 ROM: System Bootstrap, Version 12.1(11r)E1, RELEASE SOFTWARE (fc1) Router uptime is 2 weeks, 8 hours, 48 minutes Time since Router switched to active is 1 minute System returned to ROM by power-on (SP by power-on) System image file is "sup-bootflash:c6sup22-jsv-mz" cisco Catalyst 6000 (R7000) processor with 112640K/18432K bytes of memory. Processor board ID SAD06210067 R7000 CPU at 300Mhz, Implementation 39, Rev 3.3, 256KB L2, 1024KB L3 Cache Last reset from power-on Bridging software. X.25 software, Version 3.0.0. SuperLAT software (copyright 1990 by Meridian Technology Corp). TN3270 Emulation software. 3 Virtual Ethernet/IEEE 802.3 interface(s) 48 FastEthernet/IEEE 802.3 interface(s) 381K bytes of non-volatile configuration memory. 16384K bytes of Flash internal SIMM (Sector size 512K). For more details on memory requirements, see the document “How to Choose a Cisco IOS® Software Release” on Cisco.com. Configuration register is value For example: Configuration register is 0x2142 (will be 0x2102 at next reload) Shows the current configured hex value of the software configuration register. If the value has been changed with the config-register command, the register value that will be used at the next reload is displayed in parenthesis. The boot field (final digit) of the software configuration register dictates what the system will do after a reset. For example, when the boot field of the software configuration register is set to 00 (for example, 0x0), and you press the NMI button on a Performance Route Processor (PRP), the user-interface remains at the ROM monitor prompt (rommon>) and waits for a user command to boot the system manually. But if the boot field is set to 01 (for example, 0x1), the system automatically boots the first Cisco IOS image found in the onboard Flash memory SIMM on the PRP. The factory-default setting for the configuration register is 0x2102. This value indicates that the router will attempt to load a Cisco IOS software image from Flash memory and load the startup configuration file. Table 162 show version Field Descriptions (continued) Field Description show version CF-1042 Cisco IOS Configuration Fundamentals Command Reference April 2010 Configuration register is 0x2102 Router# Table 163 describes the fields that are shown in the example. The output of the show version EXEC command can provide certain messages, such as bus error messages. If such error messages appear, report the complete text of this message to your technical support specialist. This example shows how to display the ELPD version information of a slot: Router# show version epld 4 Module 4 EPLD's: Number of EPLD's: 6 EPLD A : 0x5 EPLD B : 0x2 EPLD C : 0x1 EPLD D : 0x1 EPLD E : 0x1 Router# Table 163 show version Field Descriptions Field Description IOS (tm) c6sup2_rp Software (c6sup2_rp-JSV-M), Version 12.1(nightly.E020626) NIGHTLY BUILD Version number. Always specify the complete version number when reporting a possible software problem. In the example output, the version number is 12.1. ROM: System Bootstrap, Version 12.1(11r)E1, RELEASE SOFTWARE (fc1) Bootstrap version string. BOOTFLASH: 7200 Software (C7200-BOOT-M), Version 11.1(472), RELEASE SOFTWARE Boot version string. Router uptime is Amount of time that the system has been up and running. Time since Router switched to active Amount of time since switchover occurred. System restarted by Log of how the system was last booted, both as a result of normal system startup and of system error. For example, information can be displayed to indicate a bus error that is typically the result of an attempt to access a nonexistent address, as follows: System restarted by bus error at PC 0xC4CA, address 0x210C0C0 System image file is If the software was booted over the network, the Internet address of the boot host is shown. If the software was loaded from onboard ROM, this line reads “running default software.” cisco Catalyst 6000 (R7000) processor with 112640K/18432K bytes of memory. Remaining output in each display that shows the hardware configuration and any nonstandard software options. Configuration register is Configuration register contents that are displayed in hexadecimal notation. show version CF-1043 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco uBR7246VXR Router The following is sample output from the show version command for a Cisco uBR7246 VXR with the cable clock card installed: Router# show version Cisco Internetwork Operating System Software IOS (tm) 7200 Software (UBR7200-P-M), Version 12.1(10)EC, RELEASE SOFTWARE TAC Support: http://www.cisco.com/tac Copyright (c) 1986-2000 by cisco Systems, Inc. Compiled Wed 02-Feb-00 16:49 by ccai Image text-base:0x60008900, data-base:0x61192000 ROM:System Bootstrap, Version 12.0(15)SC, RELEASE SOFTWARE VXR1 uptime is 2 days, 1 hour, 24 minutes System returned to ROM by power-on at 10:54:38 PST Sat Feb 5 2000 System restarted at 11:01:08 PST Sat Feb 5 2000 System image file is "slot1:ubr7200-p-mz.121-0.8.T" cisco uBR7246VXR (NPE300) processor (revision B) with 122880K/40960K bytes of memory. Processor board ID SAB0329005N R7000 CPU at 262Mhz, Implementation 39, Rev 1.0, 256KB L2, 2048KB L3 Cache 6 slot VXR midplane, Version 2.0 Last reset from power-on X.25 software, Version 3.0.0. National clock card with T1 controller 1 FastEthernet/IEEE 802.3 interface(s) 2 Cable Modem network interface(s) 125K bytes of non-volatile configuration memory. 16384K bytes of Flash PCMCIA card at slot 0 (Sector size 128K). 20480K bytes of Flash PCMCIA card at slot 1 (Sector size 128K). 4096K bytes of Flash internal SIMM (Sector size 256K). Configuration register is 0x0 Router# Table 0-164 describes significant fields shown in these displays. Table 0-164 show version Field Descriptions Field Description IOS (tm) 7200 Software (UBR7200-P-M), Version xx.x Always specify the complete version number when reporting a possible software problem. In the example, the version number is Cisco IOS Release 12.1(10)EC. ROM: System Bootstrap Bootstrap version string. Router uptime is The amount of time the system has been up and running. System restarted at Also displayed is a log of how the system was last booted, as a result of normal system startup or system error. System image file is If the software was booted over the network, the Internet address of the boot host is shown. If the software was loaded from onboard ROM, this line reads “running default software.” show version CF-1044 Cisco IOS Configuration Fundamentals Command Reference April 2010 The output of the show version command can also provide certain messages, such as bus error messages. If such error messages appear, report the complete text of this message to your technical support specialist. Cisco uBR10012 Router The following example shows sample output from the show version command on a Cisco uBR10012 universal broadband router running Cisco IOS Release 12.3(17b)BC4: Router> show version Cisco Internetwork Operating System Software IOS (tm) 10000 Software (UBR10K2-K9P6U2-M), Version 12.3(17b)BC4, RELEASE SOFTWA RE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2006 by cisco Systems, Inc. Compiled Wed 22-Nov-06 11:41 by tinhuang Image text-base: 0x60010F0C, data-base: 0x62480000 ROM: System Bootstrap, Version 12.0(20020314:211744) [REL-pulsar_sx.ios-rommon 1 12], DEVELOPMENT SOFTWARE ubr10k uptime is 2 days, 22 hours, 13 minutes System returned to ROM by reload at 01:34:58 UTC Sun Jun 8 2008 System image file is "disk0:ubr10k2-k9p6u2-mz.123-17b.BC4" Last reload reason: Reload command This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately. A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html If you require further assistance please contact us by sending email to export@cisco.com. cisco uBR10000 (PRE2-RP) processor with 946175K/98304K bytes of memory. Processor board ID TBA05380380 R7000 CPU at 500MHz, Implementation 39, Rev 4.1, 256KB L2, 8192KB L3 Cache Backplane version 1.1, 8 slot Last reset from register reset PXF processor tmc0 is running. PXF processor tmc1 is running. PXF processor tmc2 is running. cisco uBR7246VXR (NPE300) processor The remaining output in each display shows the hardware configuration and any nonstandard software options. Configuration register is The configuration register contents, displayed in hexadecimal notation. Table 0-164 show version Field Descriptions Field Description show version CF-1045 Cisco IOS Configuration Fundamentals Command Reference April 2010 PXF processor tmc3 is running. 1 TCCplus card(s) 1 FastEthernet/IEEE 802.3 interface(s) 3 Gigabit Ethernet/IEEE 802.3 interface(s) 24 Cable Modem network interface(s) 2045K bytes of non-volatile configuration memory. 125440K bytes of ATA PCMCIA card at slot 0 (Sector size 512 bytes). 125440K bytes of ATA PCMCIA card at slot 1 (Sector size 512 bytes). 65536K bytes of Flash internal SIMM (Sector size 512KB). Secondary is up. Secondary has 1044480K bytes of memory. Configuration register is 0x2102 Cisco ASR 1000 Series Routers In the following example, the show version installed command is entered on a Cisco ASR 1000 Series Router in diagnostic mode. Note that the output shows what every file that can be found in the consolidated package is or is not currently running (provisioning file, RP Access, RP Base, RP Control, RP IOS, ESP Base, SIP Base, SIP SPA). Router#show version installed Package: Provisioning File, version: n/a, status: active File: bootflash:packages.conf, on: RP0 Built: n/a, by: n/a File SHA1 checksum: 0b9f2c7c3d81d8455a918f285c078463c04a0cab Package: rpbase, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-rpbase.v122_33_xn_asr_rls0_throttle.pkg, on: RP0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 193c4810becc2a6097645f0b68f5684004bd3ab3 Package: rpaccess-k9, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-rpaccess-k9.v122_33_xn_asr_rls0_throttle.pkg, on: RP0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 328c3d1e10f006304ce9543ab68e914b43c41b1e Package: rpcontrol, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-rpcontrol.v122_33_xn_asr_rls0_throttle.pkg, on: RP0/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: e4152b7fe3c2b8aca07ce1e8ad6d5a54d6d20689 Package: rpios-advipservicesk9, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle.pkg, on: RP0/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 7f7f87f2c198c38e7b58214478c5b28ee3c7b567 Package: rpcontrol, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpcontrol.v122_33_xn_asr_rls0_throttle.pkg, on: RP0/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: e4152b7fe3c2b8aca07ce1e8ad6d5a54d6d20689 Package: rpios-advipservicesk9, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle.pkg, on: RP0/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 7f7f87f2c198c38e7b58214478c5b28ee3c7b567 Package: rpbase, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpbase.v122_33_xn_asr_rls0_throttle.pkg, on: RP1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 193c4810becc2a6097645f0b68f5684004bd3ab3 show version CF-1046 Cisco IOS Configuration Fundamentals Command Reference April 2010 Package: rpaccess-k9, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpaccess-k9.v122_33_xn_asr_rls0_throttle.pkg, on: RP1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 328c3d1e10f006304ce9543ab68e914b43c41b1e Package: rpcontrol, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpcontrol.v122_33_xn_asr_rls0_throttle.pkg, on: RP1/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: e4152b7fe3c2b8aca07ce1e8ad6d5a54d6d20689 Package: rpios-advipservicesk9, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle.pkg, on: RP1/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 7f7f87f2c198c38e7b58214478c5b28ee3c7b567 Package: rpcontrol, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpcontrol.v122_33_xn_asr_rls0_throttle.pkg, on: RP1/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: e4152b7fe3c2b8aca07ce1e8ad6d5a54d6d20689 Package: rpios-advipservicesk9, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle.pkg, on: RP1/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 7f7f87f2c198c38e7b58214478c5b28ee3c7b567 Package: espbase, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-espbase.v122_33_xn_asr_rls0_throttle.pkg, on: FP0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: b1c004ed151cf60f0ce250f6ea710f43707fb010 Package: espbase, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-espbase.v122_33_xn_asr_rls0_throttle.pkg, on: FP1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: b1c004ed151cf60f0ce250f6ea710f43707fb010 Package: sipbase, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipbase.v122_33_xn_asr_rls0_throttle.pkg, on: CC0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: bd34a8a23d001f9cefcac8853a31b62ffd8272a4 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC0/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC0/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC0/2 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC0/3 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipbase, version: v122_33_xn_asr_rls0_throttle, status: active show version CF-1047 Cisco IOS Configuration Fundamentals Command Reference April 2010 File: bootflash:asr1000rp1-sipbase.v122_33_xn_asr_rls0_throttle.pkg, on: CC1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: bd34a8a23d001f9cefcac8853a31b62ffd8272a4 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC1/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC1/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC1/2 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC1/3 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipbase, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-sipbase.v122_33_xn_asr_rls0_throttle.pkg, on: CC2 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: bd34a8a23d001f9cefcac8853a31b62ffd8272a4 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC2/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC2/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC2/2 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC2/3 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Router# In the following example, the show version provisioned command is entered to gather information on which sub-packages are provisioning which components on the router. Router#show version provisioned Package: Provisioning File, version: n/a, status: active File: bootflash:packages.conf, on: RP0 Built: n/a, by: n/a File SHA1 checksum: 0b9f2c7c3d81d8455a918f285c078463c04a0cab Package: rpbase, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-rpbase.v122_33_xn_asr_rls0_throttle.pkg, on: RP0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 193c4810becc2a6097645f0b68f5684004bd3ab3 show version CF-1048 Cisco IOS Configuration Fundamentals Command Reference April 2010 Package: rpaccess-k9, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-rpaccess-k9.v122_33_xn_asr_rls0_throttle.pkg, on: RP0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 328c3d1e10f006304ce9543ab68e914b43c41b1e Package: rpcontrol, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-rpcontrol.v122_33_xn_asr_rls0_throttle.pkg, on: RP0/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: e4152b7fe3c2b8aca07ce1e8ad6d5a54d6d20689 Package: rpios-advipservicesk9, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle.pkg, on: RP0/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 7f7f87f2c198c38e7b58214478c5b28ee3c7b567 Package: rpcontrol, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpcontrol.v122_33_xn_asr_rls0_throttle.pkg, on: RP0/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: e4152b7fe3c2b8aca07ce1e8ad6d5a54d6d20689 Package: rpios-advipservicesk9, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle.pkg, on: RP0/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 7f7f87f2c198c38e7b58214478c5b28ee3c7b567 Package: rpbase, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpbase.v122_33_xn_asr_rls0_throttle.pkg, on: RP1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 193c4810becc2a6097645f0b68f5684004bd3ab3 Package: rpaccess-k9, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpaccess-k9.v122_33_xn_asr_rls0_throttle.pkg, on: RP1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 328c3d1e10f006304ce9543ab68e914b43c41b1e Package: rpcontrol, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpcontrol.v122_33_xn_asr_rls0_throttle.pkg, on: RP1/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: e4152b7fe3c2b8aca07ce1e8ad6d5a54d6d20689 Package: rpios-advipservicesk9, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle.pkg, on: RP1/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 7f7f87f2c198c38e7b58214478c5b28ee3c7b567 Package: rpcontrol, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpcontrol.v122_33_xn_asr_rls0_throttle.pkg, on: RP1/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: e4152b7fe3c2b8aca07ce1e8ad6d5a54d6d20689 Package: rpios-advipservicesk9, version: v122_33_xn_asr_rls0_throttle, status: inactive File: bootflash:asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle.pkg, on: RP1/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 7f7f87f2c198c38e7b58214478c5b28ee3c7b567 Package: rpios-advipservicesk9, version: unknown, status: active File: unknown, on: FP0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown show version CF-1049 Cisco IOS Configuration Fundamentals Command Reference April 2010 Package: rpios-advipservicesk9, version: unknown, status: inactive File: unknown, on: FP1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: active File: unknown, on: CC0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: active File: unknown, on: CC0/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: active File: unknown, on: CC0/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: active File: unknown, on: CC0/2 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: inactive File: unknown, on: CC0/3 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: active File: unknown, on: CC1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: active File: unknown, on: CC1/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: active File: unknown, on: CC1/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: active File: unknown, on: CC1/2 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: inactive File: unknown, on: CC1/3 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: inactive File: unknown, on: CC2 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: inactive File: unknown, on: CC2/0 Built: 2007-11-11_17.16, by: mcpre show version CF-1050 Cisco IOS Configuration Fundamentals Command Reference April 2010 File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: inactive File: unknown, on: CC2/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: inactive File: unknown, on: CC2/2 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Package: rpios-advipservicesk9, version: unknown, status: inactive File: unknown, on: CC2/3 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: unknown Router# In the following example, the show version running command is entered to view which sub-packages are active on which hardware elements on the router. Router#show version running Package: Provisioning File, version: n/a, status: active File: bootflash:packages.conf, on: RP0 Built: n/a, by: n/a File SHA1 checksum: 0b9f2c7c3d81d8455a918f285c078463c04a0cab Package: rpbase, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-rpbase.v122_33_xn_asr_rls0_throttle.pkg, on: RP0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 193c4810becc2a6097645f0b68f5684004bd3ab3 Package: rpaccess-k9, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-rpaccess-k9.v122_33_xn_asr_rls0_throttle.pkg, on: RP0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 328c3d1e10f006304ce9543ab68e914b43c41b1e Package: rpcontrol, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-rpcontrol.v122_33_xn_asr_rls0_throttle.pkg, on: RP0/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: e4152b7fe3c2b8aca07ce1e8ad6d5a54d6d20689 Package: rpios-advipservicesk9, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle.pkg, on: RP0/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 7f7f87f2c198c38e7b58214478c5b28ee3c7b567 Package: espbase, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-espbase.v122_33_xn_asr_rls0_throttle.pkg, on: FP0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: b1c004ed151cf60f0ce250f6ea710f43707fb010 Package: sipbase, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipbase.v122_33_xn_asr_rls0_throttle.pkg, on: CC0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: bd34a8a23d001f9cefcac8853a31b62ffd8272a4 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC0/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 show version CF-1051 Cisco IOS Configuration Fundamentals Command Reference April 2010 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC0/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC0/2 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipbase, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipbase.v122_33_xn_asr_rls0_throttle.pkg, on: CC1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: bd34a8a23d001f9cefcac8853a31b62ffd8272a4 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC1/0 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC1/1 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Package: sipspa, version: v122_33_xn_asr_rls0_throttle, status: active File: bootflash:asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg, on: CC1/2 Built: 2007-11-11_17.16, by: mcpre File SHA1 checksum: 6ad199569dad7d8b35beac2c8a72b080f9662897 Router# Related Commands Table 165 show version installed, provisioned, and running Field Descriptions Field Description Package: The individual sub-package name. version: The consolidated package version of the individual sub-package. status: Reveals if the sub-package is active or inactive for the specific hardware component only. File: The location and filename of the individual sub-package file. on: The hardware component. Built: The date the individual sub-package was built. File SHA1 checksum: The SHA1 sum for the file. This sum can be compared against a SHA1 sum generated by any SHA1 sum-generating tool. Command Description show diag Displays hardware and diagnostic information for a networking device, a line card, a processor, a jacket card, a chassis, or a network module. show inventory Displays the Cisco Unique Device Identifier information, including the Product ID, the Version ID, and the Serial Number, for the hardware device and hardware components. show warm-reboot CF-1052 Cisco IOS Configuration Fundamentals Command Reference April 2010 show warm-reboot To display the statistics for attempted warm reboots, use the show warm-reboot command in privileged EXEC mode. show warm-reboot Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Usage Guidelines Use the show warm-reboot command to see if warm rebooting is enabled, and, if so, how many warm reloads have occurred and how much space in kilobytes (KB) is consumed by warm-reboot storage, which is the RAM area used to store the data segment that enables warm reloading to function. Examples The following example is sample output from the show warm-reboot command: Router# show warm-reboot Warm Reboot is enabled Statistics: 10 warm reboots have taken place since the last cold reboot XXX KB taken up by warm reboot storage Related Commands Release Modification 12.3(2)T This command was introduced. 12.2(18)S This command was integrated into Cisco IOS Relase 12.2(18)S. 12.2(28)SB This command was integrated into Cisco IOS Relase 12.2(28)SB. Command Description warm-reboot Enables a router to warm-reboot. show whoami CF-1053 Cisco IOS Configuration Fundamentals Command Reference April 2010 show whoami To display information about the terminal line of the current user, including host name, line number, line speed, and location, use the show whoami command in EXEC mode. show whoami [text] Syntax Description Command Modes EXEC Command History Usage Guidelines If text is included as an argument in the command, that text is displayed as part of the additional data about the line. To prevent the information from being lost if the menu display clears the screen, this command always displays a --More-- prompt before returning. Press the space bar to return to the prompt. Examples The following example is sample output from the show whoami command: Router> show whoami Comm Server "Router", Line 0 at 0bps. Location "Second floor, West" --More-- Router> text (Optional) Additional data to print to the screen. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. showmon CF-1054 Cisco IOS Configuration Fundamentals Command Reference April 2010 showmon To show both the ReadOnly and the Upgrade ROMmon image versions when you are in ROMmon mode, as well as which ROMmon image is running on the Cisco 7200 VXR or Cisco 7301 router, use the showmon command in ROM monitor mode. showmon Syntax Description This command has no arguments or keywords. Defaults No default behavior or values Command Modes ROM monitor mode Command History Usage Guidelines Use the showmon command when you are in ROM monitor mode. Use the show rom-monitor command when you are in Cisco IOS. Examples The following example, applicable to both the Cisco 7200 VXR and Cisco 7301 routers, uses the showmon command in ROMmon to display both ROMmon images and to verify that the Upgrade ROMmon image is running: rommon 1 > showmon ReadOnly ROMMON version is: System Bootstrap, Version 12.2(20031011:151758) [biff] Copyright (c) 2004 by Cisco Systems, Inc. Upgrade ROMMON version is: System Bootstrap, Version 12.2(20031011:151758) [biff] Copyright (c) 2004 by Cisco Systems, Inc. Upgrade ROMMON currently running Upgrade ROMMON is selected for next boot rommon 2 > Release Modification 12.0(28)S This command was introduced on the Cisco 7200 VXR router. It was introduced in ROMmon version 12.3(4r)T1 for the Cisco 7200 VXR router. 12.3(8)T This command was integrated into Cisco IOS Release 12.3(8)T and supported on the Cisco 7200 VXR router and Cisco 7301 router. It was introduced in ROMmon version 12.3(4r)T2 for the Cisco 7301 router. 12.3(9) This command was integrated into Cisco IOS Release 12.3(9) and supported on the Cisco 7200 VXR router and Cisco 7301 router. showmon CF-1055 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description rommon-pref Selects a ReadOnly or Upgrade ROMmon image to be booted on the next reload of a Cisco 7200 VXR or Cisco 7301 when you are in ROMmon. slave auto-sync config CF-1056 Cisco IOS Configuration Fundamentals Command Reference April 2010 slave auto-sync config To turn on automatic synchronization of configuration files for a Cisco 7507 or Cisco 7513 router that is configured for High System Availability (HSA) using Dual RSP Cards, use the slave auto-sync config global configuration command. To turn off automatic synchronization, use the no form of the command. slave auto-sync config no slave auto-sync config Syntax Description This command has no arguments or keywords. Defaults Enabled Command Modes Global configuration Command History Usage Guidelines Use this command for a Cisco 7507 or Cisco 7513 router that is configured for dual RSP cards. On the Cisco 7507 and Cisco 7513 router, you can install two RSP cards in a single router to improve system availability. Dual RSP Cards is a High System Availability (HSA) feature. In automatic synchronization mode, when you issue a copy EXEC command that specifies the master’s startup configuration (nvram:startup-config) as the target, the master also copies the same file to the slave’s startup configuration (slavenvram:startup-config). Use this command when implementing HSA for simple hardware backup or for software error protection to ensure that the master and slave RSP contain the same configuration files. Examples The following example turns on automatic configuration file synchronization. When the copy system:running-config nvram:startup-config command is entered, the running configuration is saved to the startup configurations of both the master RSP and the slave RSP. Router(config)# slave auto-sync config Router(config)# end Router# copy system:running-config nvram:startup-config Related Commands Release Modification 11.1 The command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show controller cbus Displays detailed information on the cards connected to the CBus controller. show stacks Displays the stack trace and version information of the master and slave RSP cards. slave auto-sync config CF-1057 Cisco IOS Configuration Fundamentals Command Reference April 2010 show version Displays the software version running on the master and slave RSP cards. slave sync config Manually synchronizes configuration files on the master and slave RSP cards of a Cisco 7507 or Cisco 7513 router. Command Description slave default-slot CF-1058 Cisco IOS Configuration Fundamentals Command Reference April 2010 slave default-slot To specify the default slave Route Switch Processor (RSP) card on a Cisco 7507 or Cisco 7513 router, use the slave default-slot global configuration command. slave default-slot processor-slot-number Syntax Description Defaults The default slave is the RSP card located in the higher number processor slot. On the Cisco 7507 router, processor slot 3 contains the default slave RSP. On the Cisco 7513 router, processor slot 7 contains the default slave RSP. Command Modes Global configuration Command History Usage Guidelines Use this command for a Cisco 7507 or Cisco 7513 router that is configured for Dual RSP Cards. On the Cisco 7507 and Cisco 7513 router, you can install two RSP cards in a single router to improve system availability. Dual RSP Cards is a High System Availability (HSA) feature. The router uses the default slave information when booting as follows: • If a system boot is due to powering up the router or using the reload EXEC command, then the specified default slave will be the slave RSP. • If a system boot is due to a system crash or hardware failure, then the system ignores the default slave designation, and makes the crashed or faulty RSP card the slave RSP. Examples In the following example, the user sets the default slave RSP to processor slot 2 on a Cisco 7507 router: c7507(config)# slave default-slot 2 Related Commands processor-slot-number Number of a processor slot that contains the default slave RSP. On the Cisco 7507 router, valid values are 2 or 3. On the Cisco 7513 router, valid values are 6 or 7. The default is the higher number processor slot. Release Modification 11.1 The command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description reload Reloads the operating system. show controller cbus Displays detailed information on the cards connected to the CBus controller. slave default-slot CF-1059 Cisco IOS Configuration Fundamentals Command Reference April 2010 show stacks Displays the stack trace and version information of the master and slave RSP cards. show version Displays the software version running on the master and slave RSP cards. Command Description slave image CF-1060 Cisco IOS Configuration Fundamentals Command Reference April 2010 slave image To specify the image that the slave Route Switch Processor (RSP) runs on a Cisco 7507 or Cisco 7513 router, use the slave image command in global configuration mode. slave image {system | file-url} Syntax Description Defaults The default is to load the image from the system bundle. Command Modes Global configuration (config) Command History Usage Guidelines Use this command for a Cisco 7507 or Cisco 7513 router that is configured for Dual RSP Cards. On the Cisco 7507 and Cisco 7513 router, you can install two RSP cards in a single router to improve system availability. Dual RSP Cards is a High System Availability (HSA) feature. Use the slave image command to override the slave image that is bundled with the master image. When using HSA for simple hardware backup, ensure that the slave image is in the same location on the master and the slave RSP card. Thus, if the slave RSP card becomes the master, it will be able to find the slave image and download it to the new slave. Note The default length of the bootstring filename is 64 characters. Depending on the platform a longer bootstring filename can be used and supported. Examples In the following example, the slave RSP is specified to run the rsp-dw-mz.ucode.111-3.2 image from slot 0: Router(config)# slave image slot0:rsp-dw-mz.ucode.111-3.2 system Loads the slave image that is bundled with the master system image. This is the default. file-url The specified file in Flash file system from which the slave image will be load. If you do not specify a filename, the first file in the specified Flash file system is the default file. Release Modification 11.1 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. slave image CF-1061 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description show controller cbus Displays detailed information on the cards connected to the CBus controller. show stacks Displays the stack trace and version information of the master and slave RSP cards. show version Displays the software version running on the master and slave RSP cards. slave reload Forces a reload of the image that the slave RSP card is running on a Cisco 7507 or Cisco 7513 router. slave reload CF-1062 Cisco IOS Configuration Fundamentals Command Reference April 2010 slave reload To force a reload of the image that the slave Route Switch Processor (RSP) card is running on a Cisco 7507 or Cisco 7513 router, use the slave reload global configuration command. slave reload Syntax Description This command has no arguments or keywords. Defaults No default behavior or values. Command Modes Global configuration Command History Usage Guidelines Use this command for a Cisco 7507 or Cisco 7513 router that is configured for Dual RSP Cards. On the Cisco 7507 and Cisco 7513 router, you can install two RSP cards in a single router to improve system availability. Dual RSP Cards is a High System Availability (HSA) feature. After using the slave image global configuration command to specify the image that the slave RSP runs on a Cisco 7507 or Cisco 7513 router, use the slave reload command to reload the slave with the new image. The slave reload command can also be used to force the slave to reboot its existing image. Examples In the following example, an inactive slave RSP card is reloaded. If the slave reloads, it will return to an active slave state. If the master RSP fails, the slave RSP will become the master. c7507(config)# slave reload Related Commands Release Modification 11.1 The command was introduced. 12.2913)T This command is no longer supported in Cisco IOS Mainline or Technology-based releases. It may appear in 12.2S-family releases. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show controller cbus Displays detailed information on the cards connected to the CBus controller. show stacks Displays the stack trace and version information of the master and slave RSP cards. show version Displays the software version running on the master and slave RSP cards. slave image Specifies the image that the slave RSP runs on a Cisco 7507 or Cisco 7513 router. slave sync config CF-1063 Cisco IOS Configuration Fundamentals Command Reference April 2010 slave sync config To manually synchronize configuration files on the master and slave Route Switch Processor (RSP) cards of a Cisco 7507 or Cisco 7513 router, use the slave sync config privileged EXEC command. slave sync config Syntax Description This command has no arguments or keywords. Defaults Automatic synchronization is turned on. Command Modes Privileged EXEC Command History Usage Guidelines Use this command for a Cisco 7507 or Cisco 7513 router that is configured for Dual RSP Cards. On the Cisco 7507 and Cisco 7513 router, you can install two RSP cards in a single router to improve system availability. Dual RSP Cards is a High System Availability (HSA) feature. This command allows you to synchronize the configuration files of the master and slave RSP cards on a case-by-case basis when you do not have automatic synchronization turned on. This command copies the master’s configuration file to the slave RSP card. Note You must use this command when you insert a new slave RSP card into a Cisco 7507 or Cisco 7513 router for the first time to ensure that the new slave is configured consistently with the master. Examples In the following example, the configuration files on the master and slave RSP card are synchronized: c7507(config)# slave sync config Related Commands Release Modification 11.1 The command was introduced. 12.2(13)T This command is no longer supported in Cisco IOS Mainline or Technology-based releases. It may appear in 12.2S-family releases. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show controller cbus Displays detailed information on the cards connected to the CBus controller. show stacks Displays the stack trace and version information of the master and slave RSP cards. slave sync config CF-1064 Cisco IOS Configuration Fundamentals Command Reference April 2010 show version Displays the software version running on the master and slave RSP cards. slave auto-sync config Turns on automatic synchronization of configuration files for a Cisco 7507 or Cisco 7513 router that is configured for HSA. Command Description slave terminal CF-1065 Cisco IOS Configuration Fundamentals Command Reference April 2010 slave terminal To enable access to the slave Route Switch Processor (RSP) console, use the slave terminal global configuration command. To disable access to the slave RSP console, use the no form of this command. slave terminal no slave terminal Syntax Description This command has no arguments or keywords. Defaults Enabled Command Modes Global configuration Command History Usage Guidelines The slave console does not have enable password protection. Thus, an individual connected to the slave console port can enter privileged EXEC mode and view or erase the configuration of the router. Use the no slave terminal command to disable slave console access and prevent security problems. When the slave console is disabled, users cannot enter commands. If slave console access is disabled, the following message appears periodically on the slave console: %%Slave terminal access is disabled. Use "slave terminal" command in master RSP configuration mode to enable it. Examples In the following example, the user disables console access to the slave RSP: c7507(config)# no slave terminal Related Commands Release Modification 11.1 The command was introduced. 12.2(13)T This command is no longer supported in Cisco IOS Mainline or Technology-based releases. It may appear in 12.2S-family releases. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show controller cbus Displays detailed information on the cards connected to the CBus controller. show stacks Displays the stack trace and version information of the master and slave RSP cards. show version Displays the software version running on the master and slave RSP cards. slave auto-sync config Turns on automatic synchronization of configuration files for a Cisco 7507 or Cisco 7513 router that is configured for Dual RSP Cards. special-character-bits CF-1066 Cisco IOS Configuration Fundamentals Command Reference April 2010 special-character-bits To configure the number of data bits per character for special characters such as software flow control characters and escape characters, use the special-character-bits command in line configuration mode. To restore the default value, use the no form of this command. special-character-bits {7 | 8} no special-character-bits Syntax Description Defaults 7-bit ASCII character set Command Modes Line configuration Command History Usage Guidelines Setting the special character bits to 8 allows you to use twice as many special characters as with the 7-bit ASCII character set. The special characters affected by this setting are the escape, hold, stop, start, disconnect, and activation characters. Examples The following example allows the full 8-bit international character set for special characters on line 5: Router(config)# line 5 Router(config-line)# special-character-bits 8 Related Commands 7 Selects the 7-bit ASCII character set. This is the default. 8 Selects the full 8-bit character set for special characters. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description default-value exec-character-bits Defines the EXEC character width for either 7 bits or 8 bits. default-value special-character-bits Configures the flow control default value from a 7-bit width to an 8-bit width. exec-character-bits Configures the character widths of EXEC and configuration command characters. terminal exec-character-bits Locally changes the ASCII character set used in EXEC and configuration command characters for the current session. terminal special-character-bits Changes the ASCII character widths to accept special characters for the current terminal line and session. squeeze CF-1067 Cisco IOS Configuration Fundamentals Command Reference April 2010 squeeze To permanently erase files tagged as “deleted” or “error” on Class A flash file systems, use the squeeze command in privileged EXEC mode. squeeze [/nolog] [/quiet] filesystem: Cisco 7600 Series Router squeeze filesystem: Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines When flash memory is full, you might need to rearrange the files so that the space used by the files marked “deleted” can be reclaimed. (This “squeeze” process is required for linear flash memory cards to make sectors contiguous; the free memory must be in a “block” to be usable.) When you enter the squeeze command, the router copies all valid files to the beginning of flash memory and erases all files marked “deleted.” After the squeeze process is completed, you can write to the reclaimed flash memory space. /nolog (Optional) Disables the squeeze log (recovery data) and accelerates the squeeze process. /quiet (Optional) Disables status messages during the squeeze process. filesystem: The flash file system, followed by a colon. For the Cisco 7600 series router, the valid values for the flash file system are bootflash: and flash:. Release Modification 11.1 This command was introduced. 12.2(1) This command was implemented on the Cisco 2600 and Cisco 3600 series routers. 12.0(17)S This command was integrated into Cisco IOS Release 12.0(17)S, and the /nolog and /quiet keywords were added. 12.2(1a) The /nolog and /quiet keywords were added. 12.0(17)ST This command was integrated into Cisco IOS Release 12.0(17)ST. 12.1(9)E This command was integrated into Cisco IOS Release 12.1(9)E. 12.2(2)B This command was integrated into Cisco IOS Release 12.2(2)B. 12.2(4)XL This command was implemented on the Cisco 1700 series routers. 12.2(14)SX Support for this command was implemented on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was integrated into Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. squeeze CF-1068 Cisco IOS Configuration Fundamentals Command Reference April 2010 Caution After performing the squeeze process, you cannot recover deleted files using the undelete EXEC mode command. In addition to removing deleted files, use the squeeze command to remove any files that the system has marked as “error”. An error file is created when a file write fails (for example, the device is full). To remove error files, you must use the squeeze command. Rewriting flash memory space during the squeeze operation may take several minutes. Using the /nolog keyword disables the log for the squeeze process. In most cases, this process will speed up the squeeze process. However, if power is lost or the flash card is removed during the squeeze process, all the data on the flash card will be lost, and the device will have to be reformatted. Note Using the /nolog keyword makes the squeeze process uninterruptible. Using the /quiet keyword disables the output of status messages to the console during the squeeze process. If the optional keywords are not used, the progress of the squeeze process will be displayed to the console, a log for the process will be maintained, and the squeeze process is interruptible. On Cisco 2600 or Cisco 3600 series routers, the entire file system has to be erased once before the squeeze command can be used. After being erased once, the squeeze command should operate properly on the flash file system for the rest of the flash file system’s history. To erase an entire flash file system on a Cisco 2600 or 3600 series router, perform the following steps: Step 1 If the flash file system has multiple partitions, enter the no partition command to remove the partitions. The reason for removing partitions is to ensure that the entire flash file system is erased. The squeeze command can be used in a flash file system with partitions after the flash file system is erased once. Step 2 Enter the erase command to erase the flash file system. Examples Supported Platforms Other tha the Cisco 7600 Series Router In the following example, the file named config1 is deleted, and then the squeeze command is used to reclaim the space used by that file. The /nolog option is used to speed up the squeeze process. Router# delete config1 Delete filename [config1]? Delete slot0:conf? [confirm] Router# dir slot0: ! Note that the deleted file name appears in square brackets Directory of slot0:/ 1 -rw- 4300244 Apr 02 2001 03:18:07 c7200-boot-mz.122-0.14 2 -rw- 2199 Apr 02 2001 04:45:15 [config1] 3 -rw- 4300244 Apr 02 2001 04:45:23 image 20578304 bytes total (11975232 bytes free) !20,578,304 - 4,300,244 - 4,300,244 - 2,199 - 385 = 11975232 squeeze CF-1069 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router# squeeze /nolog slot0: %Warning: Using /nolog option would render squeeze operation uninterruptible. All deleted files will be removed. Continue? [confirm] Squeeze operation may take a while. Continue? [confirm] Squeeze of slot0 completed in 291.832 secs . Router# dir slot0: Directory of slot0:/ 1 -rw- 4300244 Apr 02 2001 03:18:07 c7200-boot-mz.122-0.14 2 -rw- 4300244 Apr 02 2001 04:45:23 image 20578304 bytes total (11977560 bytes free) !20,578,304 - 4,300,244 - 4,300,244 - 256 = 11977560 Cisco 7600 Series Router This example shows how to permanently erase the files that are marked “deleted” from the flash memory: Router# squeeze flash: Related Commands Command Description delete Deletes a file on a flash memory device. dir Displays a list of files on a file system. erase Erases a file system. undelete Recovers a file marked “deleted” on a Class A or Class B flash file system. stack-mib portname CF-1070 Cisco IOS Configuration Fundamentals Command Reference April 2010 stack-mib portname To specify a name string for a port, use the stack-mib portname command in interface configuration mode. stack-mib portname portname Syntax Description Defaults This command has no default settings. Command Modes Interface configuration Command History Usage Guidelines Using the stack-mib command to set a name string to a port corresponds to the portName MIB object in the portTable of CISCO-STACK-MIB. portName is the MIB object in the portTable of CISCO-STACK-MIB. You can set this object to be descriptive text describing the function of the interface. Examples This example shows how to set a name to a port: Router(config-if)# stack-mib portname portall Router(config-if)# portname Name for a port. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. state-machine CF-1071 Cisco IOS Configuration Fundamentals Command Reference April 2010 state-machine To specify the transition criteria for the state of a particular state machine, use the state-machine command in global configuration mode. To remove a particular state machine from the configuration, use the no form of this command. state-machine name state first-character last-character [next-state | transmit] no state-machine name Syntax Description Defaults No transition criteria are specified. Command Modes Global configuration Command History Usage Guidelines This command is paired with the dispatch-machine line configuration command, which defines the line on which the state machine is effective. name Name for the state machine (used in the dispatch-machine line configuration command). The user can specify any number of state machines, but each line can have only one state machine associated with it. state State being modified. There are a maximum of eight states per state machine. Lines are initialized to state 0 and return to state 0 after a packet is transmitted. first-character last-character Specifies a range of characters. Use ASCII numerical values. If the state machine is in the indicated state, and the next character input is within this range, the process goes to the specified next state. Full 8-bit character comparisons are done, so the maximum value is 255. Ensure that the line is configured to strip parity bits (or not generate them), or duplicate the low characters in the upper half of the space. next-state (Optional) State to enter if the character is in the specified range. transmit (Optional) Causes the packet to be transmitted and the state machine to be reset to state 0. Recurring characters that have not been explicitly defined to have a particular action return the state machine to state 0. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. state-machine CF-1072 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example a dispatch machine named “function” is configured to ensure that the function key characters on an ANSI terminal are kept in one packet. Because the default in the example is to remain in state 0 without sending anything, normal key signals are sent immediately. Router(config)# line 1 20 Router(config-line)# dispatch-machine function Router(config-line)# exit Router(config)# state-machine function 0 0 255 transmit Related Commands Command Description dispatch-character Defines a character that causes a packet to be sent. dispatch-machine Specifies an identifier for a TCP packet dispatch state machine on a particular line. dispatch-timeout Sets the character dispatch timer. stopbits CF-1073 Cisco IOS Configuration Fundamentals Command Reference April 2010 stopbits To set the number of the stop bits transmitted per byte, use the stopbits command in line configuration mode. To restore the default value, use the no form of this command. stopbits {1 | 1.5 | 2} no stopbits Syntax Description Defaults 2 stop bits per byte Command Modes Line configuration Command History Usage Guidelines Communication protocols provided by devices such as terminals and modems often require a specific stop-bit setting. Examples In the following example, the stop bits transmitted per byte are changed from the default of two stop bits to one stop bit as a performance enhancement for line 4: Router(config)# line 4 Router(config-line)# stopbits 1 Related Commands 1 One stop bit. 1.5 One and one-half stop bits. 2 Two stop bits.This is the default. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description terminal stopbits Changes the number of stop bits sent per byte by the current terminal line during an active session. storm-control level CF-1074 Cisco IOS Configuration Fundamentals Command Reference April 2010 storm-control level To set the suppression level, use the storm-control level command in interface configuration mode. To turn off the suppression mode, use the no form of this command. storm-control {broadcast | multicast | unicast} level level[.level] no storm-control {broadcast | multicast | unicast} level Syntax Description Defaults All packets are passed. Command Modes Interface configuration Command History Usage Guidelines You can enter this command on switch ports and router ports. Enter the storm-control level command to enable traffic storm control on the interface, configure the traffic storm-control level, and apply the traffic storm-control level to all traffic storm-control modes that are enabled on the interface. Only one suppression level is shared by all three suppression modes. For example, if you set the broadcast level to 30 and set the multicast level to 40, both levels are enabled and set to 40. The Cisco 7600 series router supports storm control for multicast and unicast traffic only on Gigabit Ethernet LAN ports. The switch supports storm control for broadcast traffic on all LAN ports. The multicast and unicast keywords are supported on Gigabit Ethernet LAN ports only. These keywords are not supported on 10 Mbps, 10/100 Mbps, 100 Mbps, or 10-Gigabit Ethernet modules. The period is required when you enter the fractional-suppression level. broadcast Specifies the broadcast traffic. multicast Specifies the multicast traffic. unicast Specifies the unicast traffic. level Integer-suppression level; valid values are from 0 to 100 percent. .level (Optional) Fractional-suppression level; valid values are from 0 to 99. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. storm-control level CF-1075 Cisco IOS Configuration Fundamentals Command Reference April 2010 The suppression level is entered as a percentage of the total bandwidth. A threshold value of 100 percent means that no limit is placed on traffic. A threshold value of 0 or 0.0 (fractional) percent means that all specified traffic is blocked on a port, with the following guidelines: • A fractional level value of 0.33 or lower is the same as 0.0 on the following modules: – WS-X6704-10GE – WS-X6748-SFP – WS-X6724-SFP – WS-X6748-GE-TX • Enter 0 on all other modules to block all specified traffic on a port. Enter the show interfaces counters broadcast command to display the discard count. Enter the show running-config command to display the enabled suppression mode and level setting. To turn off suppression for the specified traffic type, you can do one of the following: • Set the level to 100 percent for the specified traffic type. • Use the no form of this command. Examples This example shows how to enable and set the suppression level: Router(config-if)# storm-control broadcast level 30 This example shows how to disable the suppression mode: Router(config-if)# no storm-control multicast level Related Commands Command Description show interfaces counters Displays the traffic that the physical interface sees. show running-config Displays the status and configuration of the module or Layer 2 VLAN. sync-restart-delay CF-1076 Cisco IOS Configuration Fundamentals Command Reference April 2010 sync-restart-delay To set the synchronization-restart delay timer to ensure accurate status reporting, use the sync-restart-delay command in interface configuration mode. To disable the synchronization-restart delay timer, use the no form of this command. sync-restart-delay timer no sync-restart-delay timer Syntax Description Defaults timer is 210 milliseconds. Command Modes Interface configuration Command History Usage Guidelines This command is supported on Gigabit Ethernet fiber ports only. The status register records the current status of the link partner. Examples This example shows how to set the Gigabit Ethernet synchronization-restart delay timer: Router(config-if)# sync-restart-delay 2000 Related Commands timer Interval between status-register resets; valid values are from 200 to 60000 milliseconds. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show running-config Displays the status and configuration of the module or Layer 2 VLAN. system flowcontrol bus CF-1077 Cisco IOS Configuration Fundamentals Command Reference April 2010 system flowcontrol bus To set the FIFO overflow error count, use the system flowcontrol bus command in global configuration mode. To return to the original FIFO threshold settings, use the no form of this command. [default] system flowcontrol bus {auto | on} no system flowcontrol bus Syntax Description Defaults auto Command Modes Global configuration Command History Usage Guidelines Note We recommend that you leave the system flow control in auto mode and use the other modes under the advice of Cisco TAC only. Examples This example shows how to monitor the FIFO overflow error count and send a warning message if the FIFO overflow error count exceeds a configured error threshold in 5-second intervals: Router(config)# system flowcontrol bus auto This example shows how to specify the original FIFO threshold settings: Router(config)# system flowcontrol bus on default (Optional) Specifies the default settings. auto Monitors the FIFO overflow error count and sends a warning message if the FIFO overflow error count exceeds a configured error threshold in 5-second intervals. on Specifies the original FIFO threshold settings. Release Modification 12.2(18)SXF Support for this command was introduced on the Supervisor Engine 720 and the Supervisor Engine 32. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. system jumbomtu CF-1078 Cisco IOS Configuration Fundamentals Command Reference April 2010 system jumbomtu To set the maximum size of the Layer 2 and Layer 3 packets, use the system jumbomtu command in global configuration mode. To revert to the default MTU setting, use the no form of this command. system jumbomtu mtu-size no system jumbomtu Syntax Description Defaults mtu-size is 9216 bytes. Command Modes Global configuration Command History Usage Guidelines The mtu-size parameter specifies the Ethernet packet size, not the total Ethernet frame size. The Layer 3 MTU is changed as a result of entering the system jumbomtu command. The system jumbomtu command enables the global MTU for port ASICs. On a port ASIC after jumbo frames are enabled, the port ASIC accepts any size packet on the ingress side and checks the outgoing packets on the egress side. The packets on the egress side that exceed the global MTU are dropped by the port ASIC. For example, if you have port A in VLAN 1 and Port B in VLAN 2, and if VLAN 1 and VLAN 2 are configured for mtu 9216 and you enter the system jumbomtu 4000 command, the packets that are larger than 4000 bytes are not transmitted out because Ports B and A drop anything larger than 4000 bytes. Examples This example shows how to set the global MTU size to 1550 bytes: Router(config)# system jumbomtu 1550 This example shows how to revert to the default MTU setting: Router(config)# no system jumbomtu mtu-size Maximum size of the Layer 2 and Layer 3 packets; valid values are from 1500 to 9216 bytes. Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. system jumbomtu CF-1079 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description mtu Adjusts the maximum packet size or MTU size. show interfaces Displays traffic that is seen by a specific interface. show system jumbomtu Displays the global MTU setting. tdm clock priority CF-1080 Cisco IOS Configuration Fundamentals Command Reference April 2010 tdm clock priority To configure the clock source and priority of the clock source used by the time-division multiplexing (TDM) bus on the Cisco AS5350, AS5400, and AS5850 access servers, use the tdm clock priority command in global configuration mode. To return the clock source and priority to the default values, use the no form of this command. tdm clock priority priority-number {slot/ds1-port | slot/ds3-port:ds1-port | external | freerun} no tdm clock priority priority-number {slot/ds1-port | slot/ds3-port:ds1-port | external | freerun} Syntax Description Defaults If no clocks are configured, the system uses a default, primary clock. An external clock is never selected by default; it must be explicitly configured. Command Modes Global configuration Command History Usage Guidelines The TDM bus can receive an input clock from one of three sources on the gateway: • CT1, CE1, and CT3 trunk cards • An external T1/E1 clock source feed directly through the Building Integrated Timing Supply (BITS) interface port on the motherboard • Free-running clock providing clock from an oscillator priority-number Priority of the clock source. The priority range is from 1 to 99. A clock set to priority 100 will not drive the TDM bus. slot/ds1-port Trunk-card slot is a value from 1 to 7. DS1 port number controller is a value between 0 and 7. Specify with a slash separating the numbers; for example, 1/1. slot/ds3-port:ds1-port Trunk-card slot is a value from 1 to 7. DS3 port specifies the T3 port. DS1 port number controller is a value from 1 to 28. Specify with a slash separating the slot and port numbers, and a colon separating the DS1 port number. An example is 1/0:19. external Synchronizes the TDM bus with an external clock source that can be used as an additional network reference. freerun Selects the free-running clock from the local oscillator when there is no good clocking source from a trunk card or an external clock source. Release Modification 12.2(8)T This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. tdm clock priority CF-1081 Cisco IOS Configuration Fundamentals Command Reference April 2010 Note BITS is a single building master timing supply. BITS generally supplies DS1- and DS0-level timing throughout an office. BITS is the clocks that provide and distribute timing to a wireline network’s lower levels. Trunk-Card Ports The TDM bus can be synchronized with any trunk cards. On the CT1/CE1 trunk card, each port receives the clock from the T1/E1 line. The CT3 trunk card uses an M13 multiplexer to receive the DS1 clock. Each port on each trunk-card slot has a default clock priority. Also, clock priority is configurable through the tdm clock priority command. External Clock The TDM bus can be synchronized with an external clock source that can be used as an additional network reference. If no clocks are configured, the system uses a primary clock through a software-controlled default algorithm. If you want the external T1/E1 clock (from the BITS interface) as the primary clock source, you must configure it using the external keyword with the tdm clock priority command; the external clock is never selected by default. The BITS interface requires a T1 line composite clock reference set at 1.544 MHz and an E1 line composite clock reference set at 2.048 MHz. Free-Running Clock If there is no good clocking source from a trunk card or an external clock source, then select the free-running clock from the internal oscillator using the freerun keyword with the tdm clock priority command. Examples In the following example, BITS clock is set at priority 1: AS5400(config)# tdm clock priority priority 1 external In the following example, a trunk clock from a CT1 trunk card is set at priority 2 and uses slot 4 and DS1 port (controller) 6: AS5400(config)# tdm clock priority priority 2 4/6 In the following example, a trunk clock from a CT3 trunk card is set at priority 2 and uses slot 1, DS3 port 0, and DS1 port 19: AS5400(config)# tdm clock priority priority 2 1/0:19 In the following example, free-running clock is set at priority 3: AS5400(config)# tdm clock priority priority 3 freerun Related Commands Command Description dial-tdm-clock Configures the clock source and priority of the clock source used by the TDM bus on the dial shelf of the Cisco AS5800. show tdm clocks Displays default system clocks and clock history. terminal databits CF-1082 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal databits To change the number of data bits per character for the current terminal line for this session, use the terminal databits command in EXEC mode. terminal databits {5 | 6 | 7 | 8} Syntax Description Defaults 8 data bits per character Command Modes EXEC Command History Usage Guidelines Communication protocols provided by devices such as terminals and modems often require a specific data bit setting. The terminal databits command can be used to mask the high bit on input from devices that generate 7 data bits with parity. If parity is being generated, specify 7 data bits per character. If no parity generation is in effect, specify 8 data bits per character. The other keywords (5 and 6) are supplied for compatibility with older devices and are generally not used. Examples In the following example, the databits per character is changed to seven for the current session: Router# terminal databits 7 Related Commands 5 Five data bits per character. 6 Six data bits per character. 7 Seven data bits per character. 8 Eight data bits per character. This is the default. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description databits Sets the number of data bits per character that are interpreted and generated by the router hardware. terminal parity Defines the generation of the parity bit for the current terminal line and session. terminal data-character-bits CF-1083 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal data-character-bits To set the number of data bits per character that are interpreted and generated by the Cisco IOS software for the current line and session, use the terminal data-character-bits command in EXEC mode. terminal data-character-bits {7 | 8} Syntax Description Defaults 8 data bits per character Command Modes EXEC Command History Usage Guidelines This command is used primarily to strip parity from X.25 connections on routers with the protocol translation software option. The terminal data-character-bits command does not work on hard-wired lines. Examples The following example sets the data bits per character to seven on the current line: Router# terminal data-character-bits 7 Related Commands 7 Seven data bits per character. 8 Eight data bits. This is the default. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description data-character-bits Sets the number of data bits per character that are interpreted and generated by the Cisco IOS software. terminal dispatch-character CF-1084 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal dispatch-character To define a character that causes a packet to be sent for the current session, use the terminal dispatch-character command in EXEC mode. terminal dispatch-character ascii-number [ascii-number2 . . . ascii-number] Syntax Description Command Modes EXEC Command History Usage Guidelines At times, you might want to queue up a string of characters until they fill a complete packet and then transmit the packet to a remote host. This can make more efficient use of a line, because the access server or router normally dispatches each character as it is entered. Examples The following example defines the characters Ctrl-D (ASCII decimal character 4) and Ctrl-Y (ASCII decimal character 25) as the dispatch characters: Router# terminal dispatch-character 4 25 Related Commands ascii-number The ASCII decimal representation of the character, such as Return (ASCII character 13) for line-at-a-time transmissions. ascii-number2 . . . ascii-number (Optional) Additional decimal representations of characters. This syntax indicates that you can define any number of characters as dispatch characters. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description dispatch-character Defines a character that causes a packet to be sent. terminal dispatch-timeout CF-1085 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal dispatch-timeout To set the character dispatch timer for the current terminal line for the current session, use the terminal dispatch-timeout command in EXEC mode. terminal dispatch-timeout milliseconds Syntax Description Command Modes EXEC Command History Usage Guidelines Use this command to increase the processing efficiency of the remote host. The dispatch-timeout line configuration command causes the software to buffer characters into packets for transmission to the remote host. The Cisco IOS software sends a packet a specified amount of time after the first character is put into the buffer. You can use the terminal dispatch-timeout and terminal dispatch-character line configuration commands together. In this case, the software dispatches a packet each time the dispatch character is entered, or after the specified dispatch timeout interval, depending on which condition is met first. Note The router response time might appear intermittent if the timeout interval is greater than 100 milliseconds and remote echoing is used. Examples In the following example, the dispatch timeout timer is set to 80 milliseconds: Router# terminal dispatch-timeout 80 Related Commands milliseconds Integer that specifies the number of milliseconds that the router waits after it puts the first character into a packet buffer before sending the packet. During this interval, more characters can be added to the packet, which increases the processing efficiency of the remote host. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description dispatch-timeout Sets the character dispatch timer for a specified line or group of lines. terminal download CF-1086 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal download To temporarily set the ability of a line to act as a transparent pipe for file transfers for the current session, use the terminal download command in EXEC mode. terminal download Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes EXEC Command History Usage Guidelines You can use this feature to run a program such as KERMIT, XMODEM, or CrossTalk that downloads a file across an access server or router line. This command configures the terminal line to send data and is equivalent to entering all the following commands: • terminal telnet transparent • terminal no escape-character (see terminal escape-character) • terminal no hold-character (see terminal hold-character) • terminal no padding 0 (see terminal padding) • terminal no padding 128 (see terminal padding) • terminal parity none • terminal databits 8 Examples The following example configures a line to act as a transparent pipe: Router# terminal download Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. terminal editing CF-1087 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal editing To reenable the enhanced editing mode for only the current terminal session, use the terminal editing command in EXEC mode. To disable the enhanced editing mode on the current line, use the no form of this command. terminal editing terminal no editing Syntax Description This command has no arguments or keywords. Defaults Enabled Command Modes EXEC Command History Usage Guidelines This command is identical to the editing EXEC mode command, except that it controls (enables or disables) enhanced editing for only the terminal session you are using. For a description of the available editing keys, see the description of the editing command in this document. Examples In the following example, enhanced editing mode is reenabled for only the current terminal session: Router> terminal editing Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description editing Controls CLI enhanced editing features for a particular line. terminal escape-character CF-1088 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal escape-character To set the escape character for the current terminal line for the current session, use the terminal escape-character command in EXEC mode. terminal escape-character ascii-number Syntax Description Defaults Ctrl-^ (Ctrl-Shift-6) Command Modes EXEC Command History Usage Guidelines See the “ASCII Character Set and Hexidecimal Values” appendix for a list of ASCII characters and their numerical representation. This command is useful, for example, if you have the default escape character defined for a different purpose in your keyboard file. Entering the escape character followed by the X key returns you to EXEC mode when you are connected to another computer. Note The Break key generally cannot be used as an escape character on the console terminal because the operating software interprets the Break command on a console line as an instruction to halt the system. Examples In the following example, the escape character to Ctrl-P (ASCII decimal character 16) for the current session: Router# terminal escape-character 16 Related Commands ascii-number ASCII decimal representation of the escape character or control sequence (for example, Ctrl-P ). Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description escape-character Defines a system escape character. terminal exec-character-bits CF-1089 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal exec-character-bits To locally change the ASCII character set used in EXEC and configuration command characters for the current session, use the terminal exec-character-bits command in EXEC mode. terminal exec-character-bits {7 | 8} Syntax Description Defaults 7-bit ASCII character set (unless set otherwise in global configuration mode) Command Modes EXEC Command History Usage Guidelines This EXEC command overrides the default-value exec-character-bits global configuration command. Configuring the EXEC character width to 8 bits enables you to view special graphical and international characters in banners, prompts, and so on. When the user exits the session, the character width is reset to the default value established by the exec-character-bits global configuration command. However, setting the EXEC character width to 8 bits can also cause failures. For example, if a user on a terminal that is sending parity enters the help command, an “unrecognized command” message appears because the system is reading all 8 bits, and the eighth bit is not needed for the help command. Examples The following example temporarily configures the system to use a full 8-bit user interface for system banners and prompts, allowing the use of additional graphical and international characters: Router# terminal exec-character-bits 8 Related Commands 7 Selects the 7-bit ASCII character set. This is the default. 8 Selects the full 8-bit character set. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description exec-character-bits Configures the character widths of EXEC and configuration command characters. terminal flowcontrol CF-1090 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal flowcontrol To set flow control for the current terminal line for the current session, use the terminal flowcontrol command in EXEC mode. terminal flowcontrol {none | software [in | out] | hardware} Syntax Description Command Modes EXEC Command History Usage Guidelines Flow control enables you to regulate the rate at which data can be transmitted from one point so that it is equal to the rate at which it can be received at another point. Flow control protects against loss of data because the terminal is not capable of receiving data at the rate it is being sent. You can set up data flow control for the current terminal line in one of two ways: software flow control, which you do with control key sequences, and hardware flow control, which you do at the device level. For software flow control, the default stop and start characters are Ctrl-S and Ctrl-Q (XOFF and XON). You can change them with the terminal stop-character and terminal start-character EXEC commands. Examples In the following example, incoming software flow control is set for the current session: Router# terminal flowcontrol software in Related Commands none Prevents flow control. software Sets software flow control. in | out (Optional) Specifies the direction of flow control: in causes the router to listen to flow control from the attached device, and out causes the router to send flow control information to the attached device. If you do not specify a direction, both directions are assumed. hardware Sets hardware flow control. For information about setting up the EIA/TIA-232 line, see the manual that was shipped with your product. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description flowcontrol Sets the method of data flow control between the terminal or other serial device and the router. terminal full-help CF-1091 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal full-help To get help for the full set of user-level commands, use the terminal full-help command in EXEC mode. terminal full-help Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes EXEC Command History Usage Guidelines The terminal full-help command enables a user to see all of the help messages available from the terminal. It is used with the show ? command. Examples In the following example, the difference between the output of the show ? command before and after using the terminal full-help command is shown: Router> show ? bootflash Boot Flash information calendar Display the hardware calendar clock Display the system clock context Show context information dialer Dialer parameters and statistics history Display the session command history hosts IP domain-name, lookup style, nameservers, and host table isdn ISDN information kerberos Show Kerberos Values modemcap Show Modem Capabilities database ppp PPP parameters and statistics rmon rmon statistics sessions Information about Telnet connections snmp snmp statistics terminal Display terminal configuration parameters users Display information about terminal lines version System hardware and software status Router> terminal full-help Router> show ? access-expression List access expression access-lists List access lists Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. terminal full-help CF-1092 Cisco IOS Configuration Fundamentals Command Reference April 2010 aliases Display alias commands apollo Apollo network information appletalk AppleTalk information arp ARP table async Information on terminal lines used as router interfaces bootflash Boot Flash information bridge Bridge Forwarding/Filtering Database [verbose] bsc BSC interface information bstun BSTUN interface information buffers Buffer pool statistics calendar Display the hardware calendar cdp CDP information clns CLNS network information clock Display the system clock cls DLC user information cmns Connection-Mode networking services (CMNS) information compress Show compression statistics. . . . x25 X.25 information xns XNS information xremote XRemote statistics Related Commands Command Description full-help Gets help for the full set of user-level commands. help Displays a brief description of the help system. terminal history CF-1093 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal history To enable the command history function with 10 lines for the current terminal session, use the terminal history command in user EXEC or privileged EXEC mode. To disable the command history function, use the no form of this command. terminal history terminal no history Syntax Description This command has no arguments or keywords. Defaults Enabled, history buffer of 10 lines Command Modes User EXEC Privileged EXEC Command History Usage Guidelines The history function provides a record of commands you have entered. This function is particularly useful for recalling long or complex commands or entries for the purposes of modifying them slightly and reexecuting them. The terminal history command enables the command history function with the default buffer size or the last buffer size specified using the terminal history size command. Table 1 lists the keys and functions you can use to recall commands from the history buffer. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 166 History Keys Key(s) Function Ctrl-P or Up Arrow1 1. The arrow keys function only with ANSI-compatible terminals. Recalls commands in the history buffer in a backward sequence, beginning with the most recent command. Repeat the key sequence to recall successively older commands. Ctrl-N or Down Arrow1 Returns to more recent commands in the history buffer after recalling commands with Ctrl-P or the Up Arrow. Repeat the key sequence to recall successively more recent commands. terminal history CF-1094 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, the command history feature is disabled for the current terminal session: Router> terminal no history Related Commands Command Description history Enables the command history function, or changes the command history buffer size for a particular line. show history Lists the commands you have entered in the current EXEC session. terminal history size Sets the size of the history buffer for the command history feature for the current terminal session. terminal history size CF-1095 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal history size To change the size of the command history buffer for the current terminal session, use the terminal history size command in EXEC mode. To reset the command history buffer to its default size of 10 lines, use the no form of this command. terminal history size number-of-lines terminal no history size Syntax Description Defaults 10 lines of command history Command Modes EXEC Command History Usage Guidelines The history feature provides a record of commands you have entered. This feature is particularly useful for recalling long or complex commands or entries for the purposes of modifying them slightly and reissuing them. The terminal history size command enables the command history feature and sets the command history buffer size. The terminal no history size command resets the buffer size to the default of 10 command lines. Table 2 lists the keys and functions you can use to recall commands from the history buffer. When you use these keys, the commands recalled will be from EXEC mode if you are in EXEC mode, or from all configuration modes if you are in any configuration mode. number-of-lines Number of command lines that the system will record in its history buffer. The range is from 0 to 256. The default is 10. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 167 History Keys Key Function Ctrl-P or Up Arrow1 1. The arrow keys function only with ANSI-compatible terminals. Recalls commands in the history buffer in a backward sequence, beginning with the most recent command. Repeat the key sequence to recall successively older commands. Ctrl-N or Down Arrow1 Returns to more recent commands in the history buffer after recalling commands with Ctrl-P or the Up Arrow. Repeat the key sequence to recall successively more recent commands. terminal history size CF-1096 Cisco IOS Configuration Fundamentals Command Reference April 2010 In EXEC mode, you can also use the show history command to show the contents of the command history buffer. To check the current settings for the command history feature on your line, use the show line command. Examples In the following example, the number of command lines recorded is set to 15 for the current terminal session. The user then checks to see what line he/she is connected to using the show users command. The user uses this line information to issue the show line command. (In this example, the user uses the show begin option in the show line command to start the output at the “Editing is enabled/disabled” line.) Router# terminal history size 15 Router# show users Line User Host(s) Idle Location * 50 vty 0 admin idle 00:00:00 ! the * symbol indicates the active terminal session for the user (line 50) Router# show line 50 | begin Editing Editing is enabled. ! the following line shows the history settings for the line History is enabled, history size is 15. DNS resolution in show commands is enabled Full user help is disabled Allowed transports are telnet. Preferred is none. No output characters are padded No special data dispatching characters Related Commands Command Description history Enables the command history function, or changes the command history buffer size for a particular line. show begin Searches the output of any show command and displays the output from the first instance of a specified string. show history Lists the commands you have entered in the current EXEC session. terminal history Enables the command history feature for the current terminal session. terminal hold-character CF-1097 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal hold-character To define the hold character for the current session, use the terminal hold-character command in EXEC mode. To return the hold character definition to the default, use the no form of this command. terminal hold-character ascii-number terminal no hold-character Syntax Description Defaults The default hold character is defined by the hold-character global configuration command. Command Modes EXEC Command History Usage Guidelines You can define a local hold character that temporarily suspends the flow of output on the terminal. When information is scrolling too quickly, you can enter the hold character to pause the screen output, then enter any other character to resume the flow of output. You cannot suspend output on the console terminal. To send the hold character to the host, precede it with the escape character. Examples In the following example, the hold character for the current (local) session is set to Ctrl-P. The show terminal output is included to show the verification of the setting (the value for the hold character is shown in the “Special Characters” listing). Router# terminal hold-character 16 "^P" is the local hold character Router# show terminal Line 50, Location: "", Type: "VT220" Length: 24 lines, Width: 80 columns Baud rate (TX/RX) is 9600/9600 Status: PSI Enabled, Ready, Active, No Exit Banner, Automore On Capabilities: none Modem state: Ready Group codes: 0 ascii-number ASCII decimal representation of a character or control sequence (for example, Ctrl-P). Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. terminal hold-character CF-1098 Cisco IOS Configuration Fundamentals Command Reference April 2010 Special Chars: Escape Hold Stop Start Disconnect Activation ^^x ^P - - none Timeouts: Idle EXEC Idle Session Modem Answer Session Dispatch 00:10:00 never none not set Idle Session Disconnect Warning never Login-sequence User Response 00:00:30 Autoselect Initial Wait not set Modem type is unknown. Session limit is not set. Time since activation: 00:04:13 Editing is enabled. History is enabled, history size is 10. . . . Related Commands Command Description hold-character Defines the local hold character used to pause output to the terminal screen. show terminal Displays settings for terminal operating characteristics. terminal international CF-1099 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal international If you are using Telnet to access a Cisco IOS platform and you want to display 8-bit and multibyte international characters (for example, Kanji) and print the Escape character as a single character instead of as the caret and bracket symbols (^[) for a current Telnet session, use the terminal international command in user EXEC or priviledged mode. To display characters in 7-bit format for a current Telnet session, use the no form of this command. terminal international no terminal international Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes User EXEC Privileged EXEC Command History Usage Guidelines If you are configuring a Cisco IOS platform using the Cisco web browser UI, this feature is enabled automatically when you enable the Cisco web browser UI using the ip http server global configuration command. Examples The following example enables a Cisco IOS platform to display 8-bit and multibyte characters and print the Escape character as a single character instead of as the caret and bracket symbols (^[) when you are using Telnet to access the platform for the current Telnet session: Router# terminal international Related Commands Release Modification 11.3 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description international Prints the Escape character as a single character instead of as the caret and bracket symbols (^[) in instances when you are using Telnet to access a Cisco IOS platform and you want to display 8-bit and multibyte international characters (for example, Kanji). terminal keymap-type CF-1100 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal keymap-type To specify the current keyboard type for the current session, use the terminal keymap-type command in EXEC mode. terminal keymap-type keymap-name Syntax Description Defaults VT100 Command Modes EXEC Command History Usage Guidelines You must use this command when you are using a keyboard other than the default of VT100. Examples The following example specifies a VT220 keyboard as the current keyboard type: Router# terminal keymap-type vt220 Related Commands keymap-name Name defining the current keyboard type. Release Modification 11.2 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description show keymap Displays the current keymap settings. terminal length CF-1101 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal length To set the number of lines on the current terminal screen for the current session, use the terminal length command in EXEC, privileged EXEC, and diagnostic mode. terminal length screen-length Syntax Description Defaults 24 lines Command Modes EXEC (>) Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines The system uses the length value to determine when to pause during multiple-screen output. A value of zero prevents the router from pausing between screens of output. Some types of terminal sessions do not require you to specify the screen length because the screen length specified can be learned by some remote hosts. For example, the rlogin protocol uses the screen length to set up terminal parameters on a remote UNIX host. Examples In the following example, the system is configured to prevent output from pausing if it exceeds the length of the screen: Router# terminal length 0 Related Commands screen-length Number of lines on the screen. A value of zero disables pausing between screens of output. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Routers, and became available in diagnostic mode. Command Description length Sets the terminal screen length. terminal monitor CF-1102 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal monitor To display debug command output and system error messages for the current terminal and session, use the terminal monitor command in EXEC mode. terminal monitor Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes EXEC Command History Usage Guidelines Remember that all terminal parameter-setting commands are set locally and do not remain in effect after a session is ended. Examples In the following example, the system is configured to display debug command output and error messages during the current terminal session: Router# terminal monitor Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. terminal notify CF-1103 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal notify To enable terminal notification about pending output from other Telnet connections for the current session, use the terminal notify command in EXEC mode. To disable notifications for the current session, use the no form of this command. terminal notify terminal no notify Syntax Description This command has no arguments or keywords. Command Modes EXEC Command History Usage Guidelines Enabling notifications may be useful if, for example, you want to know when another connection receives mail, or when a process has been completed. This command enables or disables notifications for only the current session. To globally set these notifications, use the notify line configuration command. Examples In the following example, notifications will be displayed to inform the user when output is pending on another connection: Router# terminal notify Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description notify Enables terminal notification about pending output from other Telnet connections. terminal padding CF-1104 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal padding To change the character padding on a specific output character for the current session, use the terminal padding command in EXEC mode. terminal padding ascii-number count Syntax Description Defaults No padding Command Modes EXEC Command History Usage Guidelines Character padding adds a number of null bytes to the end of the string and can be used to make a string an expected length for conformity. Use this command when the attached device is an old terminal that requires padding after certain characters (such as ones that scrolled or moved the carriage). See the“ASCII Character Set and Hexidecimal Values” appendix for a list of ASCII characters. Examples The following example pads Ctrl-D (ASCII decimal character 4) with 164 NULL bytes: Router# terminal padding 4 164 Related Commands ascii-number ASCII decimal representation of the character. count Number of NULL bytes sent after the specified character, up to 255 padding characters in length. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description padding Sets the padding on a specific output character. terminal parity CF-1105 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal parity To define the generation of the parity bit for the current terminal line and session, use the terminal parity command in EXEC mode. terminal parity {none | even | odd | space | mark} Syntax Description Defaults No parity. Command Modes EXEC Command History Usage Guidelines Communication protocols provided by devices such as terminals and modems will sometimes require a specific parity bit setting. Refer to the documentation for your device to determine required parity settings. Examples In the following example, odd parity checking is enabled for the current session: Router# terminal parity odd Related Commands none No parity. This is the default. even Even parity. odd Odd parity. space Space parity. mark Mark parity. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description parity Defines generation of a parity bit for connections on a specified line or lines. terminal rxspeed CF-1106 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal rxspeed To set the terminal receive speed (how fast information is sent to the terminal) for the current line and session, use the terminal rxspeed command in EXEC mode. terminal rxspeed bps Syntax Description Defaults 9600 bps Command Modes EXEC Command History Usage Guidelines Set the speed to match the baud rate of whatever device you have connected to the port. Some baud rates available on devices connected to the port might not be supported on the system. The system will indicate if the speed you select is not supported. Examples The following example sets the current auxiliary line receive speed to 115200 bps: Router# terminal rxspeed 115200 Related Commands bps Baud rate in bits per second (bps). The default is 9600. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description rxspeed Sets the terminal receive speed for a specified line or lines. terminal rxspeed Sets the terminal receive speed for the current session. terminal txspeed Sets the terminal transmit speed for a specified line or lines. terminal speed Sets the transmit and receive speeds for the current session. terminal special-character-bits CF-1107 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal special-character-bits To change the ASCII character widths to accept special characters for the current terminal line and session, use the terminal special-character-bits command in EXEC mode. terminal special-character-bits {7 | 8} Syntax Description Defaults 7-bit ASCII character set Command Modes EXEC Command History Usage Guidelines Configuring the width to 8 bits enables you to use twice as many special characters as with the 7-bit setting. This selection enables you to add special graphical and international characters in banners, prompts, and so on. This command is useful, for example, if you want the router to provide temporary support for international character sets. It overrides the default-value special-character-bits global configuration command and is used to compare character sets typed by the user with the special character available during a data connection, which includes software flow control and escape characters. When you exit the session, character width is reset to the width established by the default-value exec-character-bits global configuration command. Note that setting the EXEC character width to eight bits can cause failures. For example, if a user on a terminal that is sending parity enters the help command, an “unrecognized command” message appears because the Cisco IOS software is reading all eight bits, and the eighth bit is not needed for the help command. Examples The following example temporarily configures a router to use a full 8-bit user interface for system banners and prompts. Router# terminal special-character-bits 8 7 Selects the 7-bit ASCII character set. This is the default. 8 Selects the full 8-bit ASCII character set. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. terminal special-character-bits CF-1108 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description default-value exec-character-bits Globally defines the character width as 7-bit or 8-bit. special-character-bits Configures the number of data bits per character for special characters such as software flow control characters and escape characters. terminal speed CF-1109 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal speed To set the transmit and receive speeds of the current terminal line for the current session, use the terminal speed command in EXEC mode. terminal speed bps Syntax Description Defaults 9600 bps Command Modes EXEC Command History Usage Guidelines Set the speed to match the transmission rate of whatever device you have connected to the port. Some baud rates available on devices connected to the port might not be supported on the router. The router indicates whether the speed you selected is not supported. Examples The following example restores the transmit and receive speed on the current line to 9600 bps: Router# terminal speed 9600 Related Commands bps Baud rate in bits per second (bps). The default is 9600. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description speed Sets the terminal baud rate. terminal start-character CF-1110 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal start-character To change the flow control start character for the current session, use the terminal start-character command in EXEC mode. terminal start-character ascii-number Syntax Description Defaults Ctrl-Q (ASCII decimal character 17) Command Modes EXEC Command History Usage Guidelines The flow control start character signals the start of data transmission when software flow control is in effect. Examples The following example changes the start character to Ctrl-O (ASCII decimal character 15): Router# terminal start-character 15 Related Commands ascii-number ASCII decimal representation of the start character. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description start-character Sets the flow control start character. terminal stopbits CF-1111 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal stopbits To change the number of stop bits sent per byte by the current terminal line during an active session, use the terminal stopbits command in EXEC mode. terminal stopbits {1 | 1.5 | 2} Syntax Description Defaults 2 stop bits Command Modes EXEC Command History Usage Guidelines Communication protocols provided by devices such as terminals and modems often require a specific stop-bit setting. Examples In the following example, the setting for stop bits is changed to one for the current session: Router# terminal stopbits 1 Related Commands 1 One stop bit. 1.5 One and one-half stop bits. 2 Two stop bits. This is the default. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description stopbits Sets the number of the stop bits sent per byte. terminal stop-character CF-1112 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal stop-character To change the flow control stop character for the current session, use the terminal stop-character command in EXEC mode. terminal stop-character ascii-number Syntax Description Defaults Ctrl-S (ASCII character decimal 19) Command Modes EXEC Command History Usage Guidelines The flow control stop character signals the end of data transmission when software flow control is in effect. See the “ASCII Character Set and Hexidecimal Values” appendix for a list of ASCII characters. Examples In the following example, the stop character is configured as Ctrl-E (ASCII character decimal 5) for the current session: Router# terminal stop-character 5 Related Commands ascii-number ASCII decimal representation of the stop character. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description stop-character Sets the flow control stop character. terminal telnet break-on-ip CF-1113 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal telnet break-on-ip To cause an access server to generate a hardware Break signal when an interrupt-process (ip) command is received, use the terminal telnet break-on-ip command in EXEC mode. terminal telnet break-on-ip Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes EXEC Command History Usage Guidelines The hardware Break signal occurs when a Telnet interrupt-process (ip) command is received on that connection. The terminal telnet break-on-ip command can be used to control the translation of Telnet interrupt-process commands into X.25 Break indications. Note In this command, the acronym “ip” indicates “interrupt-process,” not Internet Protocol (IP). This command is also a useful workaround in the following situations: • Several user Telnet programs send an ip command, but cannot send a Telnet Break signal. • Some Telnet programs implement a Break signal that sends an ip command. Some EIA/TIA-232 hardware devices use a hardware Break signal for various purposes. A hardware Break signal is generated when a Telnet Break command is received. You can verify if this command is enabled with the show terminal EXEC command. If enabled the following line will appear in the output: Capabilities: Send BREAK on IP. Examples In the following example, a Break signal is generated for the current connection when an interrupt-process command is issued: Router# terminal telnet break-on-ip Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description terminal telnet ip-on-break Configures the system to send an interrupt-process (ip) signal when the Break command is issued. terminal telnet refuse-negotiations CF-1114 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal telnet refuse-negotiations To configure the current session to refuse to negotiate full-duplex, remote echo options on incoming connections, use the terminal telnet refuse-negotiations command in EXEC mode. terminal telnet refuse-negotiations Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes EXEC Command History Usage Guidelines You can set the line to allow access server to refuse full-duplex, remote echo connection requests from the other end. This command suppresses negotiation of the Telnet Remote Echo and Suppress Go Ahead options. Examples In the following example, the current session is configured to refuse full-duplex, remote echo requests: Router# terminal telnet refuse-negotiations Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. terminal telnet speed CF-1115 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal telnet speed To allow an access server to negotiate transmission speed for the current terminal line and session, use the terminal telnet speed command in EXEC mode. terminal telnet speed default-speed maximum-speed Syntax Description Defaults 9600 bps (unless otherwise set using the speed, txspeed or rxspeed line configuration commands) Command Modes EXEC Command History Usage Guidelines You can match line speeds on remote systems in reverse Telnet, on host machines connected to an access server to access the network, or on a group of console lines connected to the access server when disparate line speeds are in use at the local and remote ends of the connections listed above. Line speed negotiation adheres to the Remote Flow Control option, defined in RFC 1080. Note This command applies only to access servers. It is not supported on standalone routers. Examples The following example enables the access server to negotiate a bit rate on the line using the Telnet option. If no speed is negotiated, the line will run at 2400 bps. If the remote host requests a speed greater than 9600 bps, then 9600 bps will be used. Router# terminal telnet speed 2400 9600 default-speed Line speed, in bits per second (bps), that the access server will use if the device on the other end of the connection has not specified a speed. maximum-speed Maximum line speed in bits per second (bps), that the device on the other end of the connection can use. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. terminal telnet sync-on-break CF-1116 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal telnet sync-on-break To cause the access server to send a Telnet Synchronize signal when it receives a Telnet Break signal on the current line and session, use the terminal telnet sync-on-break command in EXEC mode. terminal telnet sync-on-break Syntax Description This command has no arguments or keywords. Defaults Disabled Command Modes EXEC Command History Usage Guidelines You can configure the session to cause a reverse Telnet line to send a Telnet Synchronize signal when it receives a Telnet Break signal. The TCP Synchronize signal clears the data path, but still interprets incoming commands. Note This command applies only to access servers. It is not supported on standalone routers. Examples The following example sets an asynchronous line to cause the access server to send a Telnet Synchronize signal: Router# terminal telnet sync-on-break Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. terminal telnet transparent CF-1117 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal telnet transparent To cause the current terminal line to send a Return character (CR) as a CR followed by a NULL instead of a CR followed by a Line Feed (LF) for the current session, use the terminal telnet transparent command in EXEC mode. terminal telnet transparent Syntax Description This command has no arguments or keywords. Defaults CR followed by an LF Command Modes EXEC Command History Usage Guidelines The end of each line typed at the terminal is ended with a Return (CR). This command permits interoperability with different interpretations of end-of-line demarcation in the Telnet protocol specification. Note This command applies only to access servers. It is not supported on stand-alone routers. Examples In the following example, the session is configured to send a CR signal as a CR followed by a NULL: Router# terminal telnet transparent Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. terminal terminal-type CF-1118 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal terminal-type To specify the type of terminal connected to the current line for the current session, use the terminal terminal-type command in EXEC, privileged EXEC, and diagnostic mode. terminal terminal-type terminal-type Syntax Description Defaults VT100 Command Modes EXEC (>) Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines Indicate the terminal type if it is different from the default of VT100. The terminal type name is used by TN3270s for display management and by Telnet and rlogin to inform the remote host of the terminal type. Examples In the following example, the terminal type is defined as VT220 for the current session: Router# terminal terminal-type VT220 Related Commands terminal-type Defines the terminal name and type, and permits terminal negotiation by hosts that provide that type of service. The default is VT100. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Routers, and became available in diagnostic mode. Command Description terminal keymap-type Specifies the current keyboard type for the current session. terminal-type Specifies the type of terminal connected to a line. terminal txspeed CF-1119 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal txspeed To set the terminal transmit speed (how fast the terminal can send information) for the current line and session, use the terminal txspeed command in EXEC mode. terminal txspeed bps Syntax Description Defaults 9600 bps Command Modes EXEC Command History Examples In the following example, the line transmit speed is set to 2400 bps for the current session: Router# terminal txspeed 2400 Related Commands bps Baud rate in bits per second (bps). The default is 9600 bps. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description rxspeed Sets the terminal receive speed for a specified line or lines. terminal rxspeed Sets the terminal receive speed for the current line and session. terminal terminal-type Specifies the type of terminal connected to the current line for the current session. txspeed Sets the terminal transmit speed for a specified line or lines. terminal width CF-1120 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal width To set the number of character columns on the terminal screen for the current line for a session, use the terminal width command in EXEC, privileged EXEC, or diagnostic mode. terminal width characters Syntax Description Defaults 80 characters Command Modes EXEC (>) Privileged EXEC (#) Diagnostic (diag) Command History Usage Guidelines By default, the route provides a screen display width of 80 characters. You can reset this value for the current session if it does not meet the needs of your terminal. The rlogin protocol uses the value of the characters argument to set up terminal parameters on a remote host. Examples The following example sets the terminal character columns to 132: Router# terminal width 132 Related Commands characters Number of character columns displayed on the terminal. The default is 80 characters. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was introduced on the Cisco ASR 1000 Series Routers, and became available in diagnostic mode. Command Description width Sets the terminal screen width (the number of character columns displayed on the attached terminal). terminal-queue entry-retry-interval CF-1121 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal-queue entry-retry-interval To change the retry interval for a terminal port queue, use the terminal-queue entry-rety-interval command in global configuration mode. To restore the default terminal port queue interval, use the no form of this command. terminal-queue entry-retry-interval seconds no terminal-queue entry-retry-interval Syntax Description Defaults 60 seconds Command Modes Global configuration Command History Usage Guidelines If a remote device (such as a printer) is busy, the connection attempt is placed in a terminal port queue. If you want to decrease the waiting period between subsequent connection attempts, decrease the default of 60 to an interval of 10 seconds. Decrease the time between subsequent connection attempts when, for example, a printer queue stalls for long periods. Examples The following example changes the terminal port queue retry interval from the default of 60 seconds to 10 seconds: Router# terminal-queue entry-retry-interval 10 seconds Number of seconds between terminal port retries. The default is 60 seconds. Release Modification 11.1 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. terminal-type CF-1122 Cisco IOS Configuration Fundamentals Command Reference April 2010 terminal-type To specify the type of terminal connected to a line, use the terminal-type command in line configuration mode. To remove any information about the type of terminal and reset the line to the default terminal emulation, use the no form of this command. terminal-type {terminal-name | terminal-type} no terminal-type Syntax Description Defaults VT100 Command Modes Line configuration Command History Usage Guidelines This command records the type of terminal connected to the line. The terminal-name argument provides a record of the terminal type and allows terminal negotiation of display management by hosts that provide that type of service. For TN3270 applications, this command must follow the corresponding ttycap entry in the configuration file. Examples The following example defines the terminal on line 7 as a VT220: Router(config)# line 7 Router(config-line)# terminal-type VT220 terminal-name Terminal name. terminal-type Terminal type. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. test cable-diagnostics CF-1123 Cisco IOS Configuration Fundamentals Command Reference April 2010 test cable-diagnostics To test the condition of 10-Gigabit Ethernet links or copper cables on 48-port 10/100/1000 BASE-T modules, use the test cable-diagnostics command in privileged EXEC mode. test cable-diagnostics tdr interface type number Syntax Description Defaults This command has no default settings. Command Modes Privileged EXEC Command History Usage Guidelines Cable diagnostics can help you detect whether your cable has connectivity problems. The TDR test guidelines are as follows: • TDR can test cables up to a maximum length of 115 meters. • The TDR test is supported on Cisco 7600 series routers running Release 12.2(17a)SX and later releases on specific mdoules. See the Release Notes for Cisco IOS Release 12.2SX on the Catalyst 6500 and Cisco 7600 Supervisor Engine 720, Supervisor Engine 32, and Supervisor Engine 2 for the list of the modules that support TDR. • The valid values for interface type are fastethernet and gigabitethernet. • Do not start the test at the same time on both ends of the cable. Starting the test at both ends of the cable at the same time can lead to false test results. • Do not change the port configuration during any cable diagnostics test. This action may result in incorrect test results. • The interface must be up before running the TDR test. If the port is down, the test cable-diagnostics tdr command is rejected and the following message is displayed: Router# test cable-diagnostics tdr interface gigabitethernet2/12 tdr Activates the TDR test for copper cables on 48-port 10/100/1000 BASE-T modules. interface type Specifies the interface type; see the “Usage Guidelines” section for valid values. number Module and port number. Release Modification 12.2(17a)SX Support for this command was introduced on the Cisco 7600 series routers. 12.2(17b)SXA This command was changed to provide support for the 4-port 10GBASE-E serial 10-Gigabit Ethernet module (WS-X6704-10GE). 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. test cable-diagnostics CF-1124 Cisco IOS Configuration Fundamentals Command Reference April 2010 % Interface Gi2/12 is administratively down % Use 'no shutdown' to enable interface before TDR test start. • If the port speed is 1000 and the link is up, do not disable the auto-MDIX feature. • For fixed 10/100 ports, before running the TDR test, disable auto-MDIX on both sides of the cable. Failure to do so can lead to misleading results. • For all other conditions, you must disable the auto-MDIX feature on both ends of the cable (use the no mdix auto command). Failure to disable auto-MDIX will interfere with the TDR test and generate false results. • If a link partner has auto-MDIX enabled, this action will interfere with the TDR-cable diagnostics test and test results will be misleading. The workaround is to disable auto-MDIX on the link partner. • If you change the port speed from 1000 to 10/100, enter the no mdix auto command before running the TDR test. Note that entering the speed 1000 command enables auto-MDIX regardless of whether the no mdix auto command has been run. Examples This example shows how to run the TDR-cable diagnostics: Router # test cable-diagnostics tdr interface gigabitethernet2/1 TDR test started on interface Gi2/1 A TDR test can take a few seconds to run on an interface Use 'show cable-diagnostics tdr' to read the TDR results. Related Commands Command Description clear cable-diagnostics tdr Clears a specific interface or clears all interfaces that support TDR. show cable-diagnostics tdr Displays the test results for the TDR cable diagnostics. test flash CF-1125 Cisco IOS Configuration Fundamentals Command Reference April 2010 test flash To test Flash memory on MCI and envm Flash EPROM interfaces, use the test flash command in EXEC mode. test flash Syntax Description This command has no arguments or keywords. Defaults This command has no default values. Command Modes EXEC Command History Examples In the following example, the Flash memory is tested: test flash Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description test interfaces Tests the system interfaces on the modular router. test memory Performs a test of Multibus memory (including nonvolatile memory) on the modular router. test interfaces CF-1126 Cisco IOS Configuration Fundamentals Command Reference April 2010 test interfaces To test the system interfaces on the modular router, use the test interfaces command in EXEC mode. test interfaces Syntax Description This command has no arguments or keywords. Defaults This command has no default values. Command Modes EXEC Command History Usage Guidelines The test interfaces EXEC command is intended for the factory checkout of network interfaces. It is not intended for diagnosing problems with an operational router. The test interfaces output does not report correct results if the router is attached to a “live” network. For each network interface that has an IP address that can be tested in loopback (MCI and ciscoBus Ethernet and all serial interfaces), the test interfaces command sends a series of ICMP echoes. Error counters are examined to determine the operational status of the interface. Examples In the following example, the system interfaces are tested: test interfaces Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description test flash Tests Flash memory on MCI and envm Flash EPROM interfaces. test memory Performs a test of Multibus memory (including nonvolatile memory) on the modular router. test memory CF-1127 Cisco IOS Configuration Fundamentals Command Reference April 2010 test memory To perform a test of Multibus memory (including nonvolatile memory) on the modular router, use the test memory command in privileged EXEC mode. The memory test overwrites memory. test memory Syntax Description This command has no arguments or keywords. Command Default This command overwrites memory. Command Modes Privileged EXEC Command History Usage Guidelines The memory test overwrites memory. If you use the test memory command, you will need to rewrite nonvolatile memory. For example, if you test Multibus memory, which is the memory used by the CSC-R 4-Mbps Token Ring interfaces, you will need to reload the system before the network interfaces will operate properly. The test memory command is intended primarily for use by Cisco personnel. Examples In the following example, the memory is tested: test memory Related Commands Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description test flash Tests Flash memory on MCI and envm Flash EPROM interfaces. test interfaces Tests the system interfaces on the modular router. test memory destroy CF-1128 Cisco IOS Configuration Fundamentals Command Reference April 2010 test memory destroy To destroy a memory chunk or dangling reference, use the test memory destroy command in privileged EXEC mode. test memory destroy [chunk | mgd-chunk | force-chunk | dangling-reference] chunk-id Syntax Description Command Default This command destroys memory chunks or dangling references on a router. Command Modes Privileged EXEC Command History Usage Guidelines The force-chunk keyword destroys a chunk of ordinary (not managed) memory, even if the memory has elements or siblings that are not free. Caution Use the force-chunk keyword carefully. A crash or corruption will occur if someone refers to the destroyed chunk or its elements. Examples In the following example, a chunk of ordinary memory is destroyed: test memory destroy force-chunk Related Commands chunk (Optional) Ordinary chunk of memory. mgd-chunk (Optional) Managed chunk of memory. force-chunk (Optional) Chunk of memory that is destroyed forcefully. dangling-reference (Optional) Dangling reference of memory. chunk-id Address of the chunk to be destroyed. Release Modification 12.2(33)SRC This command was introduced. Command Description test memory chunk Allocates or frees chunk elements from a chunk. test memory create chunk Creates a memory chunk. test platform police get CF-1129 Cisco IOS Configuration Fundamentals Command Reference April 2010 test platform police get To get the IPv6 internal police rate, use the test platform police get command in privileged EXEC mode. test platform police get Syntax Description This command has no arguments or keywords. Defaults 0 (No rate has been applied.) Command Modes Privileged EXEC (Router#) Command History Usage Guidelines Use this command under the exec command of the line card console. It is not visible from the route processor (RP) console. Examples The following example shows show to get the IPv6 internal police rate: Router-dfc3# enable Router-dfc3# test platform police ipv6 get IPv6 with HBH header is policed at 100000 kbps Related Commands Release Modification 12.2(33)SRD1 The command was introduced on the Cisco 7600 series routers for the ES+ line cards, the SIP-400, and the 7600-ES+ITU-2TG and 7600-ES+ITU-4TG. Command Description test platform police set Sets the IPv6 internal police rate. test platform police set CF-1130 Cisco IOS Configuration Fundamentals Command Reference April 2010 test platform police set To set the IPv6 internal police rate, use the test platform police set command in privileged EXEC mode. test platform police set rate Note There is not a no version of this command. If you have set a rate limit and wish to cancel it, you will need to use this command to set the rate to 0. Syntax Description Defaults For ES40 line cards, the default police rate is 12.8Mbps. For the SIP-400, the default police rate is 21.36kpps. Command Modes Privileged EXEC (Router#) Command History Usage Guidelines Use this command under EXEC command of the line card console. It is not visible from the route processor (RP) console. For both the ES+ line cards and the SIP-400, setting the police rate to 0 turns off the policing. For both the ES+ line cards and the SIP-400, when the policer is set from the the line card console, the setting remains effective even if the line card is moved to another chassis running the Cisco IOS Release 12.2(33)SRD1 (or later) image. For the SIP-400, IPv6 HBH packets will continue to go through the QoS policing configured on the line card. For ES+ line cards, IPv6 HBH packets will bypass any QoS configured on the line card. Examples The following examples shows how to set the IPv6 with HBH header to be policed at 100000 kbps: Router-dfc3# enable Router-dfc3# test platform police ipv6 set 100000 rate The range is 0 to 100000 kbps. • For the SIP-400, you can configure a rate up to, and including 25600 packets per second (PPS). • For the ES+ line cards, and the 7600-ES+ITU-2TG and 7600-ES+ITU-4TG line cards, you can configure a rates of: – 16 Kbps—2 Mbps; granularity of 16 kbps – 2 Mbps—100 Mbps; granularity of 64 kbps Release Modification 12.2(33)SRD1 The command was introduced on the Cisco 7600 series routers for the ES+ line cards, the SIP-400, and the 7600-ES+ITU-2TG and 7600-ES+ITU-4TG. test platform police set CF-1131 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description test platform police get Gets the IPv6 internal police rate. tftp-server CF-1132 Cisco IOS Configuration Fundamentals Command Reference April 2010 tftp-server To configure a router or a Flash memory device on the router as a TFTP server, use one of the following tftp-server commands in global configuration mode. This command replaces the tftp-server system command. To remove a previously defined filename, use the no form of this command with the appropriate filename. tftp-server flash [partition-number:]filename1 [alias filename2] [access-list-number] tftp-server rom alias filename1 [access-list-number] no tftp-server {flash [partition-number:]filename1 | rom alias filename2} Cisco 1600 Series and Cisco 3600 Series Routers tftp-server flash [device:][partition-number:]filename no tftp-server flash [device:][partition-number:]filename Cisco 7000 Family Routers tftp-server flash device:filename no tftp-server flash device:filename Syntax Description flash Specifies TFTP service of a file in Flash memory. rom Specifies TFTP service of a file in ROM. filename1 Name of a file in Flash or in ROM that the TFTP server uses in answering TFTP Read Requests. alias Specifies an alternate name for the file that the TFTP server uses in answering TFTP Read Requests. filename2 Alternate name of the file that the TFTP server uses in answering TFTP Read Requests. A client of the TFTP server can use this alternate name in its Read Requests. access-list-number (Optional) Basic IP access list number. Valid values are from 0 to 99. partition-number: (Optional) Specifies TFTP service of a file in the specified partition of Flash memory. If the partition number is not specified, the file in the first partition is used. For the Cisco 1600 series and Cisco 3600 series routers, you must enter a colon after the partition number if a filename follows it. tftp-server CF-1133 Cisco IOS Configuration Fundamentals Command Reference April 2010 Defaults Disabled Command Modes Global configuration Command History Usage Guidelines You can specify multiple filenames by repeating the tftp-server command. The system sends a copy of the system image contained in ROM or one of the system images contained in Flash memory to any client that issues a TFTP Read Request with this filename. If the specified filename1 or filename2 argument exists in Flash memory, a copy of the Flash image is sent. On systems that contain a complete image in ROM, the system sends the ROM image if the specified filename1 or filename2 argument is not found in Flash memory. Images that run from ROM cannot be loaded over the network. Therefore, it does not make sense to use TFTP to offer the ROMs on these images. On the Cisco 7000 family routers, the system sends a copy of the file contained on one of the Flash memory devices to any client that issues a TFTP Read Request with its filename. device: (Optional) Specifies TFTP service of a file on a Flash memory device in the Cisco 1600 series, Cisco 3600 series, and Cisco 7000 family routers. The colon is required. Valid devices are as follows: • flash—Internal Flash memory on the Cisco 1600 series and Cisco 3600 series routers. This is the only valid device for the Cisco 1600 series routers. • bootflash—Internal Flash memory in the Cisco 7000 family routers. • slot0—First PCMCIA slot on the Cisco 3600 series and Cisco 7000 family routers. • slot1—Second PCMCIA slot on the Cisco 3600 series and Cisco 7000 family. • slavebootflash—Internal Flash memory on the slave RSP card of a Cisco 7507 or Cisco 7513 router configured for HSA. • slaveslot0—First PCMCIA slot of the slave RSP card on a Cisco 7507 or Cisco 7513 router configured for HSA. • slaveslot1—Second PCMCIA slot of the slave RSP card on a Cisco 7507 or Cisco 7513 router configured for HSA. filename Name of the file on a Flash memory device that the TFTP server uses in answering a TFTP Read Request. Use this argument only with the Cisco 1600 series, Cisco 3600 series, Cisco 7000 series, or Cisco 7500 series routers. Release Modification 11.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. tftp-server CF-1134 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, the system uses TFTP to send a copy of the version-10.3 file located in Flash memory in response to a TFTP Read Request for that file. The requesting host is checked against access list 22. tftp-server flash version-10.3 22 In the following example, the system uses TFTP to send a copy of the ROM image gs3-k.101 in response to a TFTP Read Request for the gs3-k.101 file: tftp-server rom alias gs3-k.101 In the following example, the system uses TFTP to send a copy of the version-11.0 file in response to a TFTP Read Request for that file. The file is located on the Flash memory card inserted in slot 0. tftp-server flash slot0:version-11.0 The following example enables a Cisco 3600 series router to operate as a TFTP server. The source file c3640-i-mz is in the second partition of internal Flash memory. Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z. router(config)# tftp-server flash flash:2:dirt/gate/c3640-i-mz In the following example, the source file is in the second partition of the Flash memory PC card in slot 0 on a Cisco 3600 series: Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)# tftp-server flash slot0:2:dirt/gate/c3640-j-mz The following example enables a Cisco 1600 series router to operate as a TFTP server. The source file c1600-i-mz is in the second partition of Flash memory: router# configure terminal Enter configuration commands, one per line. End with CNTL/Z. router(config)# tftp-server flash flash:2:dirt/gate/c1600-i-mz Related Commands Command Description access-list Creates an extended access list. tftp-server system CF-1135 Cisco IOS Configuration Fundamentals Command Reference April 2010 tftp-server system The tftp-server system command has been replaced by the tftp-server command. See the description of the tftp-server command in this chapter for more information. time-period CF-1136 Cisco IOS Configuration Fundamentals Command Reference April 2010 time-period To set the time increment for automatically saving an archive file of the current running configuration in the Cisco IOS configuration archive, use the time-period command in archive configuration mode. To disable this function, use the no form of this command. time-period minutes no time-period minutes Syntax Description Command Default By default, no time increment is set. Command Modes Archive configuration Command History Usage Guidelines Note Before using this command, you must configure the path command to specify the location and filename prefix for the files in the Cisco IOS configuration archive. If this command is configured, an archive file of the current running configuration is automatically saved after the given time specified by the minutes argument. Archive files continue to be automatically saved at this given time increment until this function is disabled. Use the maximum command to set the maximum number of archive files of the running configuration to be saved. Note This command saves the current running configuration to the configuration archive whether or not the running configuration has been modified since the last archive file was saved. minutes Specifies how often, in minutes, to automatically save an archive file of the current running configuration in the Cisco IOS configuration archive. Release Modification 12.3(7)T This command was introduced. 12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(31)SB2 This command was implemented on the Cisco 10000 series router. 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB and implemented on the Cisco 10000 series. time-period CF-1137 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, a value of 20 minutes is set as the time increment for which to automatically save an archive file of the current running configuration in the Cisco IOS configuration archive: Router# configure terminal ! Router(config)# archive Router(config-archive)# path disk0:myconfig Router(config-archive)# time-period 20 Router(config-archive)# end Related Commands Command Description archive config Saves a copy of the current running configuration to the Cisco IOS configuration archive. configure confirm Confirms replacement of the current running configuration with a saved Cisco IOS configuration file. configure replace Replaces the current running configuration with a saved Cisco IOS configuration file. maximum Sets the maximum number of archive files of the running configuration to be saved in the Cisco IOS configuration archive. path Specifies the location and filename prefix for the files in the Cisco IOS configuration archive. show archive Displays information about the files saved in the Cisco IOS configuration archive. trace (privileged) CF-1138 Cisco IOS Configuration Fundamentals Command Reference April 2010 trace (privileged) To discover the routes that packets will actually take when traveling to their destination, use the trace command in privileged EXEC mode. trace [protocol] [destination] Syntax Description Defaults The protocol argument is based on the Cisco IOS software examination of the format of the destination argument. For example, if the software finds a destination argument in IP format, the protocol value defaults to ip. Command Modes Privileged EXEC Command History Usage Guidelines The trace command works by taking advantage of the error messages generated by routers when a datagram exceeds its time-to-live (TTL) value. The trace command starts by sending probe datagrams with a TTL value of one. This causes the first router to discard the probe datagram and send back an error message. The trace command sends several probes at each TTL level and displays the round-trip time for each. The trace command sends out one probe at a time. Each outgoing packet may result in one or two error messages. A “time exceeded” error message indicates that an intermediate router has seen and discarded the probe. A “destination unreachable” error message indicates that the destination node has received the probe and discarded it because it could not deliver the packet. If the timer goes off before a response comes in, the trace command prints an asterisk (*). The trace command terminates when the destination responds, when the maximum TTL is exceeded, or when the user interrupts the trace with the escape sequence. By default, to invoke the escape sequence, type Ctrl-^ X by simultaneously pressing and releasing the Ctrl, Shift, and 6 keys, and then pressing the X key. To use nondefault parameters and invoke an extended trace test, enter the command without a destination argument. You will be stepped through a dialog to select the desired parameters. protocol (Optional) Protocols that can be used are appletalk, clns, ip and vines. destination (Optional) Destination address or host name on the command line. The default parameters for the appropriate protocol are assumed and the tracing action begins. Release Modification 10.0 This command was introduced. 12.2(13)T This command is no longer supported in Cisco IOS Mainline releases or in Technology-based (T-train) releases. It might continue to appear in 12.2S-family releases. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. trace (privileged) CF-1139 Cisco IOS Configuration Fundamentals Command Reference April 2010 Common Trace Problems Due to bugs in the IP implementation of various hosts and routers, the IP trace command may behave in unexpected ways. Not all destinations will respond correctly to a probe message by sending back an “ICMP port unreachable” message. A long sequence of TTL levels with only asterisks, terminating only when the maximum TTL has been reached, may indicate this problem. There is a known problem with the way some hosts handle an “ICMP TTL exceeded” message. Some hosts generate an “ICMP” message but they reuse the TTL of the incoming packet. Because this is zero, the ICMP packets do not make it back. When you trace the path to such a host, you may see a set of TTL values with asterisks (*). Eventually the TTL gets high enough that the ICMP message can get back. For example, if the host is six hops away, the trace command will time out on responses 6 through 11. Trace IP Routes The following display shows sample IP trace output when a destination host name has been specified: Router# trace ABA.NYC.mil Type escape sequence to abort. Tracing the route to ABA.NYC.mil (26.0.0.73) 1 DEBRIS.CISCO.COM (192.180.1.6) 1000 msec 8 msec 4 msec 2 BARRNET-GW.CISCO.COM (192.180.16.2) 8 msec 8 msec 8 msec 3 EXTERNAL-A-GATEWAY.STANFORD.EDU (192.42.110.225) 8 msec 4 msec 4 msec 4 BB2.SU.BARRNET.NET (192.200.254.6) 8 msec 8 msec 8 msec 5 SU.ARC.BARRNET.NET (192.200.3.8) 12 msec 12 msec 8 msec 6 MOFFETT-FLD-MB.in.MIL (192.52.195.1) 216 msec 120 msec 132 msec 7 ABA.NYC.mil (26.0.0.73) 412 msec 628 msec 664 msec Table 168 describes the significant fields shown in the display. Extended IP Trace Dialog The following display shows a sample trace session involving the extended dialog of the trace command: Router# trace Protocol [ip]: Target IP address: mit.edu Source address: Numeric display [n]: Timeout in seconds [3]: Probe count [3]: Minimum Time to Live [1]: Maximum Time to Live [30]: Port Number [33434]: Loose, Strict, Record, Timestamp, Verbose[none]: Type escape sequence to abort. Tracing the route to MIT.EDU (18.72.2.1) Table 168 trace Field Descriptions Field Description 1 Indicates the sequence number of the router in the path to the host. DEBRIS.CISCO.COM Host name of this router. 192.180.1.6 Internet address of this router. 1000 msec 8 msec 4 msec Round-trip time for each of the three probes that are sent. trace (privileged) CF-1140 Cisco IOS Configuration Fundamentals Command Reference April 2010 1 ICM-DC-2-V1.ICP.NET (192.108.209.17) 72 msec 72 msec 88 msec 2 ICM-FIX-E-H0-T3.ICP.NET (192.157.65.122) 80 msec 128 msec 80 msec 3 192.203.229.246 540 msec 88 msec 84 msec 4 T3-2.WASHINGTON-DC-CNSS58.T3.ANS.NET (140.222.58.3) 84 msec 116 msec 88 msec 5 T3-3.WASHINGTON-DC-CNSS56.T3.ANS.NET (140.222.56.4) 80 msec 132 msec 88 msec 6 T3-0.NEW-YORK-CNSS32.T3.ANS.NET (140.222.32.1) 92 msec 132 msec 88 msec 7 T3-0.HARTFORD-CNSS48.T3.ANS.NET (140.222.48.1) 88 msec 88 msec 88 msec 8 T3-0.HARTFORD-CNSS49.T3.ANS.NET (140.222.49.1) 96 msec 104 msec 96 msec 9 T3-0.ENSS134.T3.ANS.NET (140.222.134.1) 92 msec 128 msec 92 msec 10 W91-CISCO-EXTERNAL-FDDI.MIT.EDU (192.233.33.1) 92 msec 92 msec 112 msec 11 E40-RTR-FDDI.MIT.EDU (18.168.0.2) 92 msec 120 msec 96 msec 12 MIT.EDU (18.72.2.1) 96 msec 92 msec 96 msec Table 169 describes the fields that are unique to the extended trace sequence, as shown in the display. Table 169 trace Field Descriptions Field Description Target IP address You must enter a host name or an IP address. There is no default. Source address One of the interface addresses of the router to use as a source address for the probes. The router will normally pick what it feels is the best source address to use. Numeric display The default is to have both a symbolic and numeric display; however, you can suppress the symbolic display. Timeout in seconds The number of seconds to wait for a response to a probe packet. The default is 3 seconds. Probe count The number of probes to be sent at each TTL level. The default count is 3. Minimum Time to Live [1] The TTL value for the first probes. The default is 1, but it can be set to a higher value to suppress the display of known hops. Maximum Time to Live [30] The largest TTL value that can be used. The default is 30. The trace command terminates when the destination is reached or when this value is reached. Port Number The destination port used by the User Datagram Protocol (UDP) probe messages. The default is 33434. Loose, Strict, Record, Timestamp, Verbose IP header options. You can specify any combination. The trace command issues prompts for the required fields. Note that the trace command will place the requested options in each probe; however, there is no guarantee that all routers (or end nodes) will process the options. Loose Allows you to specify a list of nodes that must be traversed when going to the destination. Strict Allows you to specify a list of nodes that must be the only nodes traversed when going to the destination. Record Allows you to specify the number of hops to leave room for. Timestamp Allows you to specify the number of time stamps to leave room for. Verbose If you select any option, the verbose mode is automatically selected and the trace command prints the contents of the option field in any incoming packets. You can prevent verbose mode by selecting it again, toggling its current setting. trace (privileged) CF-1141 Cisco IOS Configuration Fundamentals Command Reference April 2010 Table 170 describes the characters that can appear in trace command output. Related Commands Table 170 ip trace Text Characters Char Description nn msec For each node, the round-trip time (in milliseconds) for the specified number of probes. * The probe timed out. ? Unknown packet type. A Administratively unreachable. Usually, this output indicates that an access list is blocking traffic. H Host unreachable. N Network unreachable. P Protocol unreachable. Q Source quench. U Port unreachable. Command Description trace (user) Discovers the CLNS routes that packets will actually take when traveling to their destination. trace (user) CF-1142 Cisco IOS Configuration Fundamentals Command Reference April 2010 trace (user) To discover the IP routes that packets will actually take when traveling to their destination, use the trace command in EXEC mode. trace [protocol] [destination] Syntax Description Defaults The protocol argument is based on the Cisco IOS software examination of the format of the destination argument. For example, if the software finds a destination argument in IP format, the protocol defaults to ip. Command Modes EXEC Command History Usage Guidelines The trace command works by taking advantage of the error messages generated by routers when a datagram exceeds its time-to-live (TTL) value. The trace command starts by sending probe datagrams with a TTL value of one. This causes the first router to discard the probe datagram and send back an error message. The trace command sends several probes at each TTL level and displays the round-trip time for each. The trace command sends out one probe at a time. Each outgoing packet may result in one or two error messages. A “time exceeded” error message indicates that an intermediate router has seen and discarded the probe. A “destination unreachable” error message indicates that the destination node has received the probe and discarded it because it could not deliver the packet. If the timer goes off before a response comes in, trace prints an asterisk (*). The trace command terminates when the destination responds, when the maximum TTL is exceeded, or when the user interrupts the trace with the escape sequence. By default, to invoke the escape sequence, type Ctrl-^ X by simultaneously pressing and releasing the Ctrl, Shift, and 6 keys, and then pressing the X key. protocol (Optional) Protocols that can be used are appletalk, clns, ip and vines. destination (Optional) Destination address or host name on the command line. The default parameters for the appropriate protocol are assumed and the tracing action begins. Release Modification 10.0 This command was introduced. 12.2(13)T This command is no longer supported in Cisco IOS Mainline releases or in Technology-based (T-train) releases. It might continue to appear in 12.2S-family releases. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. trace (user) CF-1143 Cisco IOS Configuration Fundamentals Command Reference April 2010 Common Trace Problems Due to bugs in the IP implementation of various hosts and routers, the IP trace command may behave in unexpected ways. Not all destinations will respond correctly to a probe message by sending back an “ICMP port unreachable” message. A long sequence of TTL levels with only asterisks, terminating only when the maximum TTL has been reached, may indicate this problem. There is a known problem with the way some hosts handle an “ICMP TTL exceeded” message. Some hosts generate an ICMP message but they reuse the TTL of the incoming packet. Since this is zero, the ICMP packets do not make it back. When you trace the path to such a host, you may see a set of TTL values with asterisks (*). Eventually the TTL gets high enough that the “ICMP” message can get back. For example, if the host is six hops away, trace will time out on responses 6 through 11. Trace IP Routes The following display shows sample IP trace output when a destination host name has been specified: Router# trace ip ABA.NYC.mil Type escape sequence to abort. Tracing the route to ABA.NYC.mil (26.0.0.73) 1 DEBRIS.CISCO.COM (192.180.1.6) 1000 msec 8 msec 4 msec 2 BARRNET-GW.CISCO.COM (192.180.16.2) 8 msec 8 msec 8 msec 3 EXTERNAL-A-GATEWAY.STANFORD.EDU (192.42.110.225) 8 msec 4 msec 4 msec 4 BB2.SU.BARRNET.NET (192.200.254.6) 8 msec 8 msec 8 msec 5 SU.ARC.BARRNET.NET (192.200.3.8) 12 msec 12 msec 8 msec 6 MOFFETT-FLD-MB.in.MIL (192.52.195.1) 216 msec 120 msec 132 msec 7 ABA.NYC.mil (26.0.0.73) 412 msec 628 msec 664 msec Table 171 describes the significant fields shown in the display. Table 172 describes the characters that can appear in trace output. Table 171 trace Field Descriptions Field Description 1 Indicates the sequence number of the router in the path to the host. DEBRIS.CISCO.COM Host name of this router. 192.180.1.61 Internet address of this router. 1000 msec 8 msec 4 msec Round-trip time for each of the three probes that are sent. Table 172 ip trace Text Characters Char Description nn msec For each node, the round-trip time (in milliseconds) for the specified number of probes. * The probe timed out. ? Unknown packet type. A Administratively unreachable. Usually, this output indicates that an access list is blocking traffic. H Host unreachable. N Network unreachable. trace (user) CF-1144 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands P Protocol unreachable. Q Source quench. U Port unreachable. Table 172 ip trace Text Characters (continued) Char Description Command Description trace (privileged) Probes the routes that packets follow when traveling to their destination from the router. traceroute CF-1145 Cisco IOS Configuration Fundamentals Command Reference April 2010 traceroute To discover the routes that packets will actually take when traveling to their destination address, use the traceroute command in user EXEC or privileged EXEC mode. traceroute [vrf vrf-name | topology topology-name] [protocol] destination Syntax Description Command Default When not specified, the protocol argument is determined by the software examining the format of the destination argument. For example, if the software finds a destination argument in IP format, the protocol value defaults to IP. Command Modes User EXEC (>) Privileged EXEC (#) Command History vrf vrf-name (Optional) Specifies the name of a Virtual Private Network (VPN) routing and forwarding (VRF) instance table in which to find the destination address. The only keyword that you can select for the protocol argument when you use the vrf vrf-name keyword-argument pair is the ip keyword. topology topology-name (Optional) Specifies the name of the topology instance. The topology-name argument is case-sensitive; “VOICE” and “voice” specify different topologies. protocol (Optional) Protocol keyword, either appletalk, clns, ip, ipv6, ipx, oldvines, or vines. When not specified, the protocol argument is based on an examination by the software of the format of the destination argument. The default protocol is IP. destination (Optional in privileged EXEC mode; required in user EXEC mode) The destination address or hostname for which you want to trace the route. The software determines the default parameters for the appropriate protocol and the tracing action begins. Release Modification 10.0 This command was introduced. 12.0(5)T The vrf vrf-name keyword and argument were added. 12.2(2)T Support for IPv6 was added. 12.0(21)ST Support for IPv6 was added. 12.0(22)S Support for IPv6 was added. 12.2(11)T The traceroute command test characters for IPv6 were updated. A new error message was added. 12.2(14)S This command was integrated into Cisco IOS Release 12.2(14)S. traceroute CF-1146 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines The traceroute command works by taking advantage of the error messages generated by routers when a datagram exceeds its hop limit value. The traceroute command starts by sending probe datagrams with a hop limit of 1. Including a hop limit of 1 with a probe datagram causes the neighboring routers to discard the probe datagram and send back an error message. The traceroute command sends several probes with increasing hop limits and displays the round-trip time for each. The traceroute command sends out one probe at a time. Each outgoing packet might result in one or more error messages. A time-exceeded error message indicates that an intermediate router has seen and discarded the probe. A destination unreachable error message indicates that the destination node has received and discarded the probe because the hop limit of the packet reached a value of 0. If the timer goes off before a response comes in, the traceroute command prints an asterisk (*). The traceroute command terminates when the destination responds, when the hop limit is exceeded, or when the user interrupts the trace with the escape sequence. By default, to invoke the escape sequence, type Ctrl-^ X—by simultaneously pressing and releasing the Ctrl, Shift, and 6 keys, and then pressing the X key. To use nondefault parameters and invoke an extended traceroute test, enter the command without a protocol or destination argument in privileged EXEC mode. You are stepped through a dialog to select the desired parameters. Extended traceroute tests are not supported in user EXEC mode. The user-level traceroute feature provides a basic trace facility for users who do not have system privileges. The destination argument is required in user EXEC mode. If the system cannot map an address for a hostname, it returns a “%No valid source address for destination” message. If the vrf vrf-name keyword and argument are used, the topology option is not displayed because only the default VRF is supported. The topology topology-name keyword and argument and the DiffServ Code Point (DSCP) option in the extended traceroute system dialog are displayed only if a topology is configured on the router. 12.3(5) A line was added to the interactive traceroute vrf command, so that you can resolve the autonomous system number through the use of the global table or a VRF table, or you can choose not to resolve the autonomous system. 12.0(26)S1 Changes to the command were integrated into Cisco IOS Release 12.0(26)S1. 12.2(20)S Changes to the command were integrated into Cisco IOS Release 12.2(20)S. 12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB. 12.2(25)SG This command was integrated into Cisco IOS Release 12.2(25)SG. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SRB The topology topology-name keyword and argument were added to support Multi-Topology Routing (MTR). 12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH. 12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE. Release Modification traceroute CF-1147 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples After you enter the traceroute command in privileged EXEC mode, the system prompts you for a protocol. The default protocol is IP. If you enter a hostname or address on the same line as the traceroute command, the default action is taken as appropriate for the protocol type of that name or address. The following example is sample dialog from the traceroute command using default values. The specific dialog varies somewhat from protocol to protocol. Router# traceroute Protocol [ip]: Target IP address: Source address: DSCP Value [0]: ! Only displayed if a topology is configured on the router. Numeric display [n]: Timeout in seconds [3]: Probe count [3]: Minimum Time to Live [1]: Maximum Time to Live [30]: Port Number [33434]: Loose, Strict, Record, Timestamp, Verbose [none]: Related Commands Command Description ping (MTR) Pings a destination within a specific topology. traceroute mac CF-1148 Cisco IOS Configuration Fundamentals Command Reference April 2010 traceroute mac To display the Layer 2 path taken by the packets from the specified source to the specified destination, use the traceroute mac command in privileged EXEC mode. traceroute mac source-mac-address {destination-mac-address | interface type interface-number destination-mac-address} [vlan vlan-id] [detail] traceroute mac interface type interface-number source-mac-address {destination-mac-address | interface type interface-number destination-mac-address} [vlan vlan-id] [detail] traceroute mac ip {source-ip-address | source-hostname} {destination-ip-address | destination-hostname} [detail] Syntax Description Defaults This command has no default settings. Command Modes Privileged EXEC Command History source-mac-address Media Access Control (MAC) address of the source switch in hexadecimal format. destination-mac-address MAC address of the destination switch in hexadecimal format. interface type Specifies the interface where the MAC address resides; valid values are FastEthernet, GigabitEthernet, and Port-channel. interface-number Module and port number or the port-channel number; valid values for the port channel are from 1 to 282. vlan vlan-id (Optional) Specifies the virtual local area network (VLAN) on which to trace the Layer 2 path that the packets take from the source switch to the destination switch; valid values are from 1 to 4094. detail (Optional) Displays detailed information about the Layer 2 trace. ip Specifies the IP address where the MAC address resides. source-ip-address IP address of the source switch as a 32-bit quantity in dotted-decimal format. source-hostname IP hostname of the source switch. destination-ip-address IP address of the destination switch as a 32-bit quantity in dotted-decimal format. destination-hostname IP hostname of the destination switch. Release Modification 12.2(18)SXE Support for this command was introduced on the Supervisor Engine 720. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. traceroute mac CF-1149 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines This command is not supported on the Cisco 7600 series router that is configured with a Supervisor Engine 2. Do not use leading zeros when entering a VLAN ID. For Layer 2 traceroute to functional properly, you must enable CDP on all of the switches in the network. Do not disable CDP. When the switch detects a device in the Layer 2 path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out. The maximum number of hops identified in the path is ten. Layer 2 traceroute supports only unicast traffic. If you specify a multicast source or destination MAC address, the physical path is not identified, and a message appears. The traceroute mac command output shows the Layer 2 path when the specified source and destination addresses belong to the same VLAN. If you specify source and destination addresses that belong to different VLANs, the Layer 2 path is not identified, and a message appears. If the source or destination MAC address belongs to multiple VLANs, you must specify the VLAN to which both the source and destination MAC addresses belong. If the VLAN is not specified, the path is not identified, and a message appears. When multiple devices are attached to one port through hubs (for example, multiple CDP neighbors are detected on a port), the Layer 2 traceroute utility terminates at that hop and displays an error message. This feature is not supported in Token Ring VLANs. Examples This example shows how to display detailed information about the Layer 2 path: Router# traceroute mac 0001.0000.0204 0001.0000.0304 detail Source 1001.0000.0204 found on VAYU[WS-C6509] (10.1.1.10) 1 VAYU / WS-C6509 / 10.1.1.10 : Gi6/1 [full, 1000M] => Po100 [auto, auto] 2 PANI / WS-C6509 / 10.1.1.12 : Po100 [auto, auto] => Po110 [auto, auto] 3 BUMI / WS-C6509 / 10.1.1.13 : Po110 [auto, auto] => Po120 [auto, auto] 4 AGNI / WS-C6509 / 10.1.1.11 : Po120 [auto, auto] => Gi8/12 [full, 1000M] Destination 1001.0000.0304 found on AGNI[WS-C6509] (10.1.1.11) Layer 2 trace completed. Router# This example shows the output when the switch is not connected to the source switch: Router# traceroute mac 0000.0201.0501 0000.0201.0201 detail Source not directly connected, tracing source ..... Source 1000.0201.0501 found on con5[WS-C6509] (10.2.5.5) con5 / WS-C6509 / 10.2.5.5 : Fa0/1 [auto, auto] =>Gi0/1 [auto, auto] con1 / WS-C6509 / 10.2.1.1 : Gi0/1 [auto, auto] =>Gi0/2 [auto, auto] con2 / WS-C6509 / 10.2.2.2 : Gi0/2 [auto, auto] =>Fa0/1 [auto, auto] Destination 1000.0201.0201 found on con2[WS-C6509] (10.2.2.2) Layer 2 trace completed. Router# traceroute mac CF-1150 Cisco IOS Configuration Fundamentals Command Reference April 2010 This example shows the output when the switch cannot find the destination port for the source MAC address: Router# traceroute mac 0000.0011.1111 0000.0201.0201 Error:Source Mac address not found. Layer2 trace aborted. Router# This example shows the output when the source and destination devices are in different VLANs: Router# traceroute mac 0000.0201.0601 0000.0301.0201 Error:Source and destination macs are on different vlans. Layer2 trace aborted. Router# This example shows the output when the destination MAC address is a multicast address: Router# traceroute mac 0000.0201.0601 0100.0201.0201 Invalid destination mac address Router# This example shows the output when the source and destination switches belong to multiple VLANs: Router# traceroute mac 0000.0201.0601 0000.0201.0201 Error:Mac found on multiple vlans. Layer2 trace aborted. Router# This example shows how to display the Layer 2 path by specifying the interfaces on the source and destination switches: Router# traceroute mac interface fastethernet0/1 0000.0201.0601 interface fastethernet0/3 0000.0201.0201 Source 1000.0201.0601 found on con6[WS-C6509] (10.2.6.6) con6 (10.2.6.6) :Fa0/1 =>Fa0/3 con5 (10.2.5.5 ) : Fa0/3 =>Gi0/1 con1 (10.2.1.1 ) : Gi0/1 =>Gi0/2 con2 (10.2.2.2 ) : Gi0/2 =>Fa0/1 Destination 1000.0201.0201 found on con2[WS-C6509] (10.2.2.2) Layer 2 trace completed Router# This example shows how to display detailed traceroute information: Router# traceroute mac ip 10.2.66.66 10.2.22.22 detail Translating IP to mac..... 10.2.66.66 =>0000.0201.0601 10.2.22.22 =>0000.0201.0201 Source 0000.0201.0601 found on con6[WS-C6509] (10.2.6.6) con6 / WS-C6509 / 10.2.6.6 : Fa0/1 [auto, auto] =>Fa0/3 [auto, auto] con5 / WS-C6509 / 10.2.5.5 : Fa0/3 [auto, auto] =>Gi0/1 [auto, auto] con1 / WS-C6509 / 10.2.1.1 : Gi0/1 [auto, auto] =>Gi0/2 [auto, auto] con2 / WS-C6509 / 10.2.2.2 : Gi0/2 [auto, auto] =>Fa0/1 [auto, auto] Destination 0000.0201.0201 found on con2[WS-C6509] (10.2.2.2) traceroute mac CF-1151 Cisco IOS Configuration Fundamentals Command Reference April 2010 Layer 2 trace completed. Router# This example shows how to display the Layer 2 path by specifying the source and destination hostnames: Router# traceroute mac ip con6 con2 Translating IP to mac ..... 10.2.66.66 =>0000.0201.0601 10.2.22.22 =>0000.0201.0201 Source 0000.0201.0601 found on con6 con6 (10.2.6.6) :Fa0/1 =>Fa0/3 con5 (10.2.5.5 ) : Fa0/3 =>Gi0/1 con1 (10.2.1.1 ) : Gi0/1 =>Gi0/2 con2 (10.2.2.2 ) : Gi0/2 =>Fa0/1 Destination 0000.0201.0201 found on con2 Layer 2 trace completed Router# This example shows the output when ARP cannot associate the source IP address with the corresponding MAC address: Router# traceroute mac ip 10.2.66.66 10.2.77.77 Arp failed for destination 10.2.77.77. Layer2 trace aborted. Router# undelete CF-1152 Cisco IOS Configuration Fundamentals Command Reference April 2010 undelete To recover a file marked “deleted” on a Class A Flash file system, use the undelete command in user EXEC or privileged EXEC mode. undelete index [filesystem:] Syntax Description Defaults The default file system is the one specified by the cd command. Command Modes user EXEC privileged EXEC Command History Usage Guidelines For Class A Flash file systems, when you delete a file, the Cisco IOS software simply marks the file as deleted, but it does not erase the file. This command allows you to recover a “deleted” file on a specified Flash memory device. You must undelete a file by its index because you could have multiple deleted files with the same name. For example, the “deleted” list could contain multiple configuration files with the name router-config. You undelete by index to indicate which of the many router-config files from the list to undelete. Use the dir command to learn the index number of the file you want to undelete. You cannot undelete a file if a valid (undeleted) file with the same name exists. Instead, you first delete the existing file and then undelete the file you want. For example, if you had an undeleted version of the router-config file and you wanted to use a previous, deleted version instead, you could not simply undelete the previous version by index. You would first delete the existing router-config file and then undelete the previous router-config file by index. You can delete and undelete a file up to 15 times. On Class A Flash file systems, if you try to recover the configuration file pointed to by the CONFIG_FILE environment variable, the system prompts you to confirm recovery of the file. This prompt reminds you that the CONFIG_FILE environment variable points to an undeleted file. To permanently delete all files marked “deleted” on a Flash memory device, use the squeeze EXEC command. For further information on Flash File System types (classes), see http://www.cisco.com/warp/public/63/pcmciamatrix.html. index A number that indexes the file in the dir command output. filesystem: (Optional) A file system containing the file to undelete, followed by a colon. Release Modification 11.0 This command was introduced for Class A Flash File Systems (platforms include the Cisco 7500 series and Cisco 12000 series). 12.2(14)SX Support for this command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command was introduced on the Supervisor Engine 2. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. undelete CF-1153 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples In the following example, the deleted file at index 1 is recovered: Router# show flash System flash directory: File Length Name/status 1 8972116 c7000-js56i-mz.121-5.T [deleted] 2 6765916 c7000-ds-mz.CSCds70452 [15738160 bytes used, 1039056 available, 16777216 total] 16384K bytes of processor board System flash (Read/Write) Router# undelete 1 flash: Related Commands Command Description delete Deletes a file on a Flash memory device. dir Displays a list of files on a file system. squeeze Permanently deletes Flash files by squeezing a Class A Flash file system. upgrade automatic abortversion CF-1154 Cisco IOS Configuration Fundamentals Command Reference April 2010 upgrade automatic abortversion To cancel the scheduled reloading of the router with a new Cisco IOS software image, use the upgrade automatic abortversion command in privileged EXEC mode. upgrade automatic abortversion no upgrade automatic abortversion Syntax Description This command has no arguments or keywords. Command Default The reload of the router with the Cisco IOS software image is not scheduled. The disk-management utility is disabled. Command Modes Privileged EXEC (#) Command History Usage Guidelines Use the upgrade automatic abortversion command to cancel a reload that has already been scheduled with either the upgrade automatic getversion command or the upgrade automatic runversion command. Examples The following example shows how to cancel a reload that is scheduled within one hour and 15 minutes. The reload was scheduled by using the upgrade automatic runversion command. Router# upgrade automatic runversion in 01:15 Upgrading to "flash:c1841-adventerprisek9-mz.calvin-build-20060714". Wait.. Reload scheduled for 09:51:38 UTC Thu Aug 3 2006 (in 1 hour and 15 minutes) with image - flash:c1841-adventerprisek9-mz.calvin-build-20060714 by console Reload reason: Auto upgrade Device will WARM UPGRADE in 1:15:00 To cancel the upgrade, enter the command "upgrade automatic abortversion" Aug 3 08:36:38.072: %SYS-5-SCHEDULED_RELOAD: Reload requested for 09:51:38 UTC Thu Aug 3 2006 at 08:36:38 UTC Thu Aug 3 2006 by console. Reload Reason: Auto upgrade. Router# upgrade automatic abortversion Auto upgrade of image which was scheduled earlier is aborted! *** *** --- SHUTDOWN ABORTED --- *** Release Modification 12.4(15)T This command was introduced. upgrade automatic abortversion CF-1155 Cisco IOS Configuration Fundamentals Command Reference April 2010 Aug 3 08:37:02.292: %SYS-5-SCHEDULED_RELOAD_CANCELLED: Scheduled reload cancelled at 08:37:02 UTC Thu Aug 3 2006 Related Commands Command Description upgrade automatic getversion Downloads a Cisco IOS software image directly from www.cisco.com or from a non-Cisco server. upgrade automatic runversion Reloads the router with a new Cisco IOS software image. upgrade automatic getversion CF-1156 Cisco IOS Configuration Fundamentals Command Reference April 2010 upgrade automatic getversion To download a Cisco IOS software image directly from www.cisco.com or from a non-Cisco server, use the upgrade automatic getversion command in privileged EXEC mode. upgrade automatic getversion {cisco username username password password image image | url}[at hh:mm | now | in hh:mm] [disk-management {auto | confirm | no}] Syntax Description Command Default The reload of the router with the Cisco IOS software image is not scheduled. The disk-management utility is disabled. Command Modes Privileged EXEC (#) Command History Usage Guidelines Use the upgrade automatic getversion command to download the Cisco IOS software image to a router. You can either download the image from the Cisco website (www.cisco.com) or from a non-Cisco server to which the Cisco IOS software image has already been downloaded from the Cisco website. cisco Downloads the image from www.cisco.com. username username Username for logging in to www.cisco.com. password password Password for logging in to www.cisco.com. image Specifies the Cisco IOS software image to which the router is to be upgraded. image Name of the Cisco IOS software image to which the router is to be upgraded. url URL from where the Cisco IOS Auto-Upgrade Manager can download the image that has already been downloaded to a non-Cisco server. at (Optional) Schedules a reload at a specified time. Use either of the following arguments with this keyword: • hh:mm—Hour and minute. The time entered must be in 24-hour format. • now—Immediately after the download of the Cisco IOS software image. in hh:mm (Optional) Schedules a reload in a specified length of time after downloading the Cisco IOS software image. disk-management (Optional) Cisco IOS Auto-Upgrade Manager disk cleanup utility. You must configure one of the following keywords: • auto—Deletes the files without asking for confirmation. • confirm—Asks for confirmation before deleting a file. • no—Never deletes any file. Release Modification 12.4(15)T This command was introduced. upgrade automatic getversion CF-1157 Cisco IOS Configuration Fundamentals Command Reference April 2010 You can also use this command to schedule a reload. Additionally, this command can use the disk cleanup utility to delete files if there is not enough space to download the new Cisco IOS software image. Examples Downloading the Cisco IOS Image from the Cisco Website The following example shows how to download a Cisco IOS software image from the Cisco website (www.cisco.com). Here, the reloading of the router with the downloaded Cisco IOS software image is not scheduled. Also, the disk-cleanup utility is not enabled. Router# upgrade automatic getversion cisco username myusername password mypassword image c3825-adventerprisek9-mz.124-2.XA.bin Downloading the Cisco IOS Image from a Non-Cisco TFTP Server The following example shows how to download the Cisco IOS software image from a non-Cisco TFTP server and reload the router immediately after the download. It also shows how to delete the files automatically if there is not enough disk space. Router# upgrade automatic getversion tftp://abc/tom/c3825-adventerprisek9-mz.124-2.XA.bin at now disk-management auto Downloading the Cisco IOS Image from a Non-Cisco TFTP Server Using the Interactive Mode The following example shows how to use this command in interactive mode to download a Cisco IOS software image from a non-Cisco server. Here, the reloading of the device with the downloaded Cisco IOS software image is not scheduled. Router# upgrade automatic ################################################################################ Welcome to the Cisco IOS Auto Upgrade Manager. To upgrade your device, please answer the following questions. To accept the default value for a question, simply hit ################################################################################ Would you like to download an image directly from Cisco Server over the Internet? A valid Cisco login will be required. Download from Cisco server? [yes]: no Image location:tftp://10.1.0.1/emailid/c3825-adventerprisek9-mz_pi6_aum_review Image Found: c3825-adventerprisek9-mz_pi6_aum_review (42245860 bytes) Memory Available: 851Mb Main Memory (RAM) - 71335936 bytes of flash space New image will be downloaded to flash:c3825-adventerprisek9-mz_pi6_aum_review Reload and upgrade the device immediately after image download is complete? [yes]: no When would you like to reload your device? Use hh:mm format or specify "Manual" to not schedule a reload time. Use 'upgrade automatic runversion' to reload manually. Time to reload the box [Manual]? Proceed with device image upgrade from [tftp://10.1.0.1/emailid/c3825-adventerprisek9-mz_pi6_aum_review] to [c3825-adventerprisek9-mz_pi6_aum_review]? [yes]: Downloading Image from user specified url: Loading emailid/c3825-adventerprisek9-mz_pi6_aum_review from 172.16.0.0(via GigabitEthernet0/0): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [OK - 42245860 bytes] [download complete] Verifiying the image: ......................... Done! Image Verification: PASS Use 'upgrade automatic runversion' command to reload manually. upgrade automatic getversion CF-1158 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description upgrade automatic abortversion Cancels upgrading the router with a new Cisco IOS software image. upgrade automatic runversion Reloads the router with a new Cisco IOS software image. upgrade automatic runversion CF-1159 Cisco IOS Configuration Fundamentals Command Reference April 2010 upgrade automatic runversion To reload the router with a new Cisco IOS software image, use the upgrade automatic runversion command in privileged EXEC mode. upgrade automatic runversion [at hh:mm | now | in hh:mm] Syntax Description Command Modes Privileged EXEC (#) Command History Usage Guidelines Use the upgrade automatic runversion command to schedule a reload after downloading a Cisco IOS software image using the upgrade automatic getversion command. Note You can also use the upgrade automatic getversion command to reload the router with the new Cisco IOS software image. However, if you have already downloaded the Cisco IOS software image using the upgrade automatic getversion command, you should use the upgrade automatic runversion command to reload the router. Examples The following example shows how to schedule a reload after downloading a Cisco IOS software image: Router# show clock 09:01:36.124 UTC Thu Aug 3 2006 Router# upgrade automatic runversion at 10:20 Upgrading to "flash:c1841-adventerprisek9-mz.calvin-build-20060714". Wait.. Reload scheduled for 10:20:00 UTC Thu Aug 3 2006 (in 1 hour and 18 minutes) with image - flash:c1841-adventerprisek9-mz.calvin-build-20060714 by console Reload reason: Auto upgrade Device will WARM UPGRADE at 10:20:00 To cancel the upgrade, enter the command "upgrade automatic abortversion" Router# Aug 3 09:01:58.116: %SYS-5-SCHEDULED_RELOAD: Reload requested for 10:20:00 UTC Thu Aug 3 2006 at 09:01:58 UTC Thu Aug 3 2006 by console. Reload Reason: Auto upgrade. at Schedules a reload at a specified time. Use either of the following arguments with this keyword: • hh:mm—Hour and minute. The time entered must be in 24-hour format. • now—Immediately after the download of the Cisco IOS software image. in hh:mm Schedules a reload in a specified length of time after downloading the Cisco IOS software image. Release Modification 12.4(15)T This command was introduced. upgrade automatic runversion CF-1160 Cisco IOS Configuration Fundamentals Command Reference April 2010 Related Commands Command Description upgrade automatic abortversion Cancels upgrading the router with a new Cisco IOS software image. upgrade automatic getversion Downloads a Cisco IOS software image directly from www.cisco.com or from a non-Cisco server. upgrade filesystem monlib CF-1161 Cisco IOS Configuration Fundamentals Command Reference April 2010 upgrade filesystem monlib To upgrade the ATA ROM monitor library (monlib) file without erasing file system data, use the upgrade filesystem monlib command in privileged EXEC mode. upgrade filesystem monlib {disk0 | disk1} Syntax Description Defaults No default behavior or values Command Modes Privileged EXEC Command History Usage Guidelines If you attempt to upgrade the ATA monlib file on a disk that has not been formatted on a router running Cisco IOS software, the upgrade operation will fail. If the amount of space available on the disk for the monlib image is smaller than the monlib image you are trying to upgrade to, the upgrade operation will fail. The amount of space available for the monlib file can be determined by issuing the show disk command with the all keyword specified. The “Disk monlib size” field displays the number of bytes available for the ATA monlib file. Examples The following example shows how to upgrade the ATA monlib file on disk 0: Router# upgrade filesystem monlib disk0 Writing Monlib sectors. .......................................................................................... .......................................... Monlib write complete Related Commands disk0 Selects disk 0 as the file system to be formatted. disk1 Selects disk 1 as the file system to be formatted. Release Modification 12.3(7)T This command was introduced. 12.2(25)S This command was integrated into the Cisco IOS Release 12.2(25)S. Command Description format Formats a Class A or Class C flash file system. show disk Displays flash or file system information for a disk. upgrade rom-monitor CF-1162 Cisco IOS Configuration Fundamentals Command Reference April 2010 upgrade rom-monitor To set the execution preference on a read-only memory monitor (ROMMON), use the upgrade rom-monitor command in privileged EXEC or diagnostic mode. upgrade rom-monitor slot num {sp | rp} file filename upgrade rom-monitor slot num {sp | rp} {invalidate | preference} {region1 | region2} Cisco ASR 1000 Series Aggregation Services Routers upgrade rom-monitor filename URL slot Syntax Description Defaults This command has no default settings. Command Modes Privileged EXEC (#) Diagnostic (diag) slot num Specifies the slot number of the ROMMON to be upgraded. sp Upgrades the ROMMON of the Switch Processor. rp Upgrades the ROMMON of the Route Processor. file filename Specifies the name of the S-record (SREC) file; see the “Usage Guidelines” section for valid values. invalidate Invalidates the ROMMON of the selected region. preference Sets the execution preference on a ROMMON of the selected region. region1 Selects the ROMMON in region 1. region2 Selects the ROMMON in region 2. filename Specifies the ROMMON package filename. URL The URL to a ROMMON file. The URL always begins with a file system, such as bootflash:, harddisk:, obfl:, stby-harddisk:, or usb[0-1], then specifies the path to the file. slot The slot that contains the hardware that will receive the ROMMON upgrade. Options are: • number—the number of the Session Initiation Protocol (SIP) slot that requires the ROMMON upgrade • all—All hardware on the router • F0—Embedded-Service-Processor slot 0 • F1—Embedded-Service-Processor slot 1 • FP—All installed Embedded-Service-Processors • R0—Route-Processor slot 0 • R1—Route-Processor slot 1 • RP—Route-Processor upgrade rom-monitor CF-1163 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command History Usage Guidelines Caution If you enter the upgrade rom-monitor command from a Telnet session instead of a console connection, service may be interrupted. The slot num keyword and argument combination is required for this command to function properly. The sp or rp keyword is required if you installed a supervisor engine in the specified slot. Valid values for file filename are the following: • bootflash: • disk0: • disk1: • flash: • ftp: • rcp: • sup-bootflash: • sup-slot0: • tftp: On Cisco ASR 1000 Series Routers, this command can be used to upgrade ROMMON in privileged EXEC and diagnostic mode. The hardware receiving the ROMMON upgrade must be reloaded to complete the upgrade. From Cisco IOS Release 12.4(24)T, you can use the upgrade rom-monitor command on Cisco 3200 series routers to upgrade ROMMON and the system bootstrap, if a newer version of ROMMON is available on the system. Examples This example shows how to upgrade the new ROMMON image to the flash device on a Supervisor Engine 2: Router# upgrade rom-monitor slot 1 sp file tftp://dirt/tftpboot-users/A2_71059.srec ROMMON image upgrade in progress Erasing flash Programming flash Verifying new image ROMMON image upgrade complete The card must be reset for this to take effect Release Modification 12.2(14)SX This command was introduced on the Supervisor Engine 720. 12.2(17d)SXB This command was modified. Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.4(24)T This command was integrated into Cisco IOS Release 12.4(24)T. Cisco IOS XE Release 2.1 This command was integrated into Cisco ASR 1000 Series Routers, and introduced in diagnostic mode. upgrade rom-monitor CF-1164 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router# In the following example, a ROMMON upgrade is performed to upgrade to Cisco IOS Release 12.2(33r)XN1 on a Cisco ASR 1000 Series Router using an ROMMON image stored on the bootflash: file system. All hardware is upgraded on the Cisco ASR 1000 Series Router in this example, and the router is then reloaded to complete the procedure. Router# show rom-monitor 0 System Bootstrap, Version 12.2(33)XN1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 2007 by cisco Systems, Inc. Router# show rom-monitor F0 System Bootstrap, Version 12.2(33)XN1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 2007 by cisco Systems, Inc. Router# show rom-monitor R0 System Bootstrap, Version 12.2(33)XN1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 2007 by cisco Systems, Inc. Router# copy tftp bootflash: Address or name of remote host []? 127.23.16.81 Source filename []? auto/tftp-boot/asr1000-rommon.122-33r.XN1.pkg Destination filename [asr1000-rommon.122-33r.XN1.pkg]? Accessing tftp://127.23.16.81/auto/tftp-boot/asr1000-rommon.122-33r.XN1.pkg... Loading auto/tftp-boot/asr1000-rommon.122-33r.XN1.pkg from 127.23.16.81 (via GigabitEthernet0): !!! [OK - 553164 bytes] 553164 bytes copied in 1.048 secs (527828 bytes/sec) Router# dir bootflash: Directory of bootflash:/ 11 drwx 16384 Dec 2 2004 12:02:09 +00:00 lost+found 14401 drwx 4096 Dec 2 2004 12:05:05 +00:00 .ssh 86401 drwx 4096 Dec 2 2004 12:05:07 +00:00 .rollback_timer 12 -rw- 33554432 Nov 20 2007 19:53:47 +00:00 nvram_00100 13 -rw- 6401536 Dec 23 2004 19:45:11 +00:00 mcp-fpd-pkg.122-test.pkg 28801 drwx 4096 Nov 1 2007 17:00:36 +00:00 .installer 15 -rw- 553164 Nov 28 2007 15:33:49 +00:00 asr1000-rommon.122-33r.XN1.pkg 16 -rw- 51716300 Nov 14 2007 16:39:59 +00:00 asr1000rp1-espbase.v122_33_xn_asr_rls0_throttle.pkg 17 -rw- 21850316 Nov 14 2007 16:41:23 +00:00 asr1000rp1-rpaccess-k9.v122_33_xn_asr_rls0_throttle.pkg 18 -rw- 21221580 Nov 14 2007 16:42:21 +00:00 asr1000rp1-rpbase.v122_33_xn_asr_rls0_throttle.pkg 19 -rw- 27576524 Nov 14 2007 16:43:50 +00:00 asr1000rp1-rpcontrol.v122_33_xn_asr_rls0_throttle.pkg 20 -rw- 48478412 Nov 14 2007 16:45:50 +00:00 asr1000rp1-rpios-advipservicesk9.v122_33_xn_asr_rls0_throttle.pkg 21 -rw- 36942028 Nov 14 2007 16:47:17 +00:00 asr1000rp1-sipbase.v122_33_xn_asr_rls0_throttle.pkg 22 -rw- 14749900 Nov 14 2007 16:48:17 +00:00 asr1000rp1-sipspa.v122_33_xn_asr_rls0_throttle.pkg 23 -rw- 6049 Nov 14 2007 16:49:29 +00:00 packages.conf 14 -rw- 213225676 Nov 20 2007 19:53:13 +00:00 asr1000rp1-advipservicesk9.v122_33_xn_asr_rls0_throttle.bin upgrade rom-monitor CF-1165 Cisco IOS Configuration Fundamentals Command Reference April 2010 928833536 bytes total (451940352 bytes free) Router# upgrade rom-monitor filename bootflash:/asr1000-rommon.122-33r.XN1.pkg all Upgrade rom-monitor on Route-Processor 0 Target copying rom-monitor image file Checking upgrade image... 1966080+0 records in 3840+0 records out Upgrade image MD5 signature is 253f15daf89eea22b1db92d440d03608 Burning upgrade partition... 1966080+0 records in 3840+0 records out Checking upgrade partition... Upgrade flash partition MD5 signature is 253f15daf89eea22b1db92d440d03608 ROMMON upgrade complete. To make the new ROMMON permanent, you must restart the RP. Upgrade rom-monitor on Embedded-Service-Processor 0 Target copying rom-monitor image file Checking upgrade image... 1966080+0 records in 3840+0 records out Upgrade image MD5 signature is 253f15daf89eea22b1db92d440d03608 Burning upgrade partition... 1966080+0 records in 3840+0 records out Checking upgrade partition... Upgrade flash partition MD5 signature is 253f15daf89eea22b1db92d440d03608 ROMMON upgrade complete. To make the new ROMMON permanent, you must restart the linecard. Upgrade rom-monitor on SPA-Inter-Processor 0 Target copying rom-monitor image file Checking upgrade image... 1966080+0 records in 3840+0 records out Upgrade image MD5 signature is 253f15daf89eea22b1db92d440d03608 Burning upgrade partition... 1966080+0 records in 3840+0 records out Checking upgrade partition... Upgrade flash partition MD5 signature is 253f15daf89eea22b1db92d440d03608 ROMMON upgrade complete. To make the new ROMMON permanent, you must restart the linecard. Upgrade rom-monitor on SPA-Inter-Processor 1 Target copying rom-monitor image file Checking upgrade image... 1966080+0 records in 3840+0 records out Upgrade image MD5 signature is 253f15daf89eea22b1db92d440d03608 Burning upgrade partition... 1966080+0 records in 3840+0 records out Checking upgrade partition... Upgrade flash partition MD5 signature is 253f15daf89eea22b1db92d440d03608 ROMMON upgrade complete. To make the new ROMMON permanent, you must restart the linecard. upgrade rom-monitor CF-1166 Cisco IOS Configuration Fundamentals Command Reference April 2010 Router# reload Router# show rom-monitor 0 System Bootstrap, Version 12.2(33r)XN1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 2007 by cisco Systems, Inc. Router# show rom-monitor F0 System Bootstrap, Version 12.2(33r)XN1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 2007 by cisco Systems, Inc. Router# show rom-monitor R0 System Bootstrap, Version 12.2(33r)XN1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 2007 by cisco Systems, Inc. Related Commands Command Description show rom-monitor Displays the ROMMON status. upgrade rom-monitor file CF-1167 Cisco IOS Configuration Fundamentals Command Reference April 2010 upgrade rom-monitor file To upgrade the ROM monitor (ROMmon) image, use the upgrade rom-monitor file command in privileged EXEC mode. Cisco 1941, 2900, and 3900 Routers upgrade rom-monitor file {archive: | cns: | flash0: | flash1: | flash: | ftp: | http: | https: | null: | nvram: | rcp: | scp: | system: | tar: | tftp: | tmpsys: | usbflash0: | xmodem: | ymodem:} [file-path] Cisco 7200 VXR Router with NPE-G1 upgrade rom-monitor file {bootflash:[file-path] | disk0:[file-path] | disk1:[file-path] | disk2:[file-path] | flash:[file-path] | ftp:[file-path] | slot0:[file-path] | slot1:[file-path] | tftp:[file-path]} Cisco 7301 Router upgrade rom-monitor file {flash:[file-path] | ftp:[file-path] | disk0:[file-path] | tftp:[file-path]} Cisco 7304 Router upgrade rom-monitor {rom0 | rom1 | rom2} file {bootdisk:[file-path] | disk0:[file-path] | flash:[file-path] | ftp:[file-path] | rcp:[file-path] | tftp:[file-path]} Cisco 10008 Router (PRE3 Only) upgrade {rom-monitor | fpga} Syntax Description archive: Filename location of the Upgrade ROMmon image in archive memory. file-path Directory pathname or filename where the Upgrade ROMmon image is located. bootdisk: Filename location of the Upgrade ROMmon image in the boot disk. bootflash: Filename location of the Upgrade ROMmon image in boot flash memory. cns: Filename location of the Upgrade ROMmon image in a Cisco Networking Services (CNS) configuration. disk0: The filename location of the Upgrade ROMmon image in disk 0 of the router chassis. Disk 0 is present only on a Cisco 7200 VXR that has an I/O controller. disk1: The filename location of the Upgrade ROMmon image in disk 1 of the router chassis. Disk 1 is present only on a Cisco 7200 VXR that has an I/O controller. disk2: The filename location of the Upgrade ROMmon image in disk 2 of the router chassis. Disk 2 is always present on a Cisco 7200 VXR. flash: Filename location of the Upgrade ROMmon image in Flash memory. flash0: Filename location of the Upgrade ROMmon image in Flash 0 memory. flash1: Filename location of the Upgrade ROMmon image in Flash 1 memory. upgrade rom-monitor file CF-1168 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command Modes Privileged EXEC Command History fpga (Cisco 10008 router only) Upgradable field-programmable gate array (FPGA). ftp: Filename location of the Upgrade ROMmon image using FTP. http: Filename location of the Upgrade ROMmon image on an HTTP server (also called a web server) https: Filename location of the Upgrade ROMmon image on a Secure HTTP (HTTPS) server. null: Filename location of the Upgrade ROMmon image in the null file system. nvram: Filename location of the Upgrade ROMmon image in NVRAM memory. rcp: Filename location of the Upgrade ROMmon image using Remote Copy Protocol (RCP). rom-monitor (Cisco 10008 router only) Upgradable ROM monitor. rom0 One-time programmable, always there “golden” ROMmon. rom1 Upgradable ROM monitor 1. rom2 Upgradable ROM monitor 2. scp: Filename location of the Upgrade ROMmon image for a network server that supports Secure Shell (SSH) and accepts copies of files using the secure copy protocol (scp). slot0:, slot1: The filename location of the Upgrade ROMmon image in slot 0 and slot 1 of the router chassis. Slot 0 and slot 1 are present only on a Cisco 7200 VXR that has an I/O controller. system: Filename location of the Upgrade ROMmon image in system memory. tar: Filename location of the Upgrade ROMmon image in the archive file system. tftp: Filename location of the Upgrade ROMmon image on the TFTP server. tmpsys: Filename location of the Upgrade ROMmon image in the temporary file system. usbflash0: Filename location of the Upgrade ROMmon image in usbflash 0 memory. xmodem: Filename location of the Upgrade ROMmon image using Xmodem protocol. ymodem: Filename location of the Upgrade ROMmon image using Ymodem protocol. Release Modification 12.0(28)S This command was introduced on the Cisco 7200 VXR router. 12.3(8)T This command was integrated into Cisco IOS Release 12.3(8)T and supported on the Cisco 7200 VXR router and Cisco 7301 router. 12.3(9) This command was integrated into Cisco IOS Release 12.3(9) and supported on the Cisco 7200 VXR router and Cisco 7301 router. 12.2(18)S This command was integrated into Cisco IOS Release 12.2(18)S and supported on the Cisco 7304 router. 12.0S This command was implemented on the PRE2 for the Cisco 10000 series router. upgrade rom-monitor file CF-1169 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines You can use the upgrade rom-monitor file command to download a new ROMmon image instead of having to replace the processor to obtain a new image. Note Images are marked as invalid if the first bootup is not completed. Do not reset the router when it is doing an initial bootup. Cisco 7200 VXR Router A Cisco 7200 VXR that has an I/O controller card installed has the following additional devices on its chassis: disk 0, disk 1, slot 0, and slot 1. Cisco 7304 Router There are three ROMmon images. ROM 0 is a one-time programmable, always-there ROMmon image, referred to as the “golden” ROMmon. ROM 1 and ROM 2 are upgradable ROMmon images. At bootup, the system uses the golden ROMmon by default. If either ROM 1 or ROM 2 are configured, the system still begins bootup with the golden ROMmon, then switches to the configured ROMmon. If a new configured ROMmon image fails to boot up Cisco IOS software, the router marks this ROMmon image as invalid and reverts to the golden image for the next Cisco IOS bootup. After downloading a new ROMmon image to the writable ROMmon, you must reload Cisco IOS software for the new ROMmon to take effect. The first time a new ROMmon image is loaded, you must allow the system to boot up Cisco IOS software before doing any resets or power cycling. If the ROMmon loading process is interrupted, the system interprets this as a bootup failure of the new ROMmon image and reverts the ROMmon back to the golden ROMmon image in ROM 0. Cisco 10008 Router The PRE2 does not allow you to upgrade the ROM monitor image. However, the PRE3 does allow this using the upgrade rom-monitor command. Examples The following example of a Cisco 7200 VXR using an I/O controller loads the Upgrade ROMmon image from a disk 1 filename: Router# upgrade rom-monitor file disk1:C7200_NPEG1_RMFUR.srec.123-4r.T1 This command will reload the router. Continue? [yes/no]:yes ROMMON image upgrade in progress. Erasing boot flash eeeeeeeeeeeeeeeeee Programming boot flash pppppp Now Reloading via hard watchdog timeout The following example on a Cisco 7301 router loads the Upgrade ROMmon image from a specified TFTP file location: Router# upgrade rom-monitor file tftp://00.0.00.0/biff/C7301_RMFUR.srec 12.2(31)SB2 This command was implemented on the PRE3 for the Cisco 10000 series router. 15.0(1)M2 This command was implemented on the Cisco 1941, 2900, and 3900 routers. 15.1(1)T This command was integrated into Cisco IOS Release 15.1(1)T. Release Modification upgrade rom-monitor file CF-1170 Cisco IOS Configuration Fundamentals Command Reference April 2010 Loading biff/C7301_RMFUR.srec from 00.0.00.0 (via GigabitEthernet0/1): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [OK - 392348 bytes] This command will reload the router. Continue? [yes/no]:yes ROMMON image upgrade in progress. Erasing boot flash eeeeeeeeeeeeeeeeee Programming boot flash ppppp Now Reloading via hard watchdog timeout Unexpected exception, CP System Bootstrap, Version 12.2(20031011:151758) [biff] Copyright (c) 2004 by cisco Systems, Inc. Running new upgrade for first time System Bootstrap, Version 12.2(20031011:151758) [biff] Copyright (c) 2004 by cisco Systems, Inc. ROM:Rebooted by watchdog hard reset C7301 platform with 1048576 Kbytes of main memory Upgrade ROMMON initialized rommon 1 > The following example configures the system to install a file called “rommonfile” as ROM 1 from the bootdisk: Router# upgrade rom-monitor rom1 file bootdisk:rommonfile ROM 1 upgrade in progress Erasing (this may take a while)... Programming... CC Do you want to verify this image (may take a few minutes)? [yes/no]: y Verifying ROM 1 Reading from ROM 1....Done Comparing with the source file...Passed Set this ROMMON image as the default (will take effect on next reload/reset)? y Related Commands Command Description show diag Displays hardware information for any slot or the chassis. upgrade rom-monitor preference CF-1171 Cisco IOS Configuration Fundamentals Command Reference April 2010 upgrade rom-monitor preference To select a ReadOnly or Upgrade ROMmon image to be booted on the next reload of a Cisco 7200 VXR or Cisco 7301router, use the upgrade rom-monitor preference command in privileged EXEC mode. upgrade rom-monitor preference [readonly | upgrade] Syntax Description Defaults No default behavior or values Command Modes Privileged EXEC Command History Usage Guidelines After running the upgrade rom-monitor preference command, you must reload the router for the selected ROMmon image to take effect. Use the rommon-pref command when you are in ROMmon mode. Examples The following example applicable to both the Cisco 7200 VXR and Cisco 7301 routers selects the ReadOnly ROMmon image to be booted on the next reload of the router: Router# upgrade rom-monitor preference readonly You are about to mark ReadOnly region of ROMMON for the highest boot preference. Proceed? [confirm] Done! Router must be reloaded for this to take effect. Related Commands readonly Selects the ReadOnly ROMmon image to be booted on the next reload. upgrade Selects the Upgrade second ROMmon image to be booted on the next reload. Release Modification 12.0(28)S This command was introduced on the Cisco 7200 VXR router. 12.3(8)T This command was integrated into Cisco IOS Release 12.3(8)T and supported on the Cisco 7200 VXR router and Cisco 7301 router. 12.3(9) This command was integrated into Cisco IOS Release 12.3(9) and supported on the Cisco 7200 VXR router and Cisco 7301 router. Command Description rommon-pref Selects a ReadOnly or Upgrade ROMmon image to be booted on the next reload when you are in ROMmon mode. vacant-message CF-1172 Cisco IOS Configuration Fundamentals Command Reference April 2010 vacant-message To display an idle terminal message, use the vacant-message command in line configuration mode. To remove the default vacant message or any other vacant message that may have been set, use the no form of this command. vacant-message [d message d] no vacant-message Syntax Description Defaults The format of the default vacant message is as follows: hostname tty# is now available Press RETURN to get started. This message is generated by the system. Command Modes Line configuration Command History Usage Guidelines This command enables the banner to be displayed on the screen of an idle terminal. The vacant-message command without any arguments restores the default message. Follow this command with one or more blank spaces and a delimiting character of your choice. Then enter one or more lines of text, terminating the message with the second occurrence of the delimiting character. Note For a rotary group, you need to define only the message for the first line in the group. d (Optional) Delimiting character that marks the beginning and end of the vacant-message. Text delimiters are characters that do not ordinarily appear within the text of a title, such as slash ( / ), double quote ("), or tilde (~). ^C is reserved for special use and should not be used in the message. message (Optional) Vacant terminal message. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. vacant-message CF-1173 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example turns on the system banner and displays this message: Router(config)# line 0 Router(config-line)# vacant-message % Welcome to Cisco Systems, Inc. Press Return to get started. % verify CF-1174 Cisco IOS Configuration Fundamentals Command Reference April 2010 verify To verify the checksum of a file on a flash memory file system or compute a Message Digest 5 (MD5) signature for a file, use the verify command in privileged EXEC mode. verify [/md5 [md5-value]] filesystem:[file-url] Cisco 7600 Series Router verify {/md5 flash-filesystem [expected-md5-signature] | /ios flash-filesystem | flash-filesystem} Syntax Description Defaults The current working device is the default device (file system). Command Modes Privileged EXEC Command History /md5 (Optional) Calculates and displays the MD5 value for the specified software image. Compare this value with the value available on Cisco.com for this image. md5-value (Optional) The known MD5 value for the specified image. When an MD5 value is specified in the command, the system calculates the MD5 value for the specified image and display a message verifying that the MD5 values match or that there is a mismatch. filesystem: File system or directory containing the files to list, followed by a colon. Standard file system keywords for this command are flash: and bootflash:. file-url (Optional) The name of the files to display on a specified device. The files can be of any type. You can use wildcards in the filename. A wildcard character (*) matches all patterns. Strings after a wildcard are ignored. Cisco 7600 Series Router /md5 flash-filesystem Computes an MD5 signature for a file; valid values are bootflash:, disk0:, disk1:, flash:, or sup-bootflash:. expected-md5-signature (Optional) MD5 signature. /ios flash-filesystem Verifies the compressed Cisco IOS image checksum; valid values are bootflash:, disk0:, disk1:, flash:, or sup-bootflash:. flash-filesystem Device where the Flash memory resides; valid values are bootflash:, disk0:, disk1:, flash:, or sup-bootflash:. Release Modification 11.0 This command was introduced. 12.2(4)T The /md5 keyword was added. verify CF-1175 Cisco IOS Configuration Fundamentals Command Reference April 2010 Usage Guidelines This command replaces the copy verify and copy verify flash commands. Use the verify command to verify the checksum of a file before using it. Each software image that is distributed on disk uses a single checksum for the entire image. This checksum is displayed only when the image is copied into flash memory; it is not displayed when the image file is copied from one disk to another. Supported Platforms Other than the Cisco 7600 Series Router Before loading or duplicating a new image, record the checksum and MD5 information for the image so that you can verify the checksum when you copy the image into flash memory or onto a server. A variety of image information is available on Cisco.com. For example, you can get the Release, Feature Set, Size, BSD Checksum, Router Checksum, MD5, and Publication Date information by clicking on the image file name prior to downloading it from the Software Center on Cisco.com. To display the contents of flash memory, use the show flash command. The flash contents listing does not include the checksum of individual files. To recompute and verify the image checksum after the image has been copied into flash memory, use the verify command. Note, however, that the verify command only performs a check on the integrity of the file after it has been saved in the file system. It is possible for a corrupt image to be transferred to the router and saved in the file system without detection. If a corrupt image is transferred successfully to the router, the software will be unable to tell that the image is corrupted and the file will verify successfully. To use the message-digest5 (MD5) hash algorithm to ensure file validation, use the verify command with the /md5 option. MD5 is an algorithm (defined in RFC 1321) that is used to verify data integrity through the creation of a unique 128-bit message digest. The /md5 option of the verify command allows you to check the integrity of a Cisco IOS software image by comparing its MD5 checksum value against a known MD5 checksum value for the image. MD5 values are now made available on Cisco.com for all Cisco IOS software images for comparison against local system image values. To perform the MD5 integrity check, issue the verify command using the /md5 keyword. For example, issuing the verify flash:c7200-is-mz.122-2.T.bin /md5 command will calculate and display the MD5 value for the software image. Compare this value with the value available on Cisco.com for this image. Alternatively, you can get the MD5 value from Cisco.com first, then specify this value in the command syntax. For example, issuing the verify flash:c7200-is-mz.122-2.T.bin /md5 8b5f3062c4caeccae72571440e962233 command will display a message verifying that the MD5 values match or that there is a mismatch. A mismatch in MD5 values means that either the image is corrupt or the wrong MD5 value was entered. 12.2(18)S The verify command was enhanced to verify the hash that is contained in the image, and the output was enhanced to show the hash value in addition to the entire hash image (CCO hash). 12.0(26)S The verify command enhancements were integrated into Cisco IOS Release 12.0(26)S. 12.2(14)SX Support for this command was added for the Supervisor Engine 720. 12.3(4)T The verify command enhancements were integrated into Cisco IOS Release 12.3(4)T. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Release Modification verify CF-1176 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco 7600 Series Router The Readme file, which is included with the image on the disk, lists the name, file size, and checksum of the image. Review the contents of the Readme file before loading or duplicating the new image so that you can verify the checksum when you copy it into the flash memory or onto a server. Use the verify /md5 command to verify the MD5 signature of a file before using it. This command validates the integrity of a copied file by comparing a precomputed MD5 signature with the signature that is computed by this command. If the two MD5 signatures match, the copied file is identical to the original file. You can find the MD5 signature that is posted on the Cisco.com page with the image. You can use the verify /md5 command in one of the following ways: • Verify the MD5 signatures manually by entering the verify /md5 filename command. Check the displayed signature against the MD5 signature that is posted on the Cisco.com page. • Allow the system to compare the MD5 signatures by entering the verify /md5 flash-filesystem:filenam expected-md5-signature command. After completing the comparison, the system returns with a verified message. If an error is detected, the output is similar to the following: Router# verify /md5 disk0:c6msfc2-jsv-mz 0f . . . Done ! %Error verifying disk0:c6msfc2-jsv-mz Computed signature = 0f369ed9e98756f179d4f29d6e7755d3 Submitted signature = 0f To display the contents of the flash memory, enter the show flash command. The listing of the flash contents does not include the checksum of the individual files. To recompute and verify the image checksum after the image has been copied into the flash memory, enter the verify command. A colon (:) is required after the specified device. Examples Supported Platforms Other than Cisco 7600 Series Router The following example shows how to use the verify command to check the integrity of the file c7200-js-mz on the flash memory card inserted in slot 0: Router# dir slot0: Directory of slot0:/ 1 -rw- 4720148 Aug 29 1997 17:49:36 hampton/nitro/c7200-j-mz 2 -rw- 4767328 Oct 01 1997 18:42:53 c7200-js-mz 5 -rw- 639 Oct 02 1997 12:09:32 rally 7 -rw- 639 Oct 02 1997 12:37:13 the_time 20578304 bytes total (3104544 bytes free) Router# verify slot0:c7200-js-mz Verified slot0:c7200-js-mz verify CF-1177 Cisco IOS Configuration Fundamentals Command Reference April 2010 In the following example, the /md5 keyword is used to display the MD5 value for the image: Router# verify /md5 disk1: Verify filename []? c7200-js-mz . . . Done ! verify /md5 (disk1:c7200-js-mz) = 0f369ed9e98756f179d4f29d6e7755d3 In the following example, the known MD5 value for the image (obtained from Cisco.com) is specified in the verify command, and the system checks the value against the stored value: Router# verify /md5 disk1:c7200-js-mz ? WORD Expected md5 signature router# verify /md5 disk1:c7200-js-mz 0f369ed9e98756f179d4f29d6e7755d3 . . . Done ! Verified (disk1:c7200-js-mz) = 0f369ed9e98756f179d4f29d6e7755d3 The following example shows how the output of the verify command was enhanced to show the hash value in addition to the entire hash image (CCO hash): Router# verify disk0:c7200-js-mz %Filesystem does not support verify operations Verifying file integrity of disk0:c7200-js-mz . . . Done ! Embedded Hash MD5 :CFA258948C4ECE52085DCF428A426DCD Computed Hash MD5 :CFA258948C4ECE52085DCF428A426DCD CCO Hash MD5 :44A7B9BDDD9638128C35528466318183 Signature Verified Cisco 7600 Series Router This example shows how to use the verify command: Router# verify cat6k_r47_1.cbi . . . File cat6k_r47_1.cbi verified OK. This example shows how to check the MD5 signature manually: Router# verify /md5 c6msfc2-jsv-mz verify CF-1178 Cisco IOS Configuration Fundamentals Command Reference April 2010 . . . Done ! verify /md5 (disk0:c6msfc2-jsv-mz) = 0f369ed9e98756f179d4f29d6e7755d3 This example shows how to allow the system to compare the MD5 signatures: Router# verify /md5 disk0:c6msfc2-jsv-mz 0f369ed9e98756f179d4f29d6e7755d3 . . . Done ! verified /md5 (disk0:c6sup12-jsv-mz) = 0f369ed9e98756f179d4f29d6e7755d3 Router# This example shows how to verify the compressed checksum of the Cisco IOS image: Router# verify /ios disk0:c6k222-jsv-mz Verified compressed IOS image checksum for disk0:c6k222-jsv-mz Related Commands Command Description cd Changes the default directory or file system. copy Copies any file from a source to a destination. copy /noverify Disables the automatic image verification for the current copy operation. dir Displays a list of files on a file system. file verify auto Verifies the compressed Cisco IOS image checksum. pwd Displays the current setting of the cd command. show file systems Lists available file systems. show flash Displays the layout and contents of flash memory. vtp CF-1179 Cisco IOS Configuration Fundamentals Command Reference April 2010 vtp To configure the global VLAN Trunking Protocol (VTP) state, use the vtp command in global configuration mode. To return to the default value, use the no form of this command. vtp {{domain domain-name} | file filename | interface interface-name [only] | mode {client | off | server | transparent} | password password-value | pruning | version {1 | 2}} no vtp Syntax Description Defaults The defaults are as follows: • vtp domain and vtp interface commands have no default settings. • filename is const-nvram:vlan.dat. • VTP mode is mode server. • No password is configured. • Pruning is disabled. • Administrative-domain VTP-version number 1. Command Modes Global configuration (config) domain domain-name Sets the VTP-administrative domain name. file filename Sets the ASCII name of the IFS-file system file where the VTP configuration is stored. interface interface-name Sets the name of the preferred source for the VTP-updater ID for this device. only (Optional) Specifies to use only this interface’s IP address as the VTP-IP updater address. mode client Sets the type of VTP-device mode to client mode. mode off Sets the type of VTP-device mode to off mode. mode server Sets the type of VTP-device mode to server mode. mode transparent Sets the type of VTP-device mode to transparent mode. password password-value Specifies the administrative-domain password. pruning Enables the administrative domain to permit pruning. version {1 | 2} Specifies the administrative-domain VTP-version number. vtp CF-1180 Cisco IOS Configuration Fundamentals Command Reference April 2010 Command History Usage Guidelines Note The vtp pruning, vtp password, and vtp version commands are also available in privileged EXEC mode. We recommend that you use these commands in global configuration mode only; do not use these commands in privileged EXEC mode. Extended-range VLANs are not supported by VTP. When you define the domain-name value, the domain name is case sensitive and can be from 1 to 32 characters. The filename and interface-name values are ASCII strings from 1 to 255 characters. You must configure a password on each network device in the management domain when the switch is in secure mode. Caution If you configure VTP in secure mode, the management domain does not function properly if you do not assign a management domain password to each network device in the domain. A VTP version 2-capable network device can operate in the same VTP domain as a network device running VTP version 1 if VTP version 2 is disabled on the VTP version 2-capable network device (VTP version 2 is disabled by default). Do not enable VTP version 2 on a network device unless all of the network devices in the same VTP domain are version 2-capable. When you enable VTP version 2 on a network device, all of the version 2-capable network devices in the domain enable VTP version 2. In a Token Ring environment, you must enable VTP version 2 for VLAN switching to function properly. Enabling or disabling VTP pruning on a VTP server enables or disables VTP pruning for the entire management domain. Configuring VLANs as pruning eligible or pruning ineligible on a Cisco 7600 series router affects pruning eligibility for those VLANs on that switch only; it does not affect pruning eligibility on all network devices in the VTP domain. The vtp password, vtp pruning, and vtp version commands are not placed in startup memory but are included in the VTP transparent-mode startup configuration file. Extended-range VLANs are not supported by VTP. You can configure the pruning keyword in VTP-server mode; the version keyword is configurable in VTP-server mode or VTP transparent mode. The password-value argument is an ASCII string from 8 to 64 characters identifying the administrative domain for the device. Release Modification 12.2(14)SX This command was introduced on the Supervisor Engine 720. 12.2(17d)SXB Support for this command on the Supervisor Engine 2 was extended to Cisco IOS Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2(33)SXH The mode off keyword combination was added. vtp CF-1181 Cisco IOS Configuration Fundamentals Command Reference April 2010 VTP pruning causes information about each pruning-eligible VLAN to be removed from VTP updates if there are no stations belonging to that VLAN. All Cisco 7600 series routers in a VTP domain must run the same version of VTP. VTP version 1 and VTP version 2 do not operate on Cisco 7600 series routers in the same VTP domain. If all Cisco 7600 series routers in a domain are VTP version 2-capable, you need only to enable VTP version 2 on one Cisco 7600 series router; the version number is then propagated to the other version 2-capable Cisco 7600 series routers in the VTP domain. If you toggle the version 2 mode, certain default VLAN parameters are modified. If you enter the vtp mode off command, it sets the device to off. If you enter the no vtp mode off command, it resets the device to the VTP server mode. Examples This example shows how to set the device’s management domain: Router(config)# vtp domain DomainName1 This example shows how to specify the file in the IFS-file system where the VTP configuration is stored: Router(config)# vtp file vtpconfig Setting device to store VLAN database at filename vtpconfig. This example shows how to set the VTP mode to client: Router(config)# vtp mode client Setting device to VTP CLIENT mode. This example shows how to disable VTP mode globally: Router(config)# vtp mode off Setting device to VTP OFF mode. This example shows how to reset the device to the VTP server mode: Router(config)# no vtp mode off Setting device to VTP OFF mode. Related Commands Command Description show vtp Displays the VTP statistics and domain information. vtp (interface configuration) Enables VTP on a per-port basis. warm-reboot CF-1182 Cisco IOS Configuration Fundamentals Command Reference April 2010 warm-reboot To enable a router to do a warm-reboot, use the warm-reboot command in global configuration mode. To disable warm rebooting, use the no form of this command. warm-reboot [count number] [uptime minutes] no warm-reboot count number uptime minutes Syntax Description Defaults Warm rebooting is disabled. If warm rebooting is enabled, the default value for the count number option is 5 times, and the default value for the uptime minutes option is 5 minutes. Command Modes Global configuration Command History Usage Guidelines Use the warm-reboot command to enable the router to reload a Cisco IOS image without ROM monitor mode (ROMMON) intervention, in which the image restores read-write data from a previously saved copy in the RAM and starts execution from that point. Unlike a cold reboot, this process does not involve a flash to RAM copy or self-decompression of the image. Note After a warm reboot is enabled, it will not become active until after the next cold reboot because a warm reboot requires a copy of the initialized memory. Note If the system crashes before the image completes the warm reboot process, a cold reboot is initiated. count number (Optional) Maximum number of warm reboots allowed between any intervening cold reboot. Valid values range from 1 to 50. The default value is 5 times. uptime minutes (Optional) Minimum number of minutes that must elapse between initial system configuration and an exception before a warm reboot is attempted. If the system crashes before the specified time elapses, a warm reboot is not attempted. Valid values range from 0 to 120. The default value is 5 minutes. Release Modification 12.3(2)T This command was introduced. 12.2(18)S This command was integrated into Cisco IOS Release 12.2(18)S. 12.2(28)SB This command was integrated into Cisco IOS Relase 12.2(28)SB. warm-reboot CF-1183 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example shows how to enable a warm reboot on the router: Router#(config) warm-reboot count 10 uptime 10 Related Commands Command Description show warm-reboot Displays the statistics for attempted warm reboots. where CF-1184 Cisco IOS Configuration Fundamentals Command Reference April 2010 where To list the open sessions, use the where command in EXEC mode. where Syntax Description This command has no arguments or keywords. Command Modes EXEC Command History Usage Guidelines The where command displays all open sessions associated with the current terminal line. The break (Ctrl-Shift-6, x), where, and resume commands are available with all supported connection protocols. Examples The following is sample output from the where command: Router# where Conn Host Address Byte Idle Conn Name 1 MATHOM 192.31.7.21 0 0 MATHOM * 2 CHAFF 131.108.12.19 0 0 CHAFF The asterisk (*) indicates the current terminal session. Table 173 describes the fields shown in the display. Related Commands Release Modification 10.0 This command was introduced in a release prior to Cisco IOS Release 10.0. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Table 173 where Field Descriptions Field Description Conn Name or address of the remote host to which the connection is made. Host Remote host to which the router is connected through a Telnet session. Address IP address of the remote host. Byte Number of unread bytes for the user to see on the connection. Idle Interval (in minutes) since data was last sent on the line. Conn Name Assigned name of the connection. Command Description show line Displays information about all lines on the system or the specified line. show sessions Displays information about open LAT, Telnet, or rlogin connections. width CF-1185 Cisco IOS Configuration Fundamentals Command Reference April 2010 width To set the terminal screen width, use the width command in line configuration mode. To return to the default screen width, use the no form of this command. width characters no width Syntax Description Defaults 80 character columns Command Modes Line configuration Command History Usage Guidelines By default, the route provides a screen display width of 80 characters. You can reset this value for the current session if it does not meet the needs of your terminal. The rlogin protocol uses the value of the characters argument to set up terminal parameters on a remote host. Examples In the following example the location for line 7 is defined as “console terminal” and the display is set to 132 columns wide: Router(config)# line 7 Router(config-line)# location console terminal Router(config-line)# width 132 Related Commands characters Number of character columns displayed on the terminal. The default is 80 characters. Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Command Description terminal width Sets the number of character columns on the terminal screen for the current session. write core CF-1186 Cisco IOS Configuration Fundamentals Command Reference April 2010 write core To test the configuration of a core dump setup, use the write core command in privileged EXEC mode. write core [hostname [LINE] | destination-address [LINE]] Syntax Description Defaults If the hostname or destination arguments are not specified, the core dump file is written to the IP address or hostname specified by the exception dump command. If the LINE keyword is not specified, the name of the core dump file is assigned as the host name of the remote server followed by the word “-core.” Command Modes Privileged EXEC Command History Usage Guidelines When a router reloads, it is sometimes useful to obtain a full copy of the memory image (called a core dump) to identify the cause of the reload. Core dumps are generally useful to your technical support representative. Not all types of router reloads will produce a core dump. The write core command causes the router to generate a core dump without reloading, which may be useful if the router is malfunctioning but has not reloaded. The core dump files will be the size of the respective memory regions. It is important to remember that the entire memory region is dumped, not just the memory that is in use. Caution Use the write core command only under the direction of a technical support representative. Creating a core dump while the router is functioning in a network can disrupt network operation. When using this command, the router will not reload until the content of its memory is dumped. This event might take some time, depending on the amount of DRAM present on the router. Also, the resulting binary file, which is very large, must be transferred to a Trivial File Transfer Protocol (TFTP), File Transfer Protocol (FTP), or remote copy protocol (rcp) server and subsequently interpreted by technical personnel who have access to source code and detailed memory maps. Depending on your TFTP server, you might need to create an empty target file to which the router can write the core dump. hostname (Optional) Host name of the remote server where the core dump file is to be written. destination-address (Optional) IP address of the remote server where the core dump file is to be written. LINE (Optional) Assigns the name “LINE” to the core dump file. Release Modification 12.2(11)T This command was introduced. write core CF-1187 Cisco IOS Configuration Fundamentals Command Reference April 2010 Examples The following example shows how to test the configuration of a core dump setup. In this example, the core dump file is written to the remote server with the host name test. write core test write erase CF-1188 Cisco IOS Configuration Fundamentals Command Reference April 2010 write erase The write erase command is replaced by the erase nvram: command. See the description of the erase command for more information. write memory CF-1189 Cisco IOS Configuration Fundamentals Command Reference April 2010 write memory To save the running configuration to the nonvolatile random-access memory (NVRAM), use the write memory command in privileged EXEC mode. write memory Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC (#) Command History Usage Guidelines If you try to configure the write memory command when a router is low on memory and the backup buffer cannot be allocated, then the command will fail with the error message, “Not enough space.” When the write memory command fails to apply the new configuration, the backup configuration is used to restore the original configuration. Examples The following example shows how to save the running configuration to NVRAM: Router> enable Router# write memory Release Modification 12.2(11)T This command was introduced in a release earlier than Cisco IOS Release 12.2(11)T. 12.2(14)SX This command was integrated into a release earlier than Cisco IOS Release 12.2(14)SX. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. Cisco IOS XE Release 2.1 This command was integrated into Cisco IOS XE Release 2.1. write terminal CF-1190 Cisco IOS Configuration Fundamentals Command Reference April 2010 write terminal This command is deprecated. Deprecated commands are considered obsolete, and their use is discouraged. Support for this command may be removed. The write terminal command is now enabled only as a command alias for the show running-config command. The show running-config command offers additional options not available for the write terminal command; see the documentation of the show running-config command for details. Command Modes Privileged EXEC Command History Release Modification 8.0 This command was introduced in a release prior to 8.0. 11.0 The show running-config command was introduced as a replacement for the write terminal command. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. xmodem CF-1191 Cisco IOS Configuration Fundamentals Command Reference April 2010 xmodem To copy a Cisco IOS image to a router using the ROM monitor and the Xmodem or Ymodem protocol, use the xmodem command in ROM monitor mode. xmodem [-c] [-y] [-e] [-f] [-r] [-x] [-s data-rate] [filename] Syntax Description Defaults Xmodem protocol with 8-bit CRC, file downloaded into Flash memory and executed on completion. Command Modes ROM monitor Command History Usage Guidelines The Cisco 3600 series routers does not support XBOOT functionality. If your Cisco IOS image is erased or damaged, you cannot load a new image over the network. Use the xmodem ROM monitor command to download a new system image to your router from a local personal computer (such as a PC, Mac, or UNIX workstation), or a remote computer over a modem connection, to the router’s console port. The computer must have a terminal emulation application that supports these protocols. -c (Optional) CRC-16 checksumming, which is more sophisticated and thorough than standard checksumming. -y (Optional) Uses the Ymodem protocol for higher throughput. -e (Optional) Erases the first partition in Flash memory before starting the download. This option is only valid for the Cisco 1600 series. -f (Optional) Erases all of Flash memory before starting the download. This option is only valid for the Cisco 1600 series. -r (Optional) Downloads the file to DRAM. The default is Flash memory. -x (Optional) Do not execute Cisco IOS image on completion of the download. -s data-rate (Optional) Sets the console port’s data rate during file transfer. Values are 1200, 2400, 4800, 9600, 19200, 38400, and 115200 bps. The default rate is specified in the configuration register. This option is only valid for the Cisco 1600 series. filename (Optional) Filename to copy. This argument is ignored when the -r keyword is specified, because only one file can be copied to DRAM. On the Cisco 1600 series routers, files are loaded to the ROM for execution. Release Modification 11.2 P This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. xmodem CF-1192 Cisco IOS Configuration Fundamentals Command Reference April 2010 Cisco 3600 Series Routers Your router must have enough DRAM to hold the file being transferred, even if you are copying to Flash memory. The image is copied to the first file in internal Flash memory. Any existing files in Flash memory are erased. There is no support for partitions or copying as a second file. Cisco 1600 Series Routers If you include the -r option, your router must have enough DRAM to hold the file being transferred. To run from Flash, an image must be positioned as the first file in Flash memory. If you are copying a new image to boot from Flash, erase all existing files first. Caution A modem connection from the telephone network to your console port introduces security issues that you should consider before enabling the connection. For example, remote users can dial in to your modem and access the router’s configuration settings. Note If the file to be downloaded is not a valid router image, the copy operation is automatically terminated. Examples The following example uses the xmodem -c filename ROM monitor command to copy the file named new-ios-image from a remote or local computer: rommon > xmodem -c new-ios-image Do not start the sending program yet... File size Checksum File name 1738244 bytes (0x1a8604) 0xdd25 george-admin/c3600-i-mz WARNING: All existing data in bootflash will be lost! Invoke this application only for disaster recovery. Do you wish to continue? y/n [n]: yes Ready to receive file new-ios-image ... Related Commands Command Description copy xmodem: Copies a Cisco IOS image from a local or remote computer (such as a PC, Macintosh, or UNIX workstation) to Flash memory on a Cisco 3600 series router using the Xmodem protocol. copy ymodem: Copies a Cisco IOS image from a local or remote computer (such as a PC, Macintosh, or UNIX workstation) to Flash memory on a Cisco 3600 series router using the Ymodem protocol. CF-1193 Cisco IOS Configuration Fundamentals Command Reference April 2010 ASCII Character Set and Hexadecimal Values Some commands described in the Cisco IOS documentation set, such as the escape-character line configuration command, require that you enter the decimal representation of an ASCII character. Other commands occasionally make use of hexadecimal (hex) representations. Table 174 provides character code translations from the decimal numbers to their hexadecimal and ASCII equivalents. It also provides the keyword entry for each ASCII character. For example, the ASCII carriage return (CR) is decimal 13. Entering Ctrl-M at your terminal generates decimal 13, which is interpreted as a CR. Note This document is a reference for only the standard ASCII character set. Extended ASCII character sets are not generally recommended for use in Cisco IOS commands. Extended ASCII character set references are widely available on the internet. Table 174 ASCII Translation Table Numeric Values ASCII Decimal Hex Character Meaning Keyboard Entry 0 00 NUL Null Ctrl-@ 1 01 SOH Start of heading Ctrl-A 2 02 STX Start of text Ctrl-B 3 03 ETX Break/end of text Ctrl-C 4 04 EOT End of transmission Ctrl-D 5 05 ENQ Enquiry Ctrl-E 6 06 ACK Positive acknowledgment Ctrl-F 7 07 BEL Bell Ctrl-G 8 08 BS Backspace Ctrl-H 9 09 HT Horizontal tab Ctrl-I 10 0A LF Line feed Ctrl-J 11 0B VT Vertical tab Ctrl-K 12 0C FF Form feed Ctrl-L ASCII Character Set and Hexadecimal Values CF-1194 Cisco IOS Configuration Fundamentals Command Reference April 2010 13 0D CR Carriage return (in the CLI, equivalent to the Enter or Return key) Ctrl-M 14 0E SO Shift out Ctrl-N 15 0F SI Shift in/XON (resume output) Ctrl-O 16 10 DLE Data link escape Ctrl-P 17 11 DC1 Device control character 1 Ctrl-Q 18 12 DC2 Device control character 2 Ctrl-R 19 13 DC3 Device control character 3 Ctrl-S 20 14 DC4 Device control character 4 Ctrl-T 21 15 NAK Negative acknowledgment Ctrl-U 22 16 SYN Synchronous idle Ctrl-V 23 17 ETB End of transmission block Ctrl-W 24 18 CAN Cancel Ctrl-X 25 19 EM End of medium Ctrl-Y 26 1A SUB Substitute/end of file Ctrl-Z 27 1B ESC Escape Ctrl-[ 28 1C FS File separator Ctrl-\ 29 1D GS Group separator Ctrl-] 30 1E RS Record separator Ctrl-^ 31 1F US Unit separator Ctrl-_ 32 20 SP Space Space 33 21 ! ! ! 34 22 " " " 35 23 # # # 36 24 $ $ $ 37 25 % % % 38 26 & & & 39 27 ’ ’ ’ 40 28 ( ( ( 41 29 ) ) ) 42 2A * * * 43 2B + + + 44 2C , , , 45 2D - - - Table 174 ASCII Translation Table (continued) Numeric Values ASCII Decimal Hex Character Meaning Keyboard Entry ASCII Character Set and Hexadecimal Values CF-1195 Cisco IOS Configuration Fundamentals Command Reference April 2010 46 2E . . . 47 2F / / / 48 30 0 Zero 0 49 31 1 One 1 50 32 2 Two 2 51 33 3 Three 3 52 34 4 Four 4 53 35 5 Five 5 54 36 6 Six 6 55 37 7 Seven 7 56 38 8 Eight 8 57 39 9 Nine 9 58 3A : : : 59 3B ; ; ; 60 3C < < < 61 3D = = = 62 3E > > > 63 3F ? ? ? 64 40 @ @ @ 65 41 A A A 66 42 B B B 67 43 C C C 68 44 D D D 69 45 E E E 70 46 F F F 71 47 G G G 72 48 H H H 73 49 I I I 74 4A J J J 75 4B K K K 76 4C L L L 77 4D M M M 78 4E N N N 79 4F O O O 80 50 P P P Table 174 ASCII Translation Table (continued) Numeric Values ASCII Decimal Hex Character Meaning Keyboard Entry ASCII Character Set and Hexadecimal Values CF-1196 Cisco IOS Configuration Fundamentals Command Reference April 2010 81 51 Q Q Q 82 52 R R R 83 53 S S S 84 54 T T T 85 55 U U U 86 56 V V V 87 57 W W W 88 58 X X X 89 59 Y Y Y 90 5A Z Z Z 91 5B [ [ [ 92 5C \ \ \ 93 5D ] ] ] 94 5E ^ ^ ^ 95 5F _ _ _ 96 60 ` ` ` 97 61 a a a 98 62 b b b 99 63 c c c 100 64 d d d 101 65 e e e 102 66 f f f 103 67 g g g 104 68 h h h 105 69 i i i 106 6A j j j 107 6B k k k 108 6C l l l 109 6D m m m 110 6E n n n 111 6F o o o 112 70 p p p 113 71 q q q 114 72 r r r 115 73 s s s Table 174 ASCII Translation Table (continued) Numeric Values ASCII Decimal Hex Character Meaning Keyboard Entry ASCII Character Set and Hexadecimal Values CF-1197 Cisco IOS Configuration Fundamentals Command Reference April 2010 116 74 t t t 117 75 u u u 118 76 v v v 119 77 w w w 120 78 x x x 121 79 y y y 122 7A z z z 123 7B { { { 124 7C | | | 125 7D } } } 126 7E ~ Tilde ~ 127 7F DEL Delete Del Table 174 ASCII Translation Table (continued) Numeric Values ASCII Decimal Hex Character Meaning Keyboard Entry ASCII Character Set and Hexadecimal Values CF-1198 Cisco IOS Configuration Fundamentals Command Reference April 2010 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 User Guide for the Cisco Application Networking Manager 5.2 February 2012 Text Part Number: OL-26572-01 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R) Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental. User Guide for the Cisco Application Networking Manager 5.2 © 2011 Cisco Systems, Inc. All rights reserved. iii User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 CONTENTS Preface ix Audience ix Organization ix Conventions xi Open-Source Software Included in the Cisco Application Networking Manager xi Obtaining Documentation and Submitting a Service Request xii CHAPTER 1 Overview 1-1 ANM Overview 1-1 IPv6 Considerations 1-3 Logging In To the Cisco Application Networking Manager 1-5 Changing Your Account Password 1-6 ANM Licenses 1-7 ANM Interface Components 1-8 ANM Windows and Menus 1-9 ANM Buttons 1-11 Table Conventions 1-14 Filtering Entries 1-14 Customizing Tables 1-15 Using the Advanced Editing Option 1-16 ANM Screen Conventions 1-17 CHAPTER 2 Using Homepage 2-1 Information About Homepage 2-1 Customizing the Default ANM Page 2-4 CHAPTER 3 Using ANM Guided Setup 3-1 Information About Guided Setup 3-1 Guidelines and Limitations 3-4 Using Import Devices 3-4 Using ACE Hardware Setup 3-5 Using Virtual Context Setup 3-10 Using Application Setup 3-12 Contents iv User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 ACE Network Topology Overview 3-12 Using Application Setup 3-14 CHAPTER 4 Using Application Template Definitions 4-1 Information About Application Template Definitions and Instances 4-1 Managing Application Template Instances 4-3 Creating an Application Template Instance 4-4 Deploying a Staged Application Template Instance 4-7 Editing an Application Template Instance 4-9 Duplicating an Application Template Instance 4-10 Viewing and Editing Application Template Instance Details 4-12 Deleting an Application Template Instance 4-13 Managing Application Template Definitions 4-15 Editing an Application Template Definition 4-15 Editing an Application Template Definition Using the ANM Template Editor 4-18 Editing an Application Template Definition Using an External Editor 4-19 Creating an Application Template Definition 4-20 Creating an Application Template Definition Using the ANM Template Editor 4-21 Creating an Application Template Definition Using an External XML Editor 4-23 Exporting an Application Template Definition 4-26 Importing an Application Template Definition 4-26 Testing an Application Template Definition 4-28 Deleting an Application Template Definition 4-29 Using the ANM Template Editor 4-29 CHAPTER 5 Importing and Managing Devices 5-1 Information About Device Management 5-2 Information About Importing Devices 5-4 Preparing Devices for Import 5-4 Enabling SSH or Telnet Access on Catalyst 6500 Series Switches and Cisco 7600 Series Routers 5-5 Enabling SSH Access and the HTTPS Interface on the ACE Module and Appliance 5-6 Enabling SNMP Polling from ANM 5-7 ANM Requirements for ACE High Availability 5-8 Modifying the ANM Timeout Setting to Compensate for Network Latency 5-9 Importing Network Devices into ANM 5-10 Importing Cisco IOS Host Chassis and Chassis Modules 5-11 Importing Cisco IOS Devices with Installed Modules 5-12 Importing ACE Modules after the Host Chassis has been Imported 5-16 Importing CSM Devices after the Host Chassis has been Imported 5-19 Contents v User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Importing VSS 1440 Devices after the Host Chassis has been Imported 5-20 Importing ACE Appliances 5-21 Importing CSS Devices 5-22 Importing GSS Devices 5-23 Importing VMware vCenter Servers 5-24 Enabling a Setup Syslog for Autosync for Use With an ACE 5-27 Discovering Large Numbers of Devices Using IP Discovery 5-27 Preparing Devices for IP Discovery 5-28 Configuring Device Access Credentials 5-29 Modifying Credential Pools 5-30 Running IP Discovery to Identify Devices 5-31 Monitoring IP Discovery Status 5-33 Configuring Devices 5-34 Configuring Device System Attributes 5-34 Configuring CSM Primary Attributes 5-34 Configuring CSS Primary Attributes 5-35 Configuring GSS Primary Attributes 5-36 Configuring Catalyst 6500 VSS 1440 Primary Attributes 5-38 Configuring Catalyst 6500 Series Chassis and Cisco 7600 Series Router Primary Attributes 5-38 Configuring Catalyst 6500 Series Chassis, Catalyst 6500 Virtual Switching System 1440 Devices, and Cisco 7600 Series Routers Static Routes 5-39 Configuring VMware vCenter Server Primary Attributes 5-41 Configuring Catalyst 6500 Series Chassis or Cisco 7600 Series Router Interfaces 5-41 Displaying Chassis Interfaces and Configuring High-Level Interface Attributes 5-42 Configuring Access Ports 5-43 Configuring Trunk Ports 5-44 Configuring Switch Virtual Interfaces 5-45 Configuring Routed Ports 5-46 Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs 5-48 Adding Device VLANs 5-48 Displaying All Device VLANs 5-49 Configuring Device Layer 2 VLANs 5-50 Configuring Device Layer 3 VLANs 5-51 Modifying Device VLANs 5-51 Creating VLAN Groups 5-52 Configuring ACE Module and Appliance Role-Based Access Controls 5-53 Configuring Device RBAC Users 5-53 Guidelines for Managing Users 5-53 Displaying a List of Device Users 5-54 Configuring Device User Accounts 5-54 Contents vi User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Modifying Device User Accounts 5-55 Deleting Device User Accounts 5-56 Configuring Device RBAC Roles 5-56 Guidelines for Managing User Roles 5-57 Role Mapping in Device RBAC 5-57 Configuring Device User Roles 5-58 Modifying Device User Roles 5-60 Deleting Device User Roles 5-60 Adding, Editing, or Deleting Rules 5-61 Configuring Device RBAC Domains 5-61 Guidelines for Managing Domains 5-62 Displaying Domains for a Device 5-62 Configuring Device Domains 5-63 Modifying Device Domains 5-65 Deleting Device Domains 5-65 Managing Devices 5-66 Synchronizing Device Configurations 5-66 Synchronizing Chassis Configurations 5-67 Synchronizing Module Configurations 5-67 Mapping Real Servers to VMware Virtual Machines 5-68 Instructing ANM to Recognize an ACE Module Software Upgrade 5-71 Configuring User-Defined Groups 5-72 Adding a User-Defined Group 5-72 Modifying a User-Defined Group 5-73 Duplicating a User-Defined Group 5-74 Deleting a User-Defined Group 5-75 Changing Device Credentials 5-75 Changing ACE Module Passwords 5-77 Restarting Device Polling 5-78 Displaying All Devices 5-78 Displaying Modules by Chassis 5-79 Removing Modules from the ANM Database 5-80 Replacing an ACE Module Managed by ANM 5-82 Using the Preferred Method to Replace an ACE Module 5-82 Using the Alternate Method to Replace an ACE Module 5-84 CHAPTER 6 Configuring Virtual Contexts 6-1 Information About Virtual Contexts 6-2 Creating Virtual Contexts 6-2 Contents vii User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Configuring Virtual Contexts 6-8 Configuring Virtual Context System Attributes 6-13 Configuring Virtual Context Primary Attributes 6-14 Configuring Virtual Context Syslog Settings 6-19 Configuring Syslog Log Hosts 6-23 Configuring Syslog Log Messages 6-24 Configuring Syslog Log Rate Limits 6-26 Configuring SNMP for Virtual Contexts 6-27 Configuring Basic SNMP Attributes 6-27 Configuring SNMPv2c Communities 6-28 Configuring SNMPv3 Users 6-29 Configuring SNMP Trap Destination Hosts 6-32 Configuring SNMP Notification 6-33 Applying a Policy Map Globally to All VLAN Interfaces 6-35 Managing ACE Licenses 6-36 Viewing ACE Licenses 6-36 Installing ACE Licenses 6-37 Uninstalling ACE Licenses 6-39 Updating ACE Licenses 6-40 Displaying the File Contents of a License 6-42 Using Resource Classes 6-43 Global and Local Resource Classes 6-44 Resource Allocation Constraints 6-44 Using Global Resource Classes 6-46 Configuring Global Resource Classes 6-46 Deploying Global Resource Classes 6-48 Auditing Resource Classes 6-49 Modifying Global Resource Classes 6-50 Deleting Global Resource Classes 6-51 Using Local Resource Classes 6-51 Configuring Local Resource Classes 6-52 Deleting Local Resource Classes 6-53 Displaying Local Resource Class Use on Virtual Contexts 6-54 Using the Configuration Checkpoint and Rollback Service 6-54 Creating a Configuration Checkpoint 6-55 Deleting a Configuration Checkpoint 6-56 Rolling Back a Running Configuration 6-56 Displaying Checkpoint Information 6-57 Comparing a Checkpoint to the Running Configuration 6-58 Contents viii User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Performing Device Backup and Restore Functions 6-59 Backing Up Device Configuration and Dependencies 6-62 Restoring Device Configuration and Dependencies 6-66 Performing Global Device Backup and Copy Functions 6-68 Backing Up Multiple Device Configuration and SSL Files 6-69 Associating a Global Backup Schedule with a Device 6-71 Managing Global Backup Schedules 6-73 Creating a Backup Schedule 6-73 Updating an Existing Backup Schedule 6-76 Deleting a Backup Schedule 6-76 Copying Existing Tarred Backup Files to a Remote Server 6-77 Configuring Security with ACLs 6-78 Creating ACLs 6-79 Setting Extended ACL Attributes 6-82 Resequencing Extended ACLs 6-87 Setting EtherType ACL Attributes 6-87 Displaying ACL Information and Statistics 6-89 Configuring Object Groups 6-89 Creating or Editing an Object Group 6-90 Configuring IP Addresses for Object Groups 6-91 Configuring Subnet Objects for Object Groups 6-92 Configuring Protocols for Object Groups 6-93 Configuring TCP/UDP Service Parameters for Object Groups 6-94 Configuring ICMP Service Parameters for an Object Group 6-97 Managing ACLs 6-99 Viewing All ACLs by Context 6-99 Editing or Deleting ACLs 6-100 Configuring Virtual Context Expert Options 6-101 Comparing Context and Building Block Configurations 6-101 Managing Virtual Contexts 6-103 Displaying All Virtual Contexts 6-103 Synchronizing Virtual Context Configurations 6-105 Managing Syslog Settings for Autosynchronization 6-105 Editing Virtual Contexts 6-106 Deleting Virtual Contexts 6-107 Upgrading Virtual Contexts 6-107 Restarting Virtual Context Polling 6-108 Contents ix User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 CHAPTER 7 Configuring Virtual Servers 7-1 Information About Load Balancing 7-1 Configuring Virtual Servers 7-2 Virtual Server Configuration and ANM 7-2 Information About Using ANM to Configure Virtual Servers 7-4 Virtual Server Usage Guidelines 7-5 Virtual Server Testing and Troubleshooting 7-6 Virtual Server Configuration Procedure 7-7 Shared Objects and Virtual Servers 7-9 Virtual Server Protocols by Device Type 7-11 Configuring Virtual Server Properties 7-11 Configuring Virtual Server SSL Termination 7-17 Configuring Virtual Server Protocol Inspection 7-18 Configuring Virtual Server Layer 7 Load Balancing 7-30 Configuring Virtual Server Default Layer 7 Load Balancing 7-50 Configuring Application Acceleration and Optimization 7-53 Configuring Virtual Server NAT 7-63 Displaying Virtual Servers by Context 7-65 Displaying Virtual Server Statistics and Status Information 7-65 Managing Virtual Servers 7-66 Managing Virtual Server Groups 7-67 Creating a Virtual Server Group 7-68 Editing or Copying a Virtual Server Group 7-69 Displaying a Virtual Server Group 7-70 Deleting a Virtual Server Group 7-70 Activating Virtual Servers 7-71 Suspending Virtual Servers 7-72 Managing GSS VIP Answers 7-73 Activating and Suspending DNS Rules Governing GSS Load Balancing 7-75 Managing GSS VIP Answer and DNS Rule Groups 7-76 Creating a VIP Answer or DNS Rule Group 7-77 Editing or Copying a VIP Answer or DNS Rule Group 7-78 Displaying a VIP Answer or DNS Rule Group 7-79 Deleting a VIP Answer or DNS Rule Group 7-80 Displaying Detailed Virtual Server Information 7-81 Displaying Virtual Servers 7-81 Using the Virtual Server Connection Statistics Graph 7-84 Using the Virtual Server Topology Map 7-85 Understanding CLI Commands Sent from Virtual Server Table 7-86 Contents x User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Deploying Virtual Servers 7-86 Deploying a Virtual Server 7-87 Displaying All Staged Virtual Servers 7-87 Modifying Deployed Virtual Servers 7-88 Modifying Staged Virtual Servers 7-88 CHAPTER 8 Configuring Real Servers and Server Farms 8-1 Information About Server Load Balancing 8-1 Load-Balancing Predictors 8-2 Real Servers 8-3 Dynamic Workload Scaling Overview 8-4 Server Farms 8-5 Configuring Real Servers 8-5 Configuring Load Balancing on Real Servers 8-6 Displaying Real Server Statistics and Status Information 8-9 Managing Real Servers 8-9 Managing Real Server Groups 8-10 Creating a Real Server Group 8-11 Editing or Copying a Real Server Group 8-12 Displaying a Real Server Group 8-13 Deleting a Real Server Group 8-13 Activating Real Servers 8-14 Suspending Real Servers 8-15 Modifying Real Server Weight Value 8-17 Displaying Real Servers 8-18 Using the Real Server Connection Statistics Graph 8-22 Using the Real Server Topology Map 8-23 CLI Commands Sent from the Real Server Table 8-23 Server Weight Ranges 8-25 Configuring Dynamic Workload Scaling 8-26 Configuring and Verifying a Cisco Nexus 7000 Series Switch Connection 8-27 Configuring and Verifying a VM Controller Connection 8-29 Configuring Server Farms 8-30 Configuring Load Balancing Using Server Farms 8-31 Adding Real Servers to a Server Farm 8-37 Configuring the Predictor Method for Server Farms 8-39 Configuring Server Farm HTTP Return Error-Code Checking 8-46 Displaying All Server Farms 8-48 Displaying Server Farm Statistics and Status Information 8-48 Contents xi User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Configuring Health Monitoring 8-49 TCL Scripts 8-50 Configuring Health Monitoring for Real Servers 8-51 Configuring Probe Attributes 8-56 DNS Probe Attributes 8-57 Echo-TCP Probe Attributes 8-58 Echo-UDP Probe Attributes 8-58 Finger Probe Attributes 8-58 FTP Probe Attributes 8-59 HTTP Probe Attributes 8-60 HTTPS Probe Attributes 8-61 IMAP Probe Attributes 8-63 POP Probe Attributes 8-64 RADIUS Probe Attributes 8-65 RTSP Probe Attributes 8-65 Scripted Probe Attributes 8-66 SIP-TCP Probe Attributes 8-67 SIP-UDP Probe Attributes 8-68 SMTP Probe Attributes 8-69 SNMP Probe Attributes 8-69 TCP Probe Attributes 8-70 Telnet Probe Attributes 8-70 UDP Probe Attributes 8-71 VM Probe Attributes 8-72 Configuring DNS Probe Expect Addresses 8-73 Configuring Headers for HTTP and HTTPS Probes 8-74 Configuring Health Monitoring Expect Status 8-74 Configuring an OID for SNMP Probes 8-76 Displaying Health Monitoring Statistics and Status Information 8-77 Configuring Secure KAL-AP 8-77 CHAPTER 9 Configuring Stickiness 9-1 Information About Stickiness 9-1 Sticky Types 9-2 HTTP Content Stickiness 9-3 HTTP Cookie Stickiness 9-3 HTTP Header Stickiness 9-4 IP Netmask and IPv6 Prefix Stickiness 9-4 Layer 4 Payload Stickiness 9-4 Contents xii User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 RADIUS Stickiness 9-5 RTSP Header Stickiness 9-5 SIP Header Stickiness 9-5 Sticky Groups 9-6 Sticky Table 9-6 Configuring Sticky Groups 9-7 Sticky Group Attribute Tables 9-11 HTTP Content Sticky Group Attributes 9-11 HTTP Cookie Sticky Group Attributes 9-12 HTTP Header Sticky Group Attributes 9-13 IP Netmask Sticky Group Attributes 9-13 V6 Prefix Sticky Group Attributes 9-13 Layer 4 Payload Sticky Group Attributes 9-14 RADIUS Sticky Group Attributes 9-14 RTSP Header Sticky Group Attributes 9-15 Displaying All Sticky Groups by Context 9-15 Configuring Sticky Statics 9-15 CHAPTER 10 Configuring Parameter Maps 10-1 Information About Parameter Maps 10-1 Configuring Connection Parameter Maps 10-3 Configuring Generic Parameter Maps 10-8 Configuring HTTP Parameter Maps 10-9 Configuring Optimization Parameter Maps 10-12 Configuring RTSP Parameter Maps 10-20 Configuring SIP Parameter Maps 10-21 Configuring Skinny Parameter Maps 10-23 Configuring DNS Parameter Maps 10-25 Supported MIME Types 10-26 CHAPTER 11 Configuring SSL 11-1 SSL Overview 11-2 SSL Configuration Prerequisites 11-2 Summary of SSL Configuration Tasks 11-3 SSL Setup Sequence 11-4 Using SSL Certificates 11-5 Importing SSL Certificates 11-7 Contents xiii User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Using SSL Keys 11-10 Importing SSL Key Pairs 11-11 Generating SSL Key Pairs 11-14 Exporting SSL Certificates 11-15 Exporting SSL Key Pairs 11-16 Configuring SSL Parameter Maps 11-18 Configuring SSL Chain Group Parameters 11-23 Configuring SSL CSR Parameters 11-24 Generating CSRs 11-26 Configuring SSL Proxy Service 11-27 Configuring SSL OCSP Service 11-29 Enabling Client Authentication 11-31 Configuring SSL Authentication Groups 11-31 Configuring CRLs for Client Authentication 11-33 CHAPTER 12 Configuring Network Access 12-1 Information About VLANs 12-2 ACE Module VLANs 12-2 ACE Appliance VLANs 12-2 Configuring VLANs Using Cisco IOS Software (ACE Module) 12-3 Creating VLAN Groups Using Cisco IOS Software 12-3 Assigning VLAN Groups to the ACE Module Through Cisco IOS Software 12-4 Adding Switched Virtual Interfaces to the MSFC 12-5 Configuring Virtual Context VLAN Interfaces 12-6 Displaying All VLAN Interfaces 12-18 Displaying VLAN Interface Statistics and Status Information 12-18 Configuring Virtual Context BVI Interfaces 12-19 Configuring BVI Interfaces for a Virtual Context 12-19 Displaying All BVI Interfaces by Context 12-25 Displaying BVI Interface Statistics and Status Information 12-26 Configuring VLAN Interface NAT Pools 12-26 Configuring Virtual Context Static Routes 12-28 Configuring Global IP DHCP 12-29 Configuring Static VLANs for Over 8000 Static NAT Configurations 12-31 Configuring Gigabit Ethernet Interfaces on the ACE Appliance 12-32 Configuring Gigabit Ethernet Interfaces 12-32 Displaying Gigabit Ethernet Interface Statistics and Status Information 12-35 Configuring Port-Channel Interfaces for the ACE Appliance 12-35 Contents xiv User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Why Use Port Channels? 12-35 Configuring a Port-Channel Interface 12-36 Configuring a Catalyst 6500 Series Switch for an ACE Appliance Port-Channel Interface Connection 12-38 Creating the Port Channel Interface on the Catalyst 6500 12-38 Adding Interfaces to the Port Channel 12-39 Displaying Port Channel Interface Statistics and Status Information 12-40 CHAPTER 13 Configuring High Availability 13-1 Understanding ANM High Availability 13-2 Understanding ANM High Availability Processes 13-3 Configuring ANM High Availability Overview 13-3 CLI Commands for ANM High Availability Processes 13-4 Recovering From an HA Database Replication Failure 13-6 Understanding ACE Redundancy 13-6 ACE High Availability Polling 13-7 ACE Redundancy Protocol 13-8 ACE Stateful Failover 13-9 ACE Fault-Tolerant VLAN 13-10 ACE Configuration Synchronization 13-11 ACE Redundancy Configuration Requirements and Restrictions 13-12 ACE High Availability Troubleshooting Guidelines 13-12 Configuring ACE High Availability 13-14 Configuring ACE High Availability Peers 13-15 Clearing ACE High Availability Pairs 13-17 Configuring ACE High Availability Groups 13-17 Editing High Availability Groups 13-19 Taking a High Availability Group Out of Service 13-20 Enabling a High Availability Group 13-21 Displaying High Availability Group Statistics and Status 13-21 Switching Over an ACE High Availability Group 13-22 Deleting ACE High Availability Groups 13-23 ACE High Availability Tracking and Failure Detection Overview 13-23 Tracking ACE VLAN Interfaces for High Availability 13-24 Tracking Hosts for High Availability 13-25 Configuring Host Tracking Probes 13-26 Deleting Host Tracking Probes 13-27 Configuring ACE Peer Host Tracking Probes 13-28 Contents xv User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Deleting Peer Host Tracking Probes 13-29 Configuring ACE HSRP Groups 13-29 Synchronizing ACE High Availability Configurations 13-30 Synchronizing Virtual Context Configurations in High Availability Mode 13-31 Synchronizing SSL Certificate and Key Pairs on Both ACE Peers 13-32 CHAPTER 14 Configuring Traffic Policies 14-1 Traffic Policy Overview 14-1 Class Map and Policy Map Overview 14-2 Class Maps 14-3 Policy Maps 14-4 Parameter Maps and Their Use in Layer 3 and Layer 4 Policy Maps 14-5 Protocol Inspection Overview 14-6 Configuring Virtual Context Class Maps 14-6 Deleting Class Maps 14-8 Setting Match Conditions for Class Maps 14-8 Setting Match Conditions for Layer 3/Layer 4 Network Traffic Class Maps 14-9 Setting Match Conditions for Layer 3/Layer 4 Management Traffic Class Maps 14-12 Setting Match Conditions for Layer 7 Server Load Balancing Class Maps 14-14 Setting Match Conditions for Layer 7 HTTP Deep Packet Inspection Class Maps 14-17 Setting Match Conditions for Layer 7 FTP Command Inspection Class Maps 14-22 Setting Match Conditions for Generic Server Load Balancing Class Maps 14-23 Setting Match Conditions for RADIUS Server Load Balancing Class Maps 14-25 Setting Match Conditions for RTSP Server Load Balancing Class Maps 14-26 Setting Match Conditions for SIP Server Load Balancing Class Maps 14-27 Setting Match Conditions for Layer 7 SIP Deep Packet Inspection Class Maps 14-30 Configuring Virtual Context Policy Maps 14-32 Configuring Rules and Actions for Policy Maps 14-34 Setting Policy Map Rules and Actions for Generic Server Load Balancing 14-35 Setting Policy Map Rules and Actions for Layer 3/Layer 4 Management Traffic 14-39 Setting Policy Map Rules and Actions for Layer 3/Layer 4 Network Traffic 14-41 Setting Policy Map Rules and Actions for Layer 7 FTP Command Inspection 14-48 Setting Policy Map Rules and Actions for Layer 7 HTTP Deep Packet Inspection 14-51 Setting Policy Map Rules and Actions for Layer 7 HTTP Optimization 14-57 Setting Policy Map Rules and Actions for Layer 7 Server Load-Balancing Traffic 14-61 Setting Policy Map Rules and Actions for Layer 7 SIP Deep Packet Inspection 14-68 Setting Policy Map Rules and Actions for Layer 7 Skinny Deep Packet Inspection 14-71 Setting Policy Map Rules and Actions for RADIUS Server Load Balancing 14-73 Setting Policy Map Rules and Actions for RDP Server Load Balancing 14-75 Contents xvi User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Setting Policy Map Rules and Actions for RTSP Server Load Balancing 14-76 Setting Policy Map Rules and Actions for SIP Server Load Balancing 14-79 Special Characters for Matching String Expressions 14-84 Configuring Actions Lists 14-85 Configuring an HTTP Header Modify Action List 14-85 Configuring HTTP Header Insertion, Deletion, and Rewrite 14-85 Configuring SSL URL Rewrite 14-88 Configuring SSL Header Insertion 14-89 CHAPTER 15 Configuring Application Acceleration and Optimization 15-1 Optimization Overview 15-2 Optimization Traffic Policies and Typical Configuration Flow 15-2 Configuring an HTTP Optimization Action List 15-3 Configuring Optimization Parameter Maps 15-6 Configuring Traffic Policies for HTTP Optimization 15-6 Enabling HTTP Optimization Using Virtual Servers 15-9 Configuring Global Application Acceleration and Optimization 15-9 CHAPTER 16 Using Configuration Building Blocks 16-1 Information About Building Block Versions and Tagging 16-4 Enabling the Building Block Feature 16-5 Creating Building Blocks 16-5 Extracting Building Blocks from Virtual Contexts 16-6 Configuring Building Blocks 16-7 Configuring Building Block Primary Attributes 16-8 Tagging Building Blocks 16-9 Applying Building Blocks 16-9 Applying a Building Block to a Single Virtual Context 16-10 Applying a Building Block to Multiple Virtual Contexts 16-10 Displaying Building Block Use 16-11 CHAPTER 17 Monitoring Your Network 17-1 Setting Up Devices for Monitoring 17-2 Device Monitoring Features 17-3 Using Dashboards to Monitor Devices and Virtual Contexts 17-4 ACE Dashboard 17-5 Device Information Table 17-6 Contents xvii User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 License Status Table 17-6 High Availability Table 17-7 ACE Device Configuration Summary Table 17-7 Context With Denied Resource Usage Detected Table 17-8 Device Resource Usage Graph 17-9 Top 10 Current Resources Table 17-10 Control Plane CPU/Memory Graphs 17-11 ACE Virtual Context Dashboard 17-12 ACE Virtual Context Device Configuration Summary Table 17-13 Context With Denied Resource Usage Detected Table 17-14 Context Resource Usage Graph 17-15 Load Balancing Servers Performance Graphs 17-15 ANM Group Dashboard 17-16 Managed Devices Table 17-17 Context With Denied Resource Usage Detected Table 17-18 ANM Group Device Configuration Summary Table 17-18 Top 10 Current Resources Table 17-20 Latest 5 Alarms Notifications Table 17-21 Latest 5 Critical Events Table 17-21 Contexts Performance Overview Graph 17-22 Monitoring Device Groups 17-23 Monitoring Devices 17-24 Monitoring the System 17-25 Monitoring Resource Usage 17-26 Monitoring Virtual Context Resource Usage 17-26 Monitoring System Traffic Resource Usage 17-27 Monitoring System Non-Connection Based Resource Usage 17-29 Monitoring Traffic 17-30 Displaying Device-Specific Traffic Data 17-31 Monitoring Load Balancing 17-33 Monitoring Load Balancing on Virtual Servers 17-33 Monitoring Load Balancing on Real Servers 17-37 Monitoring Load Balancing on Probes 17-40 Monitoring Load Balancing Statistics 17-41 Monitoring Application Acceleration 17-43 Displaying the Polling Status of All Managed Objects 17-44 Setting Polling Parameters 17-46 Enabling Polling on Specific Devices 17-46 Disabling Polling on Specific Devices 17-47 Contents xviii User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Enabling Polling on All Devices 17-47 Disabling Polling on All Devices 17-48 Configuring Historical Trend and Real Time Graphs for Devices 17-48 Exporting Historical Data 17-52 Monitoring Events 17-55 Configuring Alarm Notifications on ANM 17-57 Displaying Alarm Notifications 17-65 Displaying Alarms in ANM 17-65 Displaying Email Notifications 17-66 Displaying Traps 17-67 Configuring SMTP for Email Notifications 17-68 Displaying Network Topology Maps 17-68 Testing Connectivity 17-71 CHAPTER 18 Administering the Cisco Application Networking Manager 18-1 Overview of the Admin Function 18-2 Controlling Access to Cisco ANM 18-3 Types of Users 18-5 Understanding Roles 18-6 Understanding Operations Privileges 18-6 Understanding Domains 18-7 Understanding Organizations 18-7 How ANM Handles Role-Based Access Control 18-8 Configuring User Authentication and Authorization 18-9 Adding a New Organization 18-10 Changing Authentication Server Passwords 18-14 Changing the Admin Password 18-14 Modifying Organizations 18-14 Duplicating an Organization 18-15 Displaying Authentication Server Organizations 18-16 Deleting Organizations 18-16 Managing User Accounts 18-17 Guidelines for Managing User Accounts 18-17 Displaying a List of Users 18-18 Creating User Accounts 18-19 Duplicating a User Account 18-20 Modifying User Accounts 18-21 Resetting Another User’s Password 18-22 Contents xix User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Deleting User Accounts 18-23 Displaying or Terminating Current User Sessions 18-24 Managing User Roles 18-25 Guidelines for Managing User Roles 18-25 Understanding Predefined Roles 18-26 Displaying User Role Relationships 18-27 Displaying User Roles and Associated Tasks and ANM Menu Privileges 18-28 Creating User Roles 18-29 Duplicating a User Role 18-31 Modifying User Roles 18-31 Deleting User Roles 18-32 Managing Domains 18-32 Guidelines for Managing Domains 18-33 Displaying Network Domains 18-33 Creating a Domain 18-34 Duplicating a Domain 18-35 Modifying a Domain 18-36 Deleting a Domain 18-37 Using an AAA Server for Remote User Authentication and Authorization 18-38 Information About Using AD/LDAPS for Remote User Authentication 18-38 Configuring Remote User Authentication Using a TACACS+ Server 18-39 Configuring Remote User Authorization Using a TACACS+ Server 18-45 Configuring Remote User Authorization Using Cisco Secure ACS Version 5.1 18-46 Configuring Remote User Authorization Using Cisco Secure ACS Version 4.2 18-48 Disabling the ANM Login Window Change Password Feature 18-50 Managing ANM 18-51 Checking the Status of the ANM Server 18-52 Using ANM License Manager to Manage ANM Server or Demo Licenses 18-54 Displaying and Adding ANM Licenses to License Management 18-54 Removing an ANM License File 18-55 Displaying ANM Server Statistics 18-56 Configuring ANM Statistics Collection 18-57 Configuring Audit Log Settings 18-58 Performing Device Audit Trail Logging 18-59 Displaying Change Audit Logs 18-61 Configuring Auto Sync Settings 18-61 Configuring Advanced Settings 18-62 Configuring the Overwrite ACE Logging device-id for the Syslog Option 18-62 Configuring the Enable Write Mem on the Config > Operations Option 18-63 Contents xx User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Enabling the ACE Real Server Details Popup Window Option 18-64 Enabling the ACE Server Farm Details Popup Window Option for Virtual Servers 18-65 Enable Mobile Notifications from ANM 18-66 Managing the Syslog Buffer Display in the All Devices Dashboard 18-66 Managing the Display of Virtual Servers in the Operations and Monitoring Windows 18-66 Administering the ANM Mobile Feature 18-67 Configuring ANM with a Proxy Server for ANM Mobile Push Notifications 18-67 Enabling Mobile Device Notifications for Remotely Authorized Users 18-69 Globally Enabling or Disabling Mobile Device Notifications 18-69 Displaying Mobile Device Notifications and Testing the Notification Channel 18-70 Lifeline Management 18-72 CHAPTER 19 Using ANM Mobile 19-1 Information About ANM Mobile 19-2 ANM Mobile Prerequisites and Supported Devices 19-4 Guidelines and Restrictions 19-5 Using ANM Mobile 19-5 Logging In and Out of ANM Mobile 19-6 Using the Favorites Feature 19-6 Monitoring Managed Object Status 19-7 Modifying an Object’s Operating State or Weight 19-10 Displaying Real Time Charts 19-12 Using the ANM Mobile Setting Feature 19-12 Setting Up and Viewing Mobile Device Alarm Notifications 19-13 Enabling Alarm Notifications on ANM Mobile 19-15 Viewing Alarm Notifications from ANM Mobile 19-15 Managing iPod Alarm Notification Sound and Alerts 19-16 CHAPTER 20 Troubleshooting Cisco Application Networking Manager Problems 20-1 Changing ANM Software Configuration Attributes 20-1 Changing ANM Configuration Properties 20-2 Example ANM Standalone Configuration 20-4 Example ANM HA Configuration 20-5 Example ANM Advanced Options Configuration Session 20-6 Discovering and Adding a Device Does Not Work 20-7 Cisco License Manager Server Not Receiving Syslog Messages 20-7 Using Lifeline 20-7 Guidelines for Using Lifeline 20-8 Contents xxi User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Creating a Lifeline Package 20-8 Downloading a Lifeline Package 20-9 Adding a Lifeline Package 20-10 Deleting a Lifeline Package 20-11 Backing Up and Restoring Your ANM Configuration 20-11 APPENDIX A ANM Ports Reference A-1 APPENDIX B Using the ANM Plug-In With Virtual Data Centers B-1 Information About Using ANM With VMware vCenter Server B-2 Information About the Cisco ACE SLB Tab in vSphere Client B-3 Prerequisites for Using ANM With VMware vSphere Client B-4 Guidelines and Restrictions B-5 Registering or Unregistering the ANM Plug-in B-5 Logging In To ANM from VMware vSphere Client B-7 Using the Cisco ACE SLB Tab B-8 Managing ACE Real Servers From vSphere Client B-12 Adding a Real Server B-13 Deleting a Real Server Using vSphere Client B-14 Activating Real Servers Using vSphere Client B-15 Suspending Real Servers Using vSphere Client B-16 Modifying Real Server Weight Value Using vSphere Client B-18 Monitoring Real Server Details Using vSphere Client B-19 Refreshing the Displayed Real Server Information B-20 Using the VMware vSphere Plug-in Manager B-22 GLOSSARY I NDEX Contents xxii User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 ix User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Preface Date: 3/28/12 This guide describes the Cisco Application Networking Manager and explains how to use it to manage your network. This preface provides information about using this guide and includes the following topics: • Audience, page ix • Organization, page ix • Conventions, page xi • Open-Source Software Included in the Cisco Application Networking Manager, page xi • Obtaining Documentation and Submitting a Service Request, page xii Audience This guide is intended for experienced system and network administrators. Depending on the configuration required, readers should have specific knowledge in the following areas: • Networking and data communications • Network security • Router configuration Organization This documentation contains the following sections: • Chapter 1, “Overview” summaries key features and provides an look into some general topics such as the interface. • Chapter 2, “Using Homepage” describes ANM Homepage, a launching point for quick access to selected areas within ANM. • Chapter 3, “Using ANM Guided Setup” describes how to use the guided setup pages to simplify configuration of ANM. • Chapter 4, “Using Application Template Definitions” describes how to use the application templates to simplify configuration of ACE devices (or virtual contexts). x User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Preface • Chapter 5, “Importing and Managing Devices” describes how to add and manage your supported network devices. • Chapter 6, “Configuring Virtual Contexts” describes how to configure virtual contexts on the ACE so that you can effectively and efficiently manage and allocate resources, users, and services. • Chapter 7, “Configuring Virtual Servers” contains procedures for configuring virtual servers for load balancing on the ACE. • Chapter 8, “Configuring Real Servers and Server Farms” provides an overview of server load balancing and procedures for configuring real servers and server farms for load balancing on the ACE. • Chapter 9, “Configuring Stickiness” provides information about sticky behavior and procedures for configuring stickiness with the ANM. • Chapter 10, “Configuring Parameter Maps” describes how to configure parameter maps so that the ACE can perform actions on incoming traffic based on certain criteria, such as protocol or connection attributes. • Chapter 11, “Configuring SSL” describes how to configure your ACE (both the ACE module and the ACE appliance) as a virtual Secure Sockets Layer (SSL) server for SSL initiation or termination. • Chapter 12, “Configuring Network Access” describes how to configure network access using ANM. • Chapter 13, “Configuring High Availability” describes how to configure redundancy to ensure that your network remains operational even if one of the ACE devices becomes unresponsive. • Chapter 14, “Configuring Traffic Policies” describes how to configure class maps and policy maps to provide a global level of filtering traffic received by or passing through the ACE. • Chapter 15, “Configuring Application Acceleration and Optimization” describes how to configure application acceleration and optimization options on the ACE. • Chapter 16, “Using Configuration Building Blocks” provides an overview of configuration building blocks and describes how to configure them, tag them for version control, and apply them to virtual contexts. • Chapter 17, “Monitoring Your Network” describes the ANM monitoring functions, including the various ANM dashboards, and explains how to configure thresholds and configure alarm notifications. • Chapter 18, “Administering the Cisco Application Networking Manager” describes how to administer, maintain, and manage the ANM management system. • Chapter 19, “Using ANM Mobile” describes how to use the Cisco ANM Mobile app to access your ANM server to remotely manage your network from your mobile device. • Chapter 20, “Troubleshooting Cisco Application Networking Manager Problems” describes some procedures and tips on common troubleshooting scenarios. • Appendix A, “ANM Ports Reference” identifies the TCP and UDP ports used by the ANM as well as well-known TCP and UDP port numbers and key words. • Appendix B, “Using the ANM Plug-In With Virtual Data Centers” describes how to integrate ANM with VMware vCenter Server and VMware vSphere Client. xi User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Preface Conventions This document uses the following conventions: Note Means reader take note. Notes contain helpful suggestions or references to material not covered in the publication. Caution Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data. Open-Source Software Included in the Cisco Application Networking Manager • The Cisco Application Networking Manager includes the following open-source software, which is covered by the Apache 2.0 license (http://www.apache.org/): Ant, Avalon Logkit, Commons, Ehcache, Jetty, Log4J, Oro, Commons_Logging, Xmlrpc. • The Cisco Application Networking Manager includes the following open-source software, which is covered by The Legion of the Bouncy Castle (http://www.bouncycastle.org/licence.html) license: BouncyCastle. • The Cisco Application Networking Manager includes the following open-source software, which is covered by the GNU Lesser General Public License Version 2.1 (http://www.gnu.org/licenses/lgpl.html): c3p0-0.9.0.2.jar, Enterprise DT, Jasperreports 1.2, Jcommon 1.2, Jfreechart 1.0.1 • The Cisco Application Networking Manager includes the following open-source software, which is covered by the Mozilla Public License Version 1.1 (http://www.mozilla.org/MPL/MPL-1.1.html): Itext 1.4. Item Convention Commands and keywords boldface font Variables for which you supply values italic font Displayed session and system information screen font Information you enter boldface screen font Variables you enter italic screen font Menu items and button names boldface font Choosing a menu item in paragraphs Option > Network Preferences Choosing a menu item in tables Option > Network Preferences xii User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Preface Obtaining Documentation and Submitting a Service Request For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What’s New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at: http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html Subscribe to the What’s New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0. CHAPTER 1-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 1 Overview Date: 3/28/12 This chapter provides an overview of Cisco Application Networking Manager (ANM), which is a networking management application. This chapter includes the following sections: • ANM Overview, page 1-1 • IPv6 Considerations, page 1-3 • Logging In To the Cisco Application Networking Manager, page 1-5 • Changing Your Account Password, page 1-6 • ANM Licenses, page 1-7 • ANM Interface Components, page 1-8 ANM Overview ANM is a client server application that enables you to perform the following functions: • Configure, monitor, and troubleshoot the functions of supported data center devices. • Create policies for operations, applications owners, and server administration staff to activate and suspend network-based services without knowledge of, or ability to, change network configuration or topology. • Manage the following product types: – Cisco Application Control Engine (ACE) module or appliance – Cisco Global Site Selector (GSS) – Cisco Content Services Switch (CSS) – Cisco Catalyst 6500 Virtual Switching System (VSS) 1440 – Cisco Catalyst 6500 series switch – Cisco 7600 series router – Cisco Content Switching Module (CSM) – Cisco Content Switching Module with SSL (CSM-S) – VMware vCenter Server 1-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview ANM Overview You can install the ANM server software on a standalone server or on a VMware virtual machine as shown in Figure 1-1. The capabilities and functions of the ANM software are the same regardless of which application you use. This guide uses the following terms to reference the two ANM applications: ANM server Dedicated server with ANM server software and Red Hat Enterprise Linux (RHEL) operating system installed on it. For information about installing this type of ANM application, see the Installation Guide for the Cisco Application Networking Manager 5.2. ANM Virtual Appliance VMware virtual appliance with ANM server software and Cisco Application Delivery Engine Operating System (ADE OS) installed on it. Cisco distributes ANM Virtual Appliance (ANM VA) in Open Virtual Appliance (.OVA) format. For information about installing this type of ANM application, see the Installation Guide for the Cisco Application Networking Manager 5.2 Virtual Appliance. Figure 1-1 Sample ANM Network Deployment The sample network application in Figure 1-1 illustrates the following ANM and ACE features: • VMware integration—Feature that enables ANM and the ACE to be integrated with VMware, allowing you to create and manage server farms for application delivery that consist of real servers that are a combination of physical servers and VMware virtual machines (VMs). VM VM VM VMware ESX (i) Host VM VM VM VMware ESX (i) Host VMware vCenter VMware vSphere Client Cisco ACE Virtual Machines Virtual Machines Physical Servers OTV/DCI Link (Dynamic Workload Scaling) Cisco Nexus 7000 Client Client Client Local Data Center Remote Data Center Cisco ANM Standalone Server or Virtual Appliance 330796 VM VM VM VMware ESX (i) Host Cisco Nexus 7000 ANM Mobile 1-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview IPv6 Considerations • Dynamic Workload Scaling—ACE feature that permits on-demand access to remote resources, such as VMs, that you own or lease from an Internet service provider (or cloud service provider). This feature uses Cisco’s Nexus 7000 series switches with Cisco’s Overlay Transport Virtualization (OTV), which is a Data Center Interconnect (DCI) technology used to create a Layer 2 link over an existing IP network between geographically distributed data centers. For more information, see the “Dynamic Workload Scaling Overview” section on page 8-4. Note Dynamic Workload Scaling requires ACE module or appliance software Version A4(2.0) or later and the Cisco Nexus 7000 Series switch. • ANM plug-in for vCenter Server—Enabling the plug-in on an ANM server or ANM Virtual Appliance permits access to ANM’s ACE server load-balancing functions from a VMware vSphere Client. For more information, see Appendix B, “Using the ANM Plug-In With Virtual Data Centers.” • ANM Mobile—Feature that enables supported mobile devices to access to your ANM server or ANM Virtual Appliance, allowing you to manage the network objects in much the same way you do from an ANM client. Using a mobile device, you can run ANM Mobile as a native application or inside the mobile device’s browser. For more information, see Chapter 19, “Using ANM Mobile.” IPv6 Considerations Beginning with ACE software Version 5.1, the ACE supports IPv6 configurations, which you can configure using ANM beginning with ANM software Version 5.1. The ACE supports IPv6 configurations with the following considerations: • All the management traffic used by ANM is required to send over IPv4 protocol. IPv6 is not supported. • By default, IPv6 is disabled on an interface. You must enable IPv6 on the interface to enable its configured IPv6 addresses. The interface cannot be in bridged mode. The interface may or may not have IPv4 addresses configured on it. • When you enable IPv6 or configure a global IPv6 address on an interface, the ACE automatically does the following: – Configures a link-local address (if it is not already configured) – Performs duplicate address detection (DAD) on both addresses You must enable IPv6 on the interface to enable global IPv6 address. • IPv6 on interface can be individually enabled or disabled. IPv6 cannot be enabled or disabled globally. • A link-local address is an IPv6 unicast address that has a scope of the local link only and is required on every interface. Every link-local address has a predefined prefix of FE80::/10. You can configure a link-local address manually. If you do not configure a link-local address before enabling an IPV6 address on the interface, the ACE automatically generates a link-local address with a prefix of FE80::/64. Only one IPv6 link-local address can be configured on an interface. In a redundant configuration, you can configure an IPv6 peer link-local address for the standby ACE. You can configure only one peer link-local address on an interface. 1-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview IPv6 Considerations • A unique-local address is an optional IPv6 unicast address that is used for local communication within an organization and it is similar to a private IPv4 address (for example, 10.10.2.1). unique-local addresses have a global scope, but they are not routable on the Internet, and they are assigned by a central authority. All unique-local addresses have a predefined prefix of FC00::/7. You can configure only one IPv6 unique-local address on an interface. In a redundant configuration, you can configure an IPv6 peer unique-local address on the active that is synchronized to the standby ACE. You can configure only one peer unique-local IPv6 address on an interface. • A global address is an IPv6 unicast address that is used for general IPv6 communication. Each global address is unique across the entire Internet. Therefore, its scope is global. The low order 64 bits can be assigned in several ways, including autoconfiguration using the EUI-64 format. You can configure only one globally unique IPv6 address on an interface. In a redundant configuration, you can configure an IPv6 peer global address that is synchronized to the standby ACE. When you configure redundancy with active and standby ACEs, you can configure a VLAN interface that has an alias global IPv6 address that is shared between the active and standby ACEs. The alias IPv6 address serves as a shared gateway for the two ACEs in a redundant configuration. You can configure only one alias global IPv6 address on an interface. • A multicast address is used for communications from one source to many destinations. IPv6 multicast addresses function in a manner that is similar to IPv4 multicast addresses. All multicast addresses have a predefined prefix of FF00::/8. • The ACE supports abbreviated IPv6 addresses. When using double colons (::) for leading zeros in a contiguous block, they can only be used once in an address. Leading zeros can be omitted. Trailing zeros cannot be omitted. The DM will abbreviate an IPv6 address after you finish typing it. If you enter the entire address with a block of contiguous zeros, the DM collapses it into the double colons. For example: FF01:0000:0000:0000:0000:0000:0000:101 becomes FF01::101. • The ACE uses the Neighbor Discovery (ND) protocol to manage and learn the mapping of IPv6 to Media Access Control (MAC) addresses of nodes attached to the local link. The ACE uses this information to forward and transmit IPv6 packets. The neighbor discovery protocol enables IPv6 nodes and routers to: – Determine the link-layer address of a neighbor on the same link – Find neighboring routers – Keep track of neighbors The IPv6 neighbor discovery process uses ICMPv6 messages and solicited-node multicast addresses to determine the link-layer address of a neighbor on the same network (local link), verify the reachability of a neighbor, and keep track of neighbor routers. The IPv6 neighbor discovery process uses the following mechanisms for its operation: – Neighbor Solicitation – Neighbor Advertisement – Router Solicitation – Router Advertisement – Duplicate Address Detection • The ACE supports IPv6-to-IPv6 L4/L7 SLB, including support for IPv6 VIP, predictor, probe, serverfarm, sticky, access-list, object-group, interface, source NAT, OCSP, and CRL. 1-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview Logging In To the Cisco Application Networking Manager • The probe must have the same IP address type (IPv6 or IPv4) as the real server. For example, you cannot configure an IPv6 probe to an IPv4 real server. • A server farm can support a mix of IPv6 and IPv4 real servers, and can be associated with both IPv6 and IPv4 probes. • Only the following Layer 7 protocols support IPv6: – Layer 7 HTTP/HTTPS/DNS – Layer 4 TCP/UDP • The ACE supports the following: – IPv6-to-IPv4 SLB and IPv4-to-IPv6 SLB for L7 HTTP/HTTP/TCP/UDP – Source NAT support of IPv6 – IPv6 access-list and object group – DHCPv6 relay • ICMPv6 traffic is not automatically allowed. You must configure the corresponding management traffic policy to allow the ping request to ACE. However, the necessary Neighbor Discovery (ND) messages for ARP, duplication address detection are automatically permitted. • Copying files over IPv6 to or from devices are not supported. • The ACE supports IPv6 HA: – All the FT transport (ft vlan) is still on IPv4. – Track IPv6 host /peer will be supported Logging In To the Cisco Application Networking Manager You access ANM features and functions through a web-based interface. The following sections describe logging in, the interface, and terms used in ANM. The ANM login window allows you to do the following tasks: • Log into the ANM server. • Change the password for your account (see the “Changing Your Account Password” section on page 1-6). • Obtain online help by clicking Help. Procedure Step 1 Choose one the following: • To log in after a new install, which uses the default web ports of 443 and 80, enter https://host. Note You do not have to explicitly enter the default ports 443 and 80. Caution If you log in using HTTP, you must change the properties file. See the “Changing ANM Software Configuration Attributes” section on page 20-1 for details. If you enable HTTP, you make your connection to ANM less secure. 1-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview Changing Your Account Password • To log in after an upgrade, enter https://:10443 or https://:10080. Note You must explicitly enter the nondefault ports 10443 and 10080. Note All browsers require that cookies, Javascript/scripting, and popup windows are enabled. If you reinstall a subsequent ANM release, you must delete the cookies and clear the browser cache. For example, enter https://192.168.10.10:10443. The login window appears. Step 2 In the User Name field, enter admin, which is the predefined user account that comes with a new installation. Note If you are logging in using ACS authentication (TACACS or RADIUS), you must add '@ to the username on the login page, or you will not be able to log in. Once you are logged in using this account, you can create additional user accounts. For information on changing account passwords, see the “Modifying User Accounts” section on page 18-21. Step 3 In the Password field, enter the password that you configured the admin account with when installing ANM. Step 4 Press Enter or click Login. When you log in, the default page that appears is the ANM Homepage (see the “ANM Windows and Menus” section on page 1-9). You can change your default page by making a different selection from the Homepage. See the “Customizing the Default ANM Page” section on page 2-4 for details. For a description of the user interface, see Figure 1-2 on page 1-8. The interface will not contain data until you add devices by one of the methods described in the “Importing Network Devices into ANM” section on page 5-10. . Related Topics • Changing Your Account Password, page 1-6 • ANM Interface Components, page 1-8 Changing Your Account Password You can change your account password when you log into ANM. Guidelines and Restrictions By default, the feature that allows you to change your password when logging into ANM is enabled; however, this feature can be disabled. When disabled, the ANM login window no longer displays the Change Password hyperlink. For more information, see the “Disabling the ANM Login Window Change Password Feature” section on page 18-50. 1-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview ANM Licenses Procedure Step 1 Using a web browser, navigate to the ANM login window by typing the IP address or hostname where ANM is installed. For example, enter https://192.168.10.10. The login window appears. Step 2 In the User Name field, enter your account username. Step 3 Click Change Password. The Change password configuration window appears. Step 4 In the User Name field, enter the username of the account that you want to modify. Step 5 In the Old Password field, enter the current password for this account. Step 6 In the New Password field, enter the new password for this account. Password attributes such as minimum and maximum length or accepted characters are defined at the organizational level. For more information on configuring passwords, see the “Configuring User Authentication and Authorization” section on page 18-9. Step 7 In the Confirm New Password field, reenter the new password for this account. Step 8 Do one of the following: • Click OK to save your entries and to return to the login window. • Click Cancel to exit this procedure without saving your entries and to return to the login window. Related Topics • Logging In To the Cisco Application Networking Manager, page 1-5 • ANM Interface Components, page 1-8 • Disabling the ANM Login Window Change Password Feature, page 18-50 ANM Licenses Beginning with ANM software Version 5.2, ANM includes a 90-day evaluation period that begins when you install the software image. During this time, you can use all the functions of ANM without installing a license, including managing any number of supported devices and any number of ACE virtual contexts. However, to continue using ANM beyond the evaluation period, you must install the ANM server license, which is available at no charge. The ANM demo license is also available, which allows ANM to perform all the functions associated with the ANM server license; however, the demo license has an expiration date associated with it. You can order a demo license if you do not know the PAK number required to order the ANM server license. For more information about the 90-day evaluation period, available ANM licenses, and installing a license, see the “Using ANM License Manager to Manage ANM Server or Demo Licenses” section on page 18-54 Related Topics Using ANM License Manager to Manage ANM Server or Demo Licenses, page 18-54 1-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview ANM Interface Components ANM Interface Components This section includes the following topics: • ANM Windows and Menus, page 1-9 • ANM Buttons, page 1-11 • Table Conventions, page 1-14 • ANM Screen Conventions, page 1-17 When you log in to ANM, the default window that appears is the Homepage from which you can access the operational and monitoring features of ANM. For details about using Homepage, see the “Information About Homepage” section on page 2-1). Figure 1-2 shows the Devices window (Config > Devices), which is an example ANM work window where you view the network device tree and perform network management tasks. Table 1-1 describes the numbered fields. Note The ANM software version that displays across the top of the window varies depending on your version of ANM. Figure 1-2 ANM Interface Components 1-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview ANM Interface Components Related Topics • ANM Windows and Menus, page 1-9 • ANM Interface Components, page 1-8 • Using Homepage, page 2-1 ANM Windows and Menus Figure 1-3 contains many common window elements found in ANM and described in Table 1-2. Not all windows contain all buttons. Note The ANM software version that displays across the top of the window varies depending on your version of ANM. Table 1-1 ANM Interface Components Descriptions Field Description 1 Navigation pane, which contains the following components: • High-level navigation path within the ANM interface, which includes Config, Monitor, and Admin. You can click an item in the navigation path to view that window. • Logout hyperlink. • About hyperlink that provides ANM version information. • Feedback hyperlink that opens a new browser window containing the ANM user feedback form hosted on www.ciscofeedback.vovici.com. • Help hyperlink that provides context-sensitive help and a PDF version of the ANM user guide. 2 Second-level Navigation pane, which contains another level of navigation. Clicking an option in this pane displays the associated window in the content area. 3 Content area, which contains the display and input area of the window. It can include tables, configuration items, buttons, or combinations of these items. 4 Status bar, which indicates the date and time of the ANM server machine. ANM frequently updates the status bar. 1-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview ANM Interface Components Figure 1-3 Example ANM Window Table 1-2 Example ANM Window Descriptions Number Description 1 Device tree that appears when you click Config or Monitor. The device tree includes All Devices and Groups folders: • The All Devices folder expands to show the names of imported Cisco devices and their associated modules or virtual contexts. When you click the plus sign (+) in front of a chassis icon, you can see a list of the modules in the chassis. When you expand an ACE appliance or ACE module, you can see the list of existing virtual contexts for that device. For more information about adding devices, see the “Importing Network Devices into ANM” section on page 5-10. • The Groups folder contains the list of user-defined groups. For more information about user-defined groups, see the “Configuring User-Defined Groups” section on page 5-72. The Organization tree displays when you click Admin > Role-Based Access Control. The organization tree includes all organizations in ANM. Choosing an organization name displays its details. To expand folders in the device tree, click the plus sign (+) to the right of an option. To collapse the structure, click the minus sign (-). At the top of the tree are the following buttons: • Refresh—Refreshes the device tree after you have imported devices or made changes to the User Groups. • Plus sign (+) —Allows you to add an item to the selected option in the device tree. • Garbage can—Deletes the selected entry. Note Menus are based on device types. Although menu labels are the same for different device types, the actual menu definition is different. For example, you cannot preserve the menu state while traversing back an forth from a module to a virtual context in the device tree. 2 Option menus, which appear in Config windows. Click the icon on the bar to show or hide the options. 1-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview ANM Interface Components Related Topics • ANM Buttons, page 1-11 • ANM Screen Conventions, page 1-17 ANM Buttons Table 1-3 describes the buttons that appear in some of the Config, Monitor, and Admin windows. 3 Object selector. Use this field to choose a device, context, building block, or other object that you want to view information on or configure. 4 Command buttons. Use these buttons to perform the action identified by the button label. 5 Input fields. Use these fields to make selections and provide information. When there are more than three choices for any field, the field displays as a drop-down list. Otherwise, selections display with radio buttons. 6 Feature panel that contains functions that correspond to what is selected in the device or organization tree. Click on a command to expand the list of options that correspond to that command. Table 1-2 Example ANM Window Descriptions Number Description Table 1-3 Button Descriptions Button Name Description ACL table (expand) Allows you to expand all ACL table entries. ACL table (collapse) Allows you to collapse all ACL table entries. ACL table (resequence) Allows you to open the resequence popup window that allows you to reorder the ACL table entries. Add Allows you to add an entry to the displayed table. Add another Saves the current entries and refreshes the window so that you can add another entry. Advanced editing mode Allows you to view or enter advanced arguments for the chosen display. 1-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview ANM Interface Components Auto refresh (pause) Allows you to interrupt the table data autorefresh process. Auto refresh (resume) Indicates that the table data autorefresh process is on pause and allows you to resume. Customize Allows you to customize the table to suit your needs. (See the “Customizing Tables” section on page 1-15.) Delete Deletes the chosen entry in the table. Duplicate Duplicates the chosen entry in the table. Edit Opens the configuration window of a chosen entry in the table. Groups Allows you to create groups of the following objects: • Real servers (see the “Managing Real Server Groups” section on page 8-10) • Virtual servers (see the “Managing Virtual Server Groups” section on page 7-67) • GSS VIP answers or DVS rules (see the “Creating a VIP Answer or DNS Rule Group” section on page 7-77) Filter Filters the displayed list of items according to the criteria that you specify. (See the “Filtering Entries” section on page 1-14.) Also displays a filter text box where strings can be entered. Go Appears when filtering is enabled; updates the table with the filtering criteria. Key Indicates that the associated field is a foreign key field. This field takes its values from another table. Plus Displays a table with information related to the field where Plus appears. For example, if Plus appears next to the field label VLAN Group, clicking Plus displays a list of all VLAN groups in a separate window. Table 1-3 Button Descriptions (continued) Button Name Description 1-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview ANM Interface Components Refresh Refreshes the content area. Save Displays the current information in a new window in either raw data or Microsoft Excel format so you can save it to a file or print it. Full window view Allows you to adopt a larger (full) window view for a table or dashboard window. Reduced window view (normal) Allows you to adopt a smaller window view for a table or dashboard window. Sort Sorts a column alphabetically up or down. Stop Stops the current process. If a process is only partially complete, it will finish its current operation and exit. For example, when stop is used during the import of two modules, it will complete only the first of two module imports. Switch between configure and browse modes Displays the subtables for those items that have additional sets of parameters that can be configured, such as Config > Devices > Network > VLAN Interfaces. Note This button is not available on single-row tables such as Config > Devices > System > Syslog or Config > Devices > System > SNMP. To switch between these modes, navigate to another window where the button appears (for example, Config > Devices > Load Balancing > Server Farms), click the button to enter desired mode, then return to the window on which the button was missing. You will remain in the mode you chose. View Excel Displays the raw data in Microsoft Excel format in a separate browser window. View raw data Displays the raw data in table format. Show as image Displays the historical data object graph in a separate browser window. Table 1-3 Button Descriptions (continued) Button Name Description 1-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview ANM Interface Components Related Topics • ANM Windows and Menus, page 1-9 • ANM Screen Conventions, page 1-17 Table Conventions This section describes the ANM GUI table conventions, including how to filter the information displayed and how to customize a table’s appearance. This section includes the following topics: • Filtering Entries, page 1-14 • Customizing Tables, page 1-15 • Using the Advanced Editing Option, page 1-16 Filtering Entries You can filter the information that a table displays. Click Filter to view table entries using the criteria that you chose. When filtering is enabled, a filter row appears above the first table entry that allows you to filter entries in the following ways: • In fields with drop-down lists, choose one of the ANM-identified categories (see Figure 1-4). The table refreshes automatically with the entries that match the chosen criterion. • In fields without drop-down lists, enter the string that you want to match, and then click Go above the first table entry. The table refreshes with the entries that match your input. • Enter the string in the filter box. For example, by entering the string gold and clicking Go, only the gold Resource Class virtual contexts appear (see Figure 1-4). Figure 1-4 Example Table with Filtering Enabled View as chart Toggles the display of a historical data object as a graph in the monitoring window. View as grid Toggles the display of a historical data object as a numerical grid in the monitoring window. From this display, you can export the data in Microsoft Excel format. Table 1-3 Button Descriptions (continued) Button Name Description 1-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview ANM Interface Components Related Topics • ANM Interface Components, page 1-8 • Customizing Tables, page 1-15 • Using the Advanced Editing Option, page 1-16 Customizing Tables You can customize a table for your use. Click Customize in a table to configure the table to suit your needs. When you place the cursor over Customize, the following items appear: • Default—When chosen with a check mark, this item indicates that the ANM default table format is being used by the current table. • Configure—When chosen, this item opens a dialog box that allows you to create a new customized table format or to modify the table format currently in use. Procedure Step 1 When viewing a table, choose Customize > Configure. The List Configuration dialog box appears. Step 2 In the List Configuration dialog box, enter the information in Table 1-4. Note Depending on the table that you chose, the available fields in the configuration table differ. Table 1-4 includes sample fields that might appear. Note You can be as inclusive or as restrictive as you like when setting table configuration options. Table 1-4 Table Configuration Attributes Field Description List Customization Name Unique name for a new table configuration. Fields Fields that you can include in the table, choose the fields from the Available Items list, and click Add. To remove fields from the table, choose the fields from the Selected Items list, and then click Remove. Up/Down Location of a column in the table that you can change. Choose its name in the column on the right, then click Up or Down to place it in the desired location. Group By Field that you want to group entries by. When you choose a field for grouping, one or more entries appears in the table with + at the beginning of the entry, the name of the field, the grouping criteria, and the number of items in the group. Click + to view all entries in the group. Descending Descending check box to sort the groups in reverse order. Clear the Descending check box to sort the groups in ascending order. 1-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview ANM Interface Components Step 3 Do one of the following: • Click Save to save your entries under a new name and to close the List Configuration dialog box. If a table using this format is displayed, the table is updated automatically. • Click Cancel to exit the procedure without saving your entries and to close the List Configuration dialog box. • Click Apply to apply your current entries to the table that you are viewing, to save your entries, and to close the List Configuration dialog box. • Click Delete to delete the currently selected customized table format. It no longer appears as an option when you click Customize. Related Topics • ANM Interface Components, page 1-8 • Filtering Entries, page 1-14 • Using the Advanced Editing Option, page 1-16 Using the Advanced Editing Option By default, tables include columns that contain configured attributes or a subset of columns related to a key field. To view all configurable attributes in table format, click Advanced Editing Mode (the highlighted button in Figure 1-5). When advanced editing mode is enabled, all columns appear for your review (see Figure 1-5). Sort By Field that you want to sort entries by. When you choose a field for sorting, all entries in the table are sorted according to the values in the selected field. Name Filter Name that represents the name of each field in the table. Enter the string or value that you want to filter the results by. You can enter complete or partial strings or values to be matched. Do not include wildcard characters. Version Filter Version that represents the name of each field in the table. Enter the string or value that you want to filter the results by. You can enter complete or partial strings or values to be matched. Do not include wildcard characters. Table 1-4 Table Configuration Attributes (continued) Field Description 1-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview ANM Interface Components Figure 1-5 Advanced Editing Enabled Window Related Topics • ANM Interface Components, page 1-8 • Filtering Entries, page 1-14 • Customizing Tables, page 1-15 ANM Screen Conventions Table 1-5 describes other conventions used in ANM screens. Related Topics • Table Conventions, page 1-14 Table 1-5 ANM Window Conventions Convention Example Description Dimmed field If no items are selected, buttons are dimmed. If an item is selected, only operational buttons appear. Red asterisk A red asterisk indicates a required field. Yellow field with red font Incorrect, invalid, or incomplete entries appear as red font against a yellow background with the reason for that error. In the example, an IP address cannot begin with four digits, which results in this display. Drop-down lists When there are more than three choices for any field, the field displays as a drop-down list. Otherwise, selections display with radio buttons. 1-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 1 Overview ANM Interface Components • ANM Interface Components, page 1-8 CHAPTER 2-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 2 Using Homepage This section describes how to use Homepage, which is a launching point for quick access to selected areas within Cisco Application Networking Manager (ANM). This chapter includes the following sections: • Information About Homepage, page 2-1 • Customizing the Default ANM Page, page 2-4 Information About Homepage Homepage allows you to have quick access to the following operations and guided setup tasks in ANM: • Operational tasks that you can access: – The Real Servers table to view information for each configured real server, activate or suspend real servers listed in the table, or modify server weight and connection limits. – The Virtual Servers table to view information for each configured virtual server and to activate or suspend virtual servers listed in the table. – The Cisco Global Site Selector (GSS) Answer table to manage GSS VIP answers (resources that respond to content queries) by specifying virtual IP (VIP) addresses associated with a server load balancer (SLB) such as the Cisco Content Services Switch (CSS), Cisco Content Switching Module (CSM), Cisco IOS-compliant SLB, LocalDirector, or a web server. – The DNS Rules table to specify actions in the DNS rules table for the GSS to take when it receives a request from a known source (a member of a source address list) for a known hosted domain (a member of a domain list). • Monitoring—Connect to the central Device Dashboard where you can quickly view device and virtual context monitoring results and track potential issues; view detailed context-level resource usage information; and monitor load balancing statistics for virtual servers. • Guided setup tasks that you can launch: – The Import Devices guided setup task to establish communication between ANM and hardware devices. – The Cisco Application Control Engine (ACE) Hardware Setup task to configure ACE devices that are new to the network by establishing network connectivity in either standalone or high-availability (HA) deployments. – The Virtual Context Setup task to create and connect an ACE virtual context. – The Application Setup task to configure end-to-end load-balancing for your application. 2-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 2 Using Homepage Information About Homepage • Configuration—Tasks that allow you to configure system attributes for a virtual context, control a user’s access to ANM, and display configuration and deployment changes logged in the ANM database. • Documentation—Quick links to ANM, ACE module, and ACE appliance user documentation on www.cisco.com. • System Summary—Tasks that allow you to display critical alarm notifications when the value for a specific statistic rises above the specified setting or display all critical events received from an ACE device for syslog and SNMP traps from all virtual contexts. By default, the ANM Homepage (see Figure 2-1) is the first page that appears in ANM after you log in. To access the Homepage from other locations within ANM, click the Home menu option at the top of the window. From the Homepage, you can customize which page you want to display for subsequent logins into ANM. See the “Customizing the Default ANM Page” section on page 2-4 for details. Note All menu options on the Homepage are under Role-Based Access Control (RBAC). Menu options will be grayed if proper permission has not been granted to the logged in user by the administrator. See the “How ANM Handles Role-Based Access Control” section on page 18-8 for more information about RBAC in ANM. Note The ANM software version that displays across the top of the window varies depending on your version of ANM. Figure 2-1 Homepage Window 2-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 2 Using Homepage Information About Homepage Table 2-1 identifies the Homepage links, associated pages in ANM, and related topics that can be found in this document. Table 2-1 Homepage Links Homepage Link ANM Page Related Topics Operational Tasks Manage Real Servers Config > Operations > Real Servers Managing Real Servers, page 8-9 Manage Virtual Servers Config > Operations > Virtual Servers Managing Virtual Servers, page 7-66 Manage GSS VIP Answers Config > Operations > GSS VIP Answers Managing GSS VIP Answers, page 7-73 Manage GSS DNS Rules Config > Operations > DNS Rules Activating and Suspending DNS Rules Governing GSS Load Balancing, page 7-75 Monitoring Dashboard Monitor > Devices > Dashboard Using Dashboards to Monitor Devices and Virtual Contexts, page 17-4 Resource Usage Summary Monitor > Devices > Resource Usage > Connections Monitoring System Traffic Resource Usage, page 17-27 Application Performance Summary Monitor > Devices > Load Balancing > Virtual Servers Monitoring Load Balancing, page 17-33 Guided Setup Import a Device Config > Guided Setup > Import Devices Using Import Devices, page 3-4 Configure ACE Hardware Config > Guided Setup > ACE Hardware Setup Using ACE Hardware Setup, page 3-5 Create a Virtual Context Config > Guided Setup > Virtual Context Setup Using Virtual Context Setup, page 3-10 Provision an Application Config > Guided Setup > Application Setup Using Application Setup, page 3-12 Configuration Configure Devices Config > Devices > System > Primary Attributes Configuring Virtual Context Primary Attributes, page 6-14 ANM Role-Based Access Control Admin > Role-Based Access Control > Users Managing User Accounts, page 18-17 Device Audit Config > Device Audit Performing Device Audit Trail Logging, page 18-59 Application Configs Config > Global > Application Configs Managing Application Template Instances, page 4-3 Application Config Templates Config > Global > Application Config Templates Managing Application Template Definitions, page 4-15 System Summary Critical Alarms Monitor > Alarm Notifications > Alarms Displaying Alarms in ANM, page 17-65 High Priority Syslogs Monitor > Events > Events Monitoring Events, page 17-55 Documentation 2-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 2 Using Homepage Customizing the Default ANM Page Note For information about the navigational tabs and hyperlinks located at the top of the Homepage window, see the “ANM Interface Components” section on page 1-8. Customizing the Default ANM Page You can choose the default page that you access after logging in to ANM. By default, the ANM Homepage is the first page that appears after you log in. From the ANM Homepage, you can specify a different page that appears as the default page after you log in. Procedure Step 1 If the Homepage is not active in ANM, click the Home tab. The Homepage appears. Step 2 From the Default Login Page drop-down list, choose one of the following pages that you want to appear after you log in to ANM: • Home > Welcome • Config > Guided Setup • Config > Devices • Config > Operations > Real Servers • Config > Operations > Virtual Servers • Config > Operations > GSS VIP Answers • Config > Operations > GSS DNS Rules Cisco ANM Documentation (link to documentation set on www.cisco.com) N/A N/A Cisco ACE Appliance Documentation (link to documentation set on www.cisco.com) N/A N/A Cisco ACE Module Documentation (link to documentation set on www.cisco.com) N/A N/A Cisco ACE Troubleshooting Guide (link to DocWiki) N/A N/A What is New in this ANM Release (link to release notes on www.cisco.com) Table 2-1 Homepage Links (continued) Homepage Link ANM Page Related Topics Operational Tasks 2-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 2 Using Homepage Customizing the Default ANM Page • Config > Deploy • Config > Device Audit • Monitor > Devices > Dashboard • Monitor > Devices > Resource Usage • Monitor > Devices > Traffic Summary • Monitor > Devices > Load Balancing > Real Servers • Monitor > Devices > Load Balancing > Probes • Monitor > Devices > Load Balancing > Statistics • Monitor > Devices > Load Balancing > Application Acceleration (ACE appliance only) • Monitor > Events • Monitor > Alarm Notifications > Alarms Step 3 Click Save to save your new selection as the default page the next time that you log in to ANM. 2-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 2 Using Homepage Customizing the Default ANM Page CHAPTER 3-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 3 Using ANM Guided Setup Date: 3/28/12 This chapter describes how to use Cisco Application Networking Manager (ANM) Guided Setup. Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • Information About Guided Setup, page 3-1 • Guidelines and Limitations, page 3-4 • Using Import Devices, page 3-4 • Using ACE Hardware Setup, page 3-5 • Using Virtual Context Setup, page 3-10 • Using Application Setup, page 3-12 Information About Guided Setup ANM Guided Setup provides a series of setup sequences that offer GUI window guidance and networking diagrams to simplify the configuration of ANM and the network devices that it mananges. Guided Setup allows you to quickly perform the following tasks: • Establish communication between ANM and Application Control Engine (ACE) hardware devices. • Configure ACE devices that are new to the network by establishing network connectivity in either standalone or high-availability (HA) deployments. • Create and connect to an ACE virtual context. • Set up load balancing application from an ACE to a group of back-end servers. To access Guided Setup, click the Config tab located at the top of the window, then click Guided Setup. 3-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Information About Guided Setup Note The available menu and button options on the Guided Setup tasks are under Role-Based Access Control (RBAC). Menu and button options will be grayed if proper permission has not been granted to the logged in user by the administrator. See the “How ANM Handles Role-Based Access Control” section on page 18-8 for more information about RBAC in ANM. Table 3-1 identifies the individual guided setup tasks and related topics. Table 3-1 Guided Setup Tasks and Related Topics Guided Setup Tasks Purpose Related Topics Import devices Launch the Import Devices setup task to establish communication between ANM and hardware devices. Imported devices can include: ACE modules, ACE appliances, Catalyst 6500 series chassis, Catalyst 6500 Virtual Switching System (VSS) 1440, Cisco 7600 series routers, Content Services Switches (CSS) devices, Content Switching Module (CSM) devices, or Global Site Selector (GSS) devices. • Using Import Devices, page 3-4 • Information About Importing Devices, page 5-4 • Preparing Devices for Import, page 5-4 • Importing Network Devices into ANM, page 5-10 • Discovering Large Numbers of Devices Using IP Discovery, page 5-27 ACE hardware setup Launch the ACE Hardware Setup task to help you configure ACE devices that are new to the network by establishing network connectivity in either standalone or high-availability (HA) deployments. • Using ACE Hardware Setup, page 3-5 • Configuring Devices, page 5-34 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 • Managing Devices, page 5-66 • Configuring ACE High Availability Peers, page 13-15 3-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Information About Guided Setup Virtual context setup Launch the Virtual Context Setup task to create and connect an ACE virtual context. • Using Virtual Context Setup, page 3-10 • Using Resource Classes, page 6-43 • Creating Virtual Contexts, page 6-2 • Configuring Virtual Contexts, page 6-8 • Configuring VLANs Using Cisco IOS Software (ACE Module), page 12-3 Application setup Launch the Application Setup task to configure load balancing for your application. This task guides you through a complete end-to-end configuration of the ACE for many common server load-balancing situations. • Using Application Setup, page 3-12 • Creating an Application Template Instance, page 4-4 • Configuring Virtual Context VLAN Interfaces, page 12-6 • Configuring Virtual Context BVI Interfaces, page 12-19 • Configuring Virtual Context Static Routes, page 12-28 • Configuring Virtual Context BVI Interfaces, page 12-19 • Configuring Security with ACLs, page 6-78 • SSL Setup Sequence, page 11-4 Table 3-1 Guided Setup Tasks and Related Topics Guided Setup Tasks Purpose Related Topics 3-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Guidelines and Limitations Guidelines and Limitations As you perform a Guided Setup task, use the following operating conventions: • To move between steps, click the name of the step in the menu to the left. • The steps for each task are listed in an order that is designed to prevent problems during later steps; however, you can skip steps if you know they are not applicable to your application. • Depending on your user privileges, ANM may prevent you from making changes on certain steps. • You must save and deploy any changes you want to keep before leaving each page. • Each task can be run as many times as you like. Using Import Devices You can use the Import Device task to import ACE modules, ACE appliances, Catalyst 6500 series chassis, Catalyst 6500 Virtual Switching System (VSS) 1440, Cisco 7600 series routers, CSS devices, CSM devices, or GSS devices into ANM. You must import the hardware devices before ANM can manage them. Before You Begin • Because ANM communicates with network devices through Secure Shell (SSH) and other protocols, you must set up your devices to allow ANM to collect data from them. See the “Preparing Devices for Import” section on page 5-4. • Before ANM can import a device, you must ensure that the device has a management interface that ANM can access. Also, you need the IP address and credentials for the device's management interface in order to import it. • If the ACE module is new and retains its factory settings, you can configure basic management during the import process by using the Bare Blade option. Procedure Step 1 Choose Config > Guided Setup > Import Devices. The Import Devices window appears, which includes the All Devices table. Step 2 At the top of the All Devices table, click Add (+) to import a new device. The New Device window appears. Step 3 Enter the information for the specific device and complete the import devices procedure as described in “Importing Network Devices into ANM” section on page 5-10. Note To manage modules inside a Catalyst 6500 series switch, you must first import the Catalyst into the All Devices table. To import modules from a Catalyst that is already imported, choose the Catalyst switch from the All Devices table and click Modules below the All Devices table. 3-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using ACE Hardware Setup Note The time required to import depends on the size of the existing configuration on each device. The process can range from a few minutes to 30 minutes or more for a very large configuration. Step 4 After you finish importing the ACE devices (module or appliance) into ANM, continue to the ACE Hardware Setup task to guide you through the basic device setup and network configuration. See the “Using ACE Hardware Setup” section on page 3-5. Related Topics • Information About Importing Devices, page 5-4 • Preparing Devices for Import, page 5-4 • Importing Network Devices into ANM, page 5-10 • Discovering Large Numbers of Devices Using IP Discovery, page 5-27 • Using ACE Hardware Setup, page 3-5 Using ACE Hardware Setup You can use the ACE Hardware Setup task to configure ACE devices that are new to the network by establishing network connectivity in either standalone or high-availability (HA) deployments. Before You Begin Before you can set up the ACE hardware using ANM, you must use the Import Devices task to import the ACE into ANM if you have not already. See the “Using Import Devices” section on page 3-4. Assumptions • You can extend the functionality of the ACE by installing licenses. If you plan to extend the ACE functionality, ensure that you have received the proper software license key for the ACE, that ACE licenses are available on a remote server for importing to the ACE, or you have received the software license key and have copied the license file to the disk0: file system on the ACE using the copy path/]filename1 disk0: CLI command. Note See either the Cisco Application Control Engine Module Administration Guide or Cisco 4700 Series Application Control Engine Appliance Administration Guide for details on the copy path/]filename1 disk0: CLI command. • You must be in the Admin virtual context on an ACE device (ACE module or ACE appliance) to configure ACE devices that are new to the network. • When importing an ACE HA pair into ANM, you should follow one of the following configuration requirements so that ANM can uniquely identify the ACE HA pair: – Use a unique combination of FT interface VLAN and FT IP address/peer IP address for every ACE HA pair imported into ANM. For HA, it is critical that the combination of FT interface VLAN and IP address/peer IP address is always unique across every pair of ACE peer devices. 3-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using ACE Hardware Setup – Define a peer IP address in the management interface using the management IP address of the peer ACE (module or appliance). The management IP address and management peer IP address used for this definition should be the management IP address used to import both ACE devices into ANM. Note For more information about the use of HA pairs imported into ANM, see the “ANM Requirements for ACE High Availability” section on page 5-8. • When you are configuring the ACE, changes to the physical interfaces (including Gigabit Ethernet ports or port channels) can result in a loss of connectivity between ANM and the ACE. Use caution when following the ACE Hardware Setup task if you are modifying the interface that management traffic is traversing. Procedure Step 1 Choose Config > Guided Setup > ACE Hardware Setup. The ACE Hardware Setup window appears, which includes the ACE Device and Configuration Type drop-down lists. Step 2 From the ACE Device drop-down list, choose an ACE device (module or appliance). Step 3 From the Configuration Type drop-down list, choose whether to set up the ACE as a standalone device or as a member of a high-availability (HA) ACE pair: • Standalone—The ACE is not to be used in an HA configuration. • HA Secondary—The ACE is to be the secondary peer in an HA configuration. • HA Primary—The ACE is to be the primary peer in an HA configuration. Note Ensure that you complete the ACE hardware setup task for the secondary device before you set up the primary device. Step 4 Click Start Setup. The License window appears (Config > Guided Setup > ACE Hardware Setup > Licenses). Cisco offers licenses for ACE modules and appliances that allows you to increase the number of default contexts, bandwidth, and SSL TPS (transactions per second). For more information, see either the Cisco Application Control Engine Module Administration Guide or the Cisco 4700 Series Application Control Engine Appliance Administration Guide on cisco.com. If you need to install licenses at this point, go to Step 5. If you do not need to install licenses at this point, go to Step 6. Step 5 Install one or more ACE licenses (see the “Managing ACE Licenses” section on page 6-36). Note For an ACE primary and secondary HA pair, because each ACE license is only valid on a single hardware device, licenses are not synchronized between HA peer devices. You must install an appropriate version of each license independently on both the primary and secondary ACE devices. 3-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using ACE Hardware Setup Step 6 Click SNMP v2c Read-Only Community String under ACE Hardware Setup (Config > Guided Setup > ACE Hardware Setup > SNMP v2c Read-Only Community String). The SNMP v2c Read-Only Community String window appears. Perform the following actions to configure an SNMP community string (a requirement for an ACE to be monitored by ANM): a. Click Add (+) at the top of the SNMP v2c Read-Only Community String table to create an SNMP community string. The New SNMP v2c Community window appears. Note For ANM to monitor an ACE, you must configure an SNMPv2c community string in the Admin virtual context. b. In the Read-Only Community field, enter the SNMP read-only community string name. Valid entries are unquoted text strings with no spaces and a maximum of 32 characters. Additional SNMP configuration selections are available under Config > Devices > context > System > SNMP. See the “Configuring SNMP for Virtual Contexts” section on page 6-27. Step 7 If you are configuring an ACE appliance, to group physical ports together on the ACE appliance to form a logical Layer 2 interface called the port-channel (sometimes known as EtherChannels), click Port Channel Interfaces under ACE Hardware Setup. The Port Channel Interfaces window appears (Config > Guided Setup > ACE Hardware Setup > Port Channel Interfaces). Note You must configure port channels on both the ACE appliance and the switch that the ACE is connected to. Perform the following actions to configure a port channel interface: a. If you want to poll the devices and display the current values, click Poll Now, and then OK when prompted if you want to poll the devices for data now. b. At the top of the Port Channel Interfaces table, click Add (+) to add a port channel interface, or choose an existing port channel interface and click Edit to modify it. The New Port Channel Interface window appears. Note If you click Edit, not all of the fields can be modified. c. Enter the port channel interface attributes as described in the “Configuring Port-Channel Interfaces for the ACE Appliance” section on page 12-35. d. Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. e. To display statistics and status information for a port-channel interface, choose the interface from the Port Channel Interfaces table and click Details. The show interface port-channel CLI command output appears. See the “Displaying Port Channel Interface Statistics and Status Information” section on page 12-40 for details. 3-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using ACE Hardware Setup Step 8 If you are configuring an ACE appliance, to configure one or more of the Gigabit Ethernet ports on the appliance, click GigabitEthernet Interfaces under ACE Hardware Setup. The GigabitEthernet Interfaces window appears (Config > Guided Setup > ACE Hardware Setup > GigabitEthernet Interfaces). a. If you want to poll the devices and display the current values, click Poll Now, and then OK when prompted if you want to poll the devices for data now. b. Choose an existing Gigabit Ethernet interface and click Edit to modify it. c. Enter the Gigabit Ethernet physical interface attributes as described in the “Configuring Gigabit Ethernet Interfaces on the ACE Appliance” section on page 12-32. d. Click Deploy Now when completed to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. e. Repeat Steps a through c for each Gigabit Ethernet interface that you want to configure. f. To display statistics and status information for a particular Gigabit Ethernet interface, choose the interface from the GigabitEthernet Interfaces table, then click Details. The show interface gigabitEthernet CLI command output appears. See the “Displaying Gigabit Ethernet Interface Statistics and Status Information” section on page 12-35 for details. Step 9 If the ACE is a member of an HA ACE pair, click VLAN Interfaces under ACE Hardware Setup. The VLAN Interfaces window appears (Config > Guided Setup > ACE Hardware Setup > VLAN Interfaces). Note To prevent loss of management connectivity during an HA configuration, you must configure the IP addresses of the management VLAN interface correctly for your HA setup. During this procedure, choose the management VLAN interface (and click the Edit button) and make sure its IP address, alias IP address, and peer IP address are all set correctly. You can repeat this process for any VLAN interfaces that you want. If the management VLAN is properly configured before establishing HA, you will be able to return later to reconfigure other VLANs. a. If you want to poll the devices and display the current values, click Poll Now, and then OK when prompted if you want to poll the devices for data now. b. Click Add to add a new VLAN interface, or choose an existing VLAN interface and click Edit to modify it. Note If you click Edit, not all of the fields can be modified. c. Enter the VLAN interface attributes as described in the “Configuring Virtual Context VLAN Interfaces” section on page 12-6. Click More Settings to access the additional VLAN interface attributes. By default, ANM hides the default VLAN interface attributes and the VLAN interface attributes which are not commonly used. d. Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. e. To display statistics and status information for a VLAN interface, choose the VLAN interface from the VLAN Interface table, then click Details. The output of the show interface vlan, show ipv6 interface vlan, and show ipv6 neighbor CLI commands appears. The IPv6 commands require ACE module and ACE appliance software Version A5(1.0) or later. See the “Displaying VLAN Interface Statistics and Status Information” section on page 12-18 for details. 3-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using ACE Hardware Setup Step 10 If the ACE is the primary peer in a high availability (HA) configuration, click HA Peering under ACE Hardware Setup (Config > Guided Setup > ACE Hardware Setup > HA Peering). a. Click Edit below the HA Management section to configure the primary ACE and the secondary ACE as described in the “Configuring ACE High Availability Peers” section on page 13-15. There are two columns, one for the selected ACE and another for a peer ACE. You can specify the following information: – Identify the two members of a HA pair. – Assign IP addresses to the peer ACEs. – Assign an HA VLAN to HA peers and bind a physical Gigabit Ethernet interface to the FT VLAN. – Configure the heartbeat frequency and count on the peer ACEs in a fault-tolerant VLAN. When completed, click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. Note For ACE modules, the HA VLAN specified for ACE HA Groups must also be set up on the Catalyst 6500 series switch using the svclc command. See the “Configuring VLANs Using Cisco IOS Software (ACE Module)” section on page 12-3 for details. b. Click Add below the ACE HA group table to add a new high availability group. Enter the information in the configurable fields as described in the “Configuring ACE High Availability Peers” section on page 13-15. When completed, click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The HA State field displays FT VLAN Compatible once HA setup has been successfully completed. Note To display statistics and status information for a particular HA group, choose the group from the ACE HA Groups table and click Details. The show ft group group_id detail CLI command output appears. See the “Displaying High Availability Group Statistics and Status” section on page 13-21 for details. Step 11 Once the HA State field in the ACE HA Groups table shows a successful state, the ACE is ready for further configuration as follows: • To set up additional virtual contexts, continue to the Virtual Context Setup task to create and connect an ACE virtual context. See the “Using Virtual Context Setup” section on page 3-10. • To set up an application in an existing virtual context, continue to the Application Setup task to set up load-balancing for an application from an ACE to a group of back-end servers. See the “Using Application Setup” section on page 3-12. Related Topics • Using Import Devices, page 3-4 • Configuring Devices, page 5-34 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 • Managing Devices, page 5-66 3-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using Virtual Context Setup Using Virtual Context Setup You can use the Virtual Context Setup task to create and connect an ACE virtual context. Virtual contexts use virtualization to partition your ACE appliance or module into multiple virtual devices, or contexts. Each context contains its own set of policies, interfaces, resources, and administrators. Before You Begin You must be in the Admin context on the ACE to create a new user context. Procedure Step 1 Choose Config > Guided Setup > Virtual Context Setup. The Virtual Context Setup window appears. Step 2 From the ACE Device drop-down list, choose an ACE. Step 3 Click Start Setup. The Resource Classes window appears (Config > Guided Setup > Virtual Context Setup > Resource Classes). Perform the following tasks to create or modify a resource class: a. If you want to create a resource class, click Add (+). The New Resource Class configuration window appears. Enter the resource information as described in the “Configuring Global Resource Classes” section on page 6-46. b. If you want to modify an existing resource, choose the resource class that you want to modify, then click Edit. The Edit Resource Class configuration window appears. Enter the resource information as described in the “Modifying Global Resource Classes” section on page 6-50. c. Click OK to save your entries and to return to the Resource Classes table. Make note of the resource class that you want to use because you will need it in Step 5. Step 4 Click Virtual Context Management under Virtual Context Setup. The Virtual Context window appears (Config > Guided Setup > Virtual Context Setup > Virtual Context Management). Perform the following actions to create or modify a virtual context: a. If you want to create a virtual context, click Add (+). The New Virtual Context window appears. Configure the virtual context as described in the “Configuring Virtual Contexts” section on page 6-8. b. If you want to modify an existing virtual context, choose the virtual context that you want to modify and click Edit. The Edit Resource Class configuration window appears. Enter the resource information as described in the “Modifying Global Resource Classes” section on page 6-50. Step 5 To create or modify the attributes of a virtual context, configure the virtual context as described in the “Configuring Virtual Contexts” section on page 6-8. When completed, click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. Follow these guidelines when creating or modifying the virtual context: • To connect the virtual context to the available VLANs, specify one or more VLANs in the Allocated VLANs field. You can specify multiple VLAN values and ranges (for example, “10, 14, 70-79”). • For virtual contexts configured for an ACE, do the following: 3-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using Virtual Context Setup – For an ACE appliance, you must set up all VLANs used in this step as trunk or access VLANs on the port channel or Gigabit Ethernet interfaces. If you did not set up these VLANs during the ACE Hardware Setup task, you can return to the ACE Hardware Setup window to configure the required VLANs. See the “Using ACE Hardware Setup” section on page 3-5. – For an ACE module, you must set up all VLANs used in this step as trunk or access VLANs on the Catalyst 6500 series switch using the svclc command. See the “Configuring VLANs Using Cisco IOS Software (ACE Module)” section on page 12-3 for details. • When specifying the resource class for the virtual context, choose the resource class that you created or specified in Step 3. Note If you are unsure of the resource class to use for this virtual context, choose default. You can change the resource class setting at a later time. • If HA has been correctly configured for this ACE device, the High Availability checkbox will be checked. If the checkbox is unchecked, check it to instruct ANM to automatically configure synchronization for this virtual context. Note The High Availability checkbox is available only if HA Peering has previously been completed for the ACE hardware. • If you want to set up a separate management VLAN interface for the virtual context, under Management Settings, configure the management interface for this virtual context and create an admin user. Each context also has its own management VLAN that you can access using the ANM GUI. In this case, you would assign an independent VLAN and IP address for management traffic to access the virtual context. Step 6 To edit the load-balancing configuration for a virtual context, continue to the Application Setup task. See the “Using Application Setup” section on page 3-12. Related Topics • Using Import Devices, page 3-4 • Using ACE Hardware Setup, page 3-5 • Information About Virtual Contexts, page 6-2 • Using Resource Classes, page 6-43 • Creating Virtual Contexts, page 6-2 • Configuring Virtual Contexts, page 6-8 • Configuring VLANs Using Cisco IOS Software (ACE Module), page 12-3 • Using Application Setup, page 3-12 3-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using Application Setup Using Application Setup This section includes the following topics on application setup: • ACE Network Topology Overview, page 3-12 • Using Application Setup, page 3-14 ACE Network Topology Overview With respect to ACE configuration, the network topology describes where—which VLAN or subnet—client traffic comes into the ACE and where this traffic is sent to real servers. Network configuration for ACE load balancing depends on the surrounding topology. By specifying to ANM the topology that is appropriate for your networking application, ANM can present more relevant options and guidance. The network topology is often determined solely by your existing network; however, the goals for your ACE deployment can also play a role. For example, when ACE acts as a router between clients and servers, it provides a level of protection by effectively hiding the servers from the clients. On the other hand, for a routed topology to work, each of those servers must be configured to route back through the ACE, which can be a significant change to the network routing. The ACE is also capable of bridging the client and server VLANs, which does not affect server routing. However, it does require the network to have VLANs set up appropriately. If you are not sure what topology to use, or do not want to make topology decisions immediately, use the “one-armed” topology. The one-armed topology does not typically require any changes to an existing network and can be set up with minimal knowledge of the network. You can then expand your ACE network topology to routed mode or bridged mode to better suit your networking requirements. Figure 3-1 illustrates the one-armed network topology. Figure 3-1 Example of a One-Armed Network Topology 247750 ACE Virtual Context Real Servers Router/ Switch Client to ACE Request Client IP (src): VIP (dst): 172.16.5.10 Client to ACE Request Nat Pool IP (src): 172.16.5.101 Server IP (dst): 192.168.1.11 ACE VLAN e.g. 172.16.5.0/16 Server VLAN e.g. 192.168.1.0/16 Client Network 3-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using Application Setup Figure 3-2 illustrates the routed mode network topology. Figure 3-2 Example of a Routed Mode Network Topology Figure 3-3 illustrates the bridged mode network topology. Figure 3-3 Example of a Bridged Mode Network Topology 247751 ACE Virtual Context Real Servers Router/ Switch Real Server Default Routes Client VLAN e.g. 172.16.5.0/16 Server VLAN e.g. 192.168.1.0/16 Client Network 247752 ACE Virtual Context Real Servers Router/ Switch Real Server Default Routes Client VLAN Server VLAN BVI e.g. 192.168.1.0/16 Client Network 3-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using Application Setup Using Application Setup You use the Application Setup task to set up load balancing for an application in which you choose an application type, virtual context to configure, and network topology (see Figure 3-4). ANM Guided Setup displays a list of configuration attributes to define that is based on your choice of application type and network topology. Figure 3-4 Guided Setup: Application Setup Guidelines and Restrictions The Application Type drop down list (see Figure 3-4) includes both non-template and template-based options. The template-based options are application definition templates that allow you to quickly configure one or more ACE virtual contexts (or devices) with a complex configuration for well known or custom in-house applications. A template can be a Cisco-defined system template or it can be user-defined. The number of system templates that display in the drop-down list increases as more of these templates become available during ANM upgrades or you import them into ANM from the Cisco Developers Network. For more information, see the “Information About Application Template Definitions and Instances” section on page 4-1. By default, all system templates display in the Application Type drop down list. You can edit a template so that it does not display in this list. For more information, see the “Editing an Application Template Definition” section on page 4-15. Procedure Step 1 Choose Config > Guided Setup > Application Setup. The Application Setup window appears. Step 2 From the Application Type drop-down list, choose an application as follows: 3-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using Application Setup • Non-template options—Choose one of the following application types if you do not want to create an application that is not based on a system or user-defined template: – Generic-SSL-HTTP—Choose this application type if your ACE is to use HTTPS when communicating with either the client or with real servers. – Generic-Non-SSL—Choose this application type if your ACE is to use HTTP when communicating with either the client or with real servers. These applications allow you to create an application that is more granular in terms of the number of attributes that you can configure using Guided Setup compared to an application based on a system or user template. • Template-based options—Choose one of the application types that are based on a system template provided with ANM or a user-defined template. Examples of system templates include the following: – Microsoft Exchange – Microsoft SharePoint For more informtion, see “Guidelines and Restrictions.” Step 3 From the Select Virtual Context drop-down list, choose an existing ACE virtual context. Step 4 Choose the network topology that reflects the relationship of the selected ACE virtual context to the real servers in the network. Topology choices include one-armed, routed, or bridged. See the “ACE Network Topology Overview” section on page 3-12 for background details on networking topology. Step 5 Click Start Setup. Step 6 Configure the attributes that are associated with the selected application type and topology and listed under Application Setup (see Figure 3-5) and described in Table 3-2, which includes all possible attributes. Figure 3-5 Navigating Application Setup Configuration Attributes 3-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using Application Setup Note As you complete and deploy an attribute configuration, go to the next one by clicking on the attribute listed under Application Setup (see Figure 3-5). Table 3-2 Guide Setup Configuration Attributes Attribute Description VLAN Interfaces To communicate with the client and real servers, a VLAN interface must be specified for client and server traffic to be sent and received. Perform the following actions to configure a VLAN interface: a. If you want to poll the devices and display the current values, click Poll Now, and then click OK when prompted to poll the devices for data. b. Click Add to add a new VLAN interface, or choose an existing VLAN interface and click Edit to modify it. c. Enter the VLAN interface attributes. Click More Settings to access the additional VLAN interface attributes. By default, ANM hides the default VLAN interface attributes and the VLAN interface attributes that are not commonly used. For configuration details, see the “Configuring Virtual Context VLAN Interfaces” section on page 12-6. Note After you define the VLAN, write down the VLAN number. You need this number when configuring the ACLs and Virtual Server attributes. d. Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. e. To display statistics and status information for a VLAN interface, choose the VLAN interface from the VLAN Interface table, then click Details. The output of the show interface vlan, show ipv6 interface vlan, and show ipv6 neighbor CLI commands appears. The IPv6 commands require ACE module and ACE appliance software Version A5(1.0) or later. See the “Displaying VLAN Interface Statistics and Status Information” section on page 12-18 for details. 3-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using Application Setup BVI Interfaces Perform the following actions to configure a BVI interface: a. If you want to poll the devices and display the current values, click Poll Now, and then OK when prompted if you want to poll the devices for data now. b. Click Add to add a new BVI interface, or choose an existing BVI interface, then click Edit to modify it. c. Enter the BVI interface attributes. For configuration details, see the “Configuring Virtual Context BVI Interfaces” section on page 12-19. Note After you define the BVI, write down the client-side VLAN number. You need this number when configuring the ACLs and Virtual Server attributes. d. Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. e. To display statistics and status information for a BVI interface, choose the BVI interface from the BVI Interface table, then click Details. The show interface bvi, show ipv6 interface bvi, and show ipv6 neighbors CLI commands output appears. The IPv6 commands require ACE module and ACE appliance software Version A5(1.0) or later. See the “Displaying BVI Interface Statistics and Status Information” section on page 12-26 for details. NAT Pools To set up a one-armed topology, you need a NAT pool to provide the set of IP addresses that ACE can use as source addresses when sending requests to the real servers. Note You must configure the NAT pool on the same VLAN interface that you configured in Step 6. Perform the following actions to create or modify a NAT pool for a VLAN: a. Click Add to add a new NAT pool entry, or choose an existing NAT pool entry and click Edit to modify it. The NAT Pool configuration window appears. b. Configure the NAT pool attributes. For configuration details, see the “Configuring VLAN Interface NAT Pools” section on page 12-26. Note After you define the NAT pool, write down the NAT pool ID. You specify the NAT pool ID when configuring the Virtual Server attributes. c. Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. Table 3-2 Guide Setup Configuration Attributes (continued) Attribute Description 3-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using Application Setup ACLs An ACL applies to one or more VLAN interfaces. Each ACL consists of a list of entries, each of which defines a source, a destination, and whether to permit or deny traffic between those locations. Perform the following actions to create or modify an ACL: a. Click Add to add a new ACL entry, or choose an existing ACL entry and click Edit to modify it. The Access List configuration window appears. b. Add or edit the required fields. For configuration details, see the “Configuring Security with ACLs” section on page 6-78. c. Click Deploy to save this configuration. d. To display statistics and status information for an ACL, choose an ACL from the ACLs table, then click Details. The show access-list access-list detail CLI command output appears. See the “Displaying ACL Information and Statistics” section on page 6-89 for details. SSL Proxy Note To terminate or initiate HTTPS connections with ACE, the virtual context must have at least one SSL proxy service. An SSL proxy contains the certificate and key information needed to terminate HTTPS connections from the client or initiate them to the servers. Perform the following actions to create or modify an SSL proxy service: a. To create an SSL proxy service, click SSL Proxy Setup. Note To edit an existing SSL proxy service, choose it from the SSL Proxy table, and click Edit to modify the SSL proxy service. The SSL Proxy Service configuration window appears. Edit the required fields as described in the “Configuring SSL Proxy Service” section on page 11-27. b. Add required fields. For configuration details, see the “Configuring SSL Proxy Service” section on page 11-27. c. Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. Table 3-2 Guide Setup Configuration Attributes (continued) Attribute Description 3-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using Application Setup Virtual Server The virtual server defines the load-balancing configuration for an application. Perform the following actions to create or modify a virtual server: a. If you want to poll the devices and display the current values, click Poll Now, and then OK when prompted if you want to poll the devices for data now. b. Click Add to add a new virtual server, or choose an existing virtual server, and click Edit to modify it. The Virtual Server configuration window appears with a number of configuration subsets. The subsets that you see depend on whether you use the Basic View or the Advanced View and entries you make in the Properties subset. Change views by using the View object selector at the top of the configuration pane. c. Add or edit required fields. For configuration details, see the “Virtual Server Configuration Procedure” section on page 7-7. Table 7-1 identifies and describes virtual server configuration subsets with links to related topics for configuration information. Virtual servers have many configuration options. At a minimum, you need to configure the following attributes: – Set the VIP, port number (TCP or UDP), and application protocol for your application. Note If the ACE is to terminate the client HTTPS connections, choose HTTPS as the Application Protocol. – (One-Armed Topology) For VLAN, choose the VLAN defined in VLAN Interfaces. – (Routed Topology) For VLAN, choose the client-side VLAN defined VLAN Interfaces. – (Bridged Topology) For VLAN, choose the client-side VLAN defined in VLAN Interfaces. – If the ACE is to terminate client HTTPS connections, then under the SSL Termination header, specify the SSL proxy defined in SSL Proxy. – Under the Default L7 Loadbalancing Action, set Primary Action to Loadbalance. – Create a server farm that contains one or more real servers for this application (see Table 7-13 in the “Configuring Virtual Server Layer 7 Load Balancing” section for details on setting server farm attributes). – If the ACE is to initiate HTTPS connections to the real servers, choose the desired SSL proxy for initiation to this application from the menu next to SSL Initiation. – (One-Armed Topology) Under NAT, enter the NAT pool ID from Step 8. After you set up a base virtual server, you can test it to validate your configuration and isolate any issues in your networking application. You can then add these more advanced load balancing options to your networking application: – Additional real servers to a server farm. See Table 7-13 in the “Configuring Virtual Server Layer 7 Load Balancing” section for details. – Health monitoring probes and attributes for the specific probe type. See Table 7-14 in the “Configuring Virtual Server Layer 7 Load Balancing” section for details. – Stickiness, where client requests for content are to be handled by a sticky group when match conditions are met. See Table 7-15 in the “Configuring Virtual Server Layer 7 Load Balancing” section for details. Table 3-2 Guide Setup Configuration Attributes (continued) Attribute Description 3-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 3 Using ANM Guided Setup Using Application Setup Related Topics • Using Import Devices, page 3-4 • Using ACE Hardware Setup, page 3-5 • Using Virtual Context Setup, page 3-10 • Configuring Virtual Context VLAN Interfaces, page 12-6 • Configuring Virtual Context BVI Interfaces, page 12-19 • Configuring Virtual Context Static Routes, page 12-28 • Configuring Virtual Context BVI Interfaces, page 12-19 • Configuring Security with ACLs, page 6-78 • SSL Setup Sequence, page 11-4 Virtual Server (continued) – Application protocol inspection, where the ACE allows the virtual server to verify protocol behavior and identify unwanted or malicious traffic passing through the ACE. See the “Configuring Virtual Server Protocol Inspection” section for details. d. Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. e. To display statistics and status information for an existing virtual server, choose a virtual server from the Virtual Servers table, then click Details. The show service-policy global detail CLI command output appears. See the “Displaying Virtual Server Statistics and Status Information” section on page 7-65 for details. Application Config You can create an application configuration or modify one that is staged (not deployed). Perform the following actions to create or modify an application configuration: a. Click Add to add a new application config, or choose an existing application config with a Type of Staged, and click Edit to modify it. The Application Configuration window appears. b. Configure or edit the required fields. For configuration details, see the “Creating an Application Template Instance” section on page 4-4. c. Do one of the following: - Click Deploy Now to deploy this application config on the ACE and save your entries to the running-configuration and startup-configuration files. - Click Save to save the information but not deploy the application config to the ACE. Use this option if you want to deploy or complete the configuration at a later time. Table 3-2 Guide Setup Configuration Attributes (continued) Attribute Description CHAPTER 4-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 4 Using Application Template Definitions Date: 3/28/12 This chapter describes how to use Cisco Application Networking Manager (ANM) application template definitions for configuring ACE virtual contexts. Note This chapter uses the terms “virtual context” and “device” interchangeably. Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • Information About Application Template Definitions and Instances, page 4-1 • Managing Application Template Instances, page 4-3 • Managing Application Template Definitions, page 4-15 Information About Application Template Definitions and Instances The ANM application template definitions allow you to quickly configure one or more ACE virtual contexts (or devices) with a complex configuration for well-known or custom in-house applications. A template is defined by an XML template definition file, which contains the configuration that is deployed to a device with place holders for variable replacement. The template variables are presented to the user in the ANM GUI. The two types of application template definitions are as follows: • System templates—Defined by Cisco and included in ANM for major applications. You can edit a system file to customize it if needed. 4-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Information About Application Template Definitions and Instances Examples of system templates are as follows: – Basic HTTP – DNS – DWS with Cisco Nexus 7000 OTV – FTP – Java Application Server – Layer 3 LB – Layer 4 LB – Microsoft Exchange 2010 – Microsoft SharePoint 2010 – RDP – Secure Webserver • User-defined templates—User defined for custom applications. You can create a user-defined template that is based on an existing template or you can create a template using the base code provided in this chapter. The template file follows a specific schema that is defined by ANM. All user-defined templates must follow this schema before ANM can deploy it to an ACE. You can create or edit a template using the internal ANM template editor or you can use the template export and import feature that allows you to use an external XML editor. Using application template definitions, you create application template instances, which are based on the template that you choose. You can display and manage application template instances on a global or device-specific level. Guidelines and Restrictions The variable fields of an application template definition are role-based access controlled (RBAC), which means that when you use a template to create an application template instance, your user account must be configured with the required roles that will allow you to enter the variable information. ANM does not allow you to enter variable information for those fields that you are not permitted to fill in. If you are not permitted to enter all the variable information, you can save the incomplete template instance with the information that you are allowed to input, and then have a user with the required roles complete the template instance so that it can be deployed. Related Topics • Managing Application Template Instances, page 4-3 • Managing Application Template Definitions, page 4-15 4-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Instances Managing Application Template Instances Application template instances are ACE configurations that you create based on a specific application template definition. ANM maintains a table of the template instances that you create using ANM, which you can view by doing one of the following: • To display the template instances of all devices, display the global view by doing one of the following: – Choose Home and from the Configuration category, choose Application Template Instances. – Choose Config > Global > Application Template Instances. • To display only the template instances associated with a specific device, choose Config > Devices > context > Load Balancing > Application Template Instances. The Application Template Instances window appears, displaying the information described in Table 4-1. From the Application Template Instances window, you can perform such tasks as creating, editing, deploying, or deleting a template instance. Note ANM tracks only application template instances that you create and deploy using ANM. It does not discover template instances that may reside on an ACE. For example, if you use the CLI to configure an ACE with a configuration that matches an installed application template configuration, you will not see this configuration listed as a template instance in the ANM GUI (Config > Global > Application Template Instances). This section includes the following topics: • Creating an Application Template Instance, page 4-4 • Deploying a Staged Application Template Instance, page 4-7 Table 4-1 Application Template Instances Window Field Description Name Application template instance name. Application Type Name of the application template definition used to create the template instance. Device Virtual context associated with the template instance. Type Template instance type as follows: • Staged—Template instance is saved but has not been deployed. • Deployed—Template instance is saved and deployed to the device. Status Current status of the template instance as follows: • Complete—Template instance attributes have all been defined and the template instance can be deployed if the Type field displays Staged (see the “Deploying a Staged Application Template Instance” section on page 4-7). • Incomplete—Template instance attributes have not all been defined so it cannot be deployed. This status is possible only when the Type field displays Staged. Last Updated Time Last time that ANM retrieved the status information. 4-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Instances • Editing an Application Template Instance, page 4-9 • Duplicating an Application Template Instance, page 4-10 • Viewing and Editing Application Template Instance Details, page 4-12 • Deleting an Application Template Instance, page 4-13 Creating an Application Template Instance You can create an application template instance by configuring a virtual context using an application template definition. Prerequisites You must have a user account with the following RBAC tasks assigned to it: ace_interface=modify, ace_access-list=modify, ace_ssl=modify, ace_vip=modify Procedure Step 1 Display the Application Template Instances window by doing one of the following: • Choose Home and from the Configuration category, choose Application Template Instances. • Choose Config > Devices > context > Load Balancing > Application Template Instances. • Choose Config > Global > Application Template Instances. For information about the information that is displayed, see Table 4-1. Note You can also create a template instance using Application Setup (see the “Using Application Setup” section on page 3-12). Step 2 From the Application Template Instances window, click the Add icon (+). The New Application Template Instance dialog box appears. Step 3 In the dialog box, do the following: a. From the Application Type drop-down list, choose one of the system templates provided with ANM or a user-defined template. The number of system templates that display in the drop-down list will increase as more templates become available and you import them into ANM. b. Click OK. The dialog box closes and the template configuration attributes appear in the Application Template Instances window. Step 4 (Optional) From the Application Template Instances window, choose one of the following view settings from the drop-down list located at the top of the window: • Basic View—Displays only the variable fields that require user input. Variable fields that are optional or are configured with default values are hidden. • Advanced View—Displays all available variable fields. 4-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Instances Note The Basic/Advanced display option appears only when a variable field in the application template definition file uses the “advanced” attribute (see the “Creating an Application Template Definition Using the ANM Template Editor” section on page 4-21). The DWS with Nexus 7000 OTV system template is an example of a template that uses the advanced attribute. Step 5 From the Application Template Instances window, configure the variable attributes. Table 4-2 describes some variable attributes that are associated with the system templates included with ANM. Use the information provided here to define the variables. Table 4-2 System Template Attributes Field Description Application Configuration Visual grouping of application-specific options. Application Config Name Name of the application that is used as a base name for many ACE objects, such as class maps, policy maps, stickies, or server farms. VIP Address/Exchange VIP Address Application server VIP address, which is generally the IP address that appears in DNS for the application. You can enter an IPv4 or IPv6 formatted address here; however, IPv6 requires ACE software Version A5(1.0) or later. Optionally, an IPv4 can include a prefix of /32 or less, and an IPv6 address can include a prefix of /128 or less. Real Server IP/ Client Access Servers (CAS)/ SharePoint Web Front End Servers Addresses IP addresses of the servers that are being load balanced. You can enter an IPv4 or IPv6 formatted address here; however, IPv6 requires ACE software Version A5(1.0) or later. Relative Probe URL File location that the ACE health check probes. FQDN Fully qualified domain name that is used for web host redirection. The %H string redirects based on the hostname in the header of the client HTTP requests. Web Front End Port Real server port on which the service is running. Secure communications between Load Balancers and Servers Check box option that when checked, instructs the ACE to use SSL to encrypt the traffic between it and the real servers. Key Type SSL key type. Choose one of the following from the drop-down list: • PKCS12 • DER • PEM SSL Key URL Field that appears only when the Key Type field is set to PKCS12 or DER. The TFTP, FTP, or SFTP URL including a key server IP address. You must use two forward slashes (//) to do absolute references; otherwise, the user home directory is used as the base path. Key Server Username Field that appears only when the Key Type field is set to PKCS12 or DER. The username to use for SFTP or FTP with the SSL key URL. Key Server Password Field that appears only when the Key Type field is set to PKCS12 or DER. The password to use for SFTP or FTP with the SSL key URL. SSL Key Field that appears only when the Key Type field is set to PEM. The SSL key that the ACE uses to decrypt and encrypt traffic from the client. 4-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Instances Step 6 Do one of the following: • Click Deploy to deploy the template instance to the device. The deployment verification popup window appears. Go to Step 7. Note The Deploy option requires a user account with the following RBAC task assigned to it: ace_virtualcontext=create. • Click Stage to save the template instance without deploying it to the specified virtual context. • Click Cancel to exit the configuration window without saving your changes. Step 7 From the popup window, do one of the following: • Click OK to deploy the template instance. The Deploy dialog box appears, which displays the list of configuration attributes to be deployed. Go to Step 8. • Click Cancel to exit this procedure without deploying the template instance. Step 8 In the dialog box, do the following: a. (Optional) Check the Create Named Checkpoint check box to create a checkpoint that ANM does not delete after a successful deployment. This check box works as follows: SSL Certificate Field that appears only when the Key Type field is set to PEM. The SSL certificate that the ACE presents to the client. Cert/Key Passphrase Optional passphrase that the key and certificate are encrypted. Session Persistence Check box option that when checked, enables session persistence. Depending on the type of template, the persistence type is generally either IP Netmask or HTTP Cookie. Redirect from 80 to 443 Check box option that when checked, configures an automatic HTTP redirect. Note When you enable this option, you must specify a FQDN. Network Configuration Visual grouping of network-specific options. Load Balancer (Device: Virtual Context) Virtual context to which the template is deployed. When you access the Application Template Instances window through device configurations (Config > Devices > context > Load Balancing > Application Template Instances), this field is already populated with the specified virtual context. When you access the Application Template Instances window through the Home page or global configuration, choose the virtual context from the drop-down device tree. Client VLANs VLANs on which client traffic originates. Enable Source NAT Check box option that when checked, specifies that traffic from the servers must have source NAT applied in order to return to the ACE. In general, you do not want to enable this feature if your ACE is installed in a one-armed network topology (see the “ACE Network Topology Overview” section on page 3-12). Note You must define NAT pools on the server interfaces before you select this option. Table 4-2 System Template Attributes (continued) Field Description 4-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Instances – Unchecked—ANM creates a checkpoint that you can revert back to if the deployment of the staged application template is unsuccessful. ANM assigns a random name to the checkpoint and deletes the checkpoint after a successful deployment. – Checked—ANM creates a checkpoint that you name and can revert back to at any time because ANM does not delete it even after a successful deployment. Note ACE virtual contexts have a limit of 10 checkpoints. If you attempt to exceed this limit, ANM does not deploy the template instance. b. Do one of the following: – Click Deploy Now. The template instance is applied to the device running-configuration and startup-configuration files. The Results window appears with the deployment status as follows: - Deployment Successful - Error in deploying template: error_details – Click Cancel to cancel the deployment. Related Topics • Information About Application Template Definitions and Instances, page 4-1 • Managing Application Template Instances, page 4-3 • Deploying a Staged Application Template Instance, page 4-7 • Editing an Application Template Instance, page 4-9 • Duplicating an Application Template Instance, page 4-10 • Viewing and Editing Application Template Instance Details, page 4-12 • Deleting an Application Template Instance, page 4-13 Deploying a Staged Application Template Instance You can deploy an application template instance that has been saved (or staged) but not yet deployed to the device. Prerequisites You must have a user account with the following RBAC task assigned to it: ace_virtualcontext=create. Procedure Step 1 Display the Application Template Instances window by doing one of the following: • Choose Home and from the Configuration category, choose Application Template Instances. • Choose Config > Devices > context > Load Balancing > Application Template Instances. • Choose Config > Global > Application Template Instances. For information about the information that is displayed, see Table 4-1. 4-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Instances Step 2 From the Application Template Instances window, choose the staged template instance to deploy and click Deploy. The deployment verification popup window appears. Step 3 From the popup window, do one of the following: • Click OK to deploy the template instance. One of the following popups appear depending on the template instance status: – Complete template instance—The Deploy dialog box appears, which displays the list of configuration attributes to be deployed. Go to Step 4. – Incomplete template instance—A popup window appears with the following message: The selected instance is not completely filled. Do you want to proceed to edit screen? Do one of the following: - Click OK to proceed to the edit window where you can complete the template instance as described in the “Editing an Application Template Instance” section on page 4-9. - Click Cancel to return to the Application Template Instances window. • Click Cancel to exit this procedure without deploying the template instance. Step 4 In the dialog box, do the following: a. (Optional) Check the Create Named Checkpoint check box to create a checkpoint that ANM does not delete after a successful deployment. This check box works as follows: – Unchecked—ANM creates a checkpoint that you can revert back to if the deployment of the staged application template is unsuccessful. ANM assigns a random name to the checkpoint and deletes the checkpoint after a successful deployment. – Checked—ANM creates a checkpoint that you name and can revert back to at any time because ANM does not delete it even after a successful deployment. Note ACE virtual contexts have a limit of 10 checkpoints. If you attempt to exceed this limit, ANM does not deploy the template instance. b. Do one of the following: – Click Deploy Now. The template instance is applied to the device running-configuration and startup-configuration files. The Results window appears with the deployment status as follows: - Deployment Successful - Error in deploying template: error_details – Click Cancel to cancel the deployment. Related Topics • Information About Application Template Definitions and Instances, page 4-1 • Managing Application Template Instances, page 4-3 • Creating an Application Template Instance, page 4-4 • Editing an Application Template Instance, page 4-9 4-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Instances • Duplicating an Application Template Instance, page 4-10 • Viewing and Editing Application Template Instance Details, page 4-12 • Deleting an Application Template Instance, page 4-13 Editing an Application Template Instance You can edit a staged application template instance. Guidelines and Restrictions This topic includes the following guidelines and restrictions: • To edit an application template instance, it must display as the type Staged. You cannot edit a template instance that displays as the type Deployed. • To retain the original template instance and make changes to a copy of it, go to the “Duplicating an Application Template Instance” section on page 4-10. Prerequisites You must have a user account with the following RBAC tasks assigned to it: ace_interface=modify, ace_access-list=modify, ace_ssl=modify, ace_vip=modify Procedure Step 1 View the list of application template instances by doing one of the following: • To display the template instances of all devices, display the global view by doing one of the following: – Choose Home and from the Configuration category, choose Application Template Instances. – Choose Config > Global > Application Template Instances. • To display only the template instances associated with a specific device, choose Config > Devices > context > Load Balancing > Application Template Instances. The Application Template Instances window appears, displaying the information described in Table 4-2. Step 2 From the Application Template Instances window, choose a staged template instance to edit and click the Edit icon ( ). The Application Configuration window appears, displaying the configured variable attributes. Step 3 From the Application Configuration window, edit the configuration as needed. For information about configuring the attributes, see Table 4-2. Step 4 When your edits are complete, do one of the following: • Click Deploy to deploy the template instance to the device. The deployment verification popup window appears. Go to Step 5. • Click Stage to save the template instance without deploying it to the specified virtual context. • Click Cancel to exit the configuration window without saving your changes. Step 5 From the popup window, do one of the following: • Click OK to deploy the template instance. The Deploy dialog box appears, which displays the list of configuration attributes to be deployed. Go to Step 6. 4-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Instances • Click Cancel to exit this procedure without deploying the template instance. Step 6 From the Deploy dialog box, do the following: a. (Optional) Check the Create Named Checkpoint check box to create a checkpoint that ANM does not delete after a successful deployment. This check box works as follows: – Unchecked—ANM creates a checkpoint that you can revert back to if the deployment of the staged application template is unsuccessful. ANM assigns a random name to the checkpoint and deletes the checkpoint after a successful deployment. – Checked—ANM creates a checkpoint that you name and can revert back to at any time because ANM does not delete it even after a successful deployment. Note ACE virtual contexts have a limit of 10 checkpoints. If you attempt to exceed this limit, ANM does not deploy the template instance. b. Do one of the following: – Click Deploy Now. The template instance is applied to the device running-configuration and startup-configuration files. The Results window appears with the deployment status as follows: - Deployment Successful - Error in deploying template: error_details – Click Cancel to cancel the deployment. Related Topics • Information About Application Template Definitions and Instances, page 4-1 • Managing Application Template Instances, page 4-3 • Creating an Application Template Instance, page 4-4 • Deploying a Staged Application Template Instance, page 4-7 • Duplicating an Application Template Instance, page 4-10 • Viewing and Editing Application Template Instance Details, page 4-12 • Deleting an Application Template Instance, page 4-13 Duplicating an Application Template Instance You can duplicate an existing application template instance, which allows you to create a new template instance based on the original one. Procedure Step 1 View the list of application template instances by doing one of the following: • To display the template instances of all devices, display the global view by doing one of the following: – Choose Home and from the Configuration category, choose Application Template Instances. 4-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Instances – Choose Config > Global > Application Template Instances. • To display only the application configurations associated with a specific device, choose Config > Devices > context > Load Balancing > Application Template Instances. The Application Template Instances window appears, displaying the information described in Table 4-1. Step 2 From the Application Template Instances window, choose the template instance to duplicate and click the Duplicate icon ( ). The Duplicate Application Config dialog box appears. Step 3 In the dialog box, enter the prefix to use for the duplicate and click OK. The dialog box closes and the Application Template Instances window appears, displaying the configuration attributes of the original template instance. Step 4 (Optional) From the Application Template Instances window, edit the variable attributes if needed. For information about configuring the attributes, see Table 4-2. Step 5 Do one of the following: • Click Deploy to deploy the template instance to the device. The deployment verification popup window appears. Go to Step 6. • Click Stage to save the template instance without deploying it to the specified virtual context. • Click Cancel to exit the configuration window without saving your changes. Step 6 From the popup window, do one of the following: • Click OK to deploy the template instance. The Deploy dialog box appears, which displays the list of configuration attributes to be deployed. Go to Step 6. • Click Cancel to exit this procedure without deploying the template instance. Step 7 In the dialog box, do the following: a. (Optional) Check the Create Named Checkpoint check box to create a checkpoint that ANM does not delete after a successful deployment. This check box works as follows: – Unchecked—ANM creates a checkpoint that you can revert back to if the deployment of the staged application template is unsuccessful. ANM assigns a random name to the checkpoint and deletes the checkpoint after a successful deployment. – Checked—ANM creates a checkpoint that you name and can revert back to at any time because ANM does not delete it even after a successful deployment. Note ACE virtual contexts have a limit of 10 checkpoints. If you attempt to exceed this limit, ANM does not deploy the template instance. b. Do one of the following: – Click Deploy Now. The template instance is applied to the device running-configuration and startup-configuration files. The Results window appears with the deployment status as follows: - Deployment Successful - Error in deploying template: error_details – Click Cancel to cancel the deployment. 4-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Instances Related Topics • Information About Application Template Definitions and Instances, page 4-1 • Creating an Application Template Instance, page 4-4 • Deploying a Staged Application Template Instance, page 4-7 • Editing an Application Template Instance, page 4-9 • Viewing and Editing Application Template Instance Details, page 4-12 • Deleting an Application Template Instance, page 4-13 Viewing and Editing Application Template Instance Details You can view the configuration details of an application template instance, such as the real servers and server farms associated with the template instance. The view details feature also allows you to open the configuration window of a specific attribute to make changes if needed. Guidelines and Restrictions This topic includes the following guidelines and restrictions: • You can view the details of deployed template instance but you cannot view the details of a staged template instance. • ANM tracks only application template instances that you create and deploy using ANM. It does not discover template instances that may reside on an ACE. For example, if you use the CLI to configure an ACE with a configuration that matches an installed application template configuration, you will not see this configuration listed as a template instance in the ANM GUI (Config > Global > Application Template Instances). Procedure Step 1 View the list of application template instances by doing one of the following: • To display the template instances of all devices, display the global view by doing one of the following: – Choose Home and from the Configuration category, choose Application Template Instances. – Choose Config > Global > Application Template Instances. • To display only the application template instances associated with a specific device, choose Config > Devices > context > Load Balancing > Application Template Instances. The Application Template Instances window appears, displaying the information described in Table 4-1. Step 2 From the Application Template Instances window, view the details of a configuration by choosing a template instance name and clicking Details. The Application Template Instance - Detail window appears, displaying details about the configuration objects. The information that displays varies depending on the template instance and user input. Configuration objects that can appear include the following: 4-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Instances Step 3 To view and edit one of the objects, click the Go To Config Page link. The associated attribute window opens, such as the Virtual Server, Real Server, or Server Farm window, where all the objects associated with the attribute display. For example, if you click the Go To Config Page link associated with a real server, the Real Servers window appears, displaying the complete table of real servers. You must locate the real server in the table to view its details and make changes to it if needed. Related Topics • Information About Application Template Definitions and Instances, page 4-1 • Managing Application Template Instances, page 4-3 • Creating an Application Template Instance, page 4-4 • Deploying a Staged Application Template Instance, page 4-7 • Editing an Application Template Instance, page 4-9 • Duplicating an Application Template Instance, page 4-10 • Deleting an Application Template Instance, page 4-13 Deleting an Application Template Instance You can delete an application template instance. Guidelines and Restrictions When you delete a deployed template instance, the virtual context configuration attributes that were added or modified as a result of deploying the application configuration are changed back to what they were prior to deploying the template instance, which means that if the virtual context was configured and operating prior to deploying the template instance, it reverts to operating with the previous configuration after you delete the template instance. • Virtual Servers • Probe • SSL Chain Group Parameters • Server Farms • SSL Proxy Service • SSL Parameter Maps • Real Servers • SSL Keys • HTTP Parameter Maps • Redirect Real Servers • SSL Certificates • TCP Parameter Maps • Sticky • SSL Auth Group Parameters • HTTP Header Modify Action Lists 4-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Instances Prerequisites You must have a user account with the following RBAC task assigned to it: ace_virtualcontext=create. Procedure Step 1 View the list of application configurations by doing one of the following: • To display the template instances of all devices, display the global view by doing one of the following: – Choose Home and from the Configuration category, choose Application Template Instances. – Choose Config > Global > Application Template Instances. • To display only the application template instances associated with a specific device, choose Config > Devices > context > Load Balancing > Application Template Instances. The Application Template Instances window appears, displaying the information described in Table 4-1. Step 2 From the Application Template Instances window, choose the template instance to delete and click the Delete icon ( ). ANM removes the template instance from the table. If the template instance was of the type Saved, no virtual context operations are affected. If the template instance was of the type Deployed, the associated virtual context operations are affected as described in “Guidelines and Restrictions” section on page 4-13. Related Topics • Information About Application Template Definitions and Instances, page 4-1 • Managing Application Template Instances, page 4-3 • Creating an Application Template Instance, page 4-4 • Deploying a Staged Application Template Instance, page 4-7 • Editing an Application Template Instance, page 4-9 • Duplicating an Application Template Instance, page 4-10 • Viewing and Editing Application Template Instance Details, page 4-12 4-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions Managing Application Template Definitions ANM maintains a table of the application template definitions, which you can view by choosing Config > Global > Application Template Definitions. The Application Template Definitions window appears, displaying the information described in Table 4-3. From the Application Template Definitions window, you can create, edit, export, import, and test application template definitions. This section includes the following topics: • Editing an Application Template Definition, page 4-15 • Creating an Application Template Definition, page 4-20 • Exporting an Application Template Definition, page 4-26 • Importing an Application Template Definition, page 4-26 • Testing an Application Template Definition, page 4-28 • Deleting an Application Template Definition, page 4-29 • Using the ANM Template Editor, page 4-29 Editing an Application Template Definition You can edit the XML code of an application template definition file from within ANM using the template editor that comes with ANM, or you can export the template definition file and edit it outside of ANM using an XML editor or text editor such as WordPad. To help you understand how a template can be edited to suit your particular requirements, this section includes an example that involves editing the probe information in the Basic HTTP system template. In the code editing example, the probe interval value is changed from a set value of 60 seconds to a variable with a default of 60 seconds. This change allows you to configure the interval value when you use the template to create an application template instance (see the “Creating an Application Template Instance” section on page 4-4). Table 4-3 Application Template Definitions Window Fields Field Description Application Type Template name. Version Template version. Template Type Template type: User-defined or System (Cisco defined). Description Template description that indicates the type of network application in which the template configures the ACE. Validity Icons that indicate the validity of a template as follows: • Check mark—Template conforms to the XML schema and can be deployed to an ACE. • Error icon (!)—Template does not conform to the XML schema and cannot be deployed to an ACE. 4-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions Figure 4-1 highlights the XML code for the probe URI variable and its set interval value. The figure also shows the GUI window that the code produces, including the variable field for inputting the relative probe URI. Figure 4-1 Basic HTTP Template: Probe with Set Interval Value You can modify a template to fit your particular requirements. Figure 4-2 highlights the probe code that was added or modified to produce a variable field in the GUI that allows you to set the probe interval if you do not want to use the default value of 60 seconds. 4-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions Figure 4-2 Modified Basic HTTP Template: Probe with Variable Interval Setting Table 4-4 describes the XML code and ANM GUI changes called out in Figure 4-2. Table 4-4 Example XML Code and ANM GUI Changes Item Description Code Changes 1 Modified code that changes the template version number from 1 to 1.1. 2 New code that defines a probe interval variable (probe_interval) that has a default value of 60. 3 Modified code that changes the set probe interval value (60) to a variable ($probe_interval). GUI Changes 4 Modified template identification bar that includes the new version number (1.1). 5 New user field that allows the user to specify a probe interval other than the default of 60. 4-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions Guidelines and Restrictions This topic includes the following guidelines and restrictions: • You can edit the template definition within ANM using the ANM template editor or you can export the template file, edit the code using a text editor such as WordPad, and then import the modified template file. • When editing a system template file, in the XML code you must change the template type or version number (or both). • By default, templates that you created using the ANM template editor display as options when using Application Setup in Guided Setup (see the “Using Application Setup” section on page 3-14). To configure a template not to display in Application Setup, either change the following code in the template root element from true to false or remove this piece of code from the root element: showsInGuidedSetup=”false” This section includes the following topics: • Editing an Application Template Definition Using the ANM Template Editor, page 4-18 • Editing an Application Template Definition Using an External Editor, page 4-19 Editing an Application Template Definition Using the ANM Template Editor You can use the template editor that comes with ANM to modify an application template definition from within ANM. Procedure Step 1 Choose Config > Global > Application Template Definitions. The Application Template Definitions window appears, displaying the information described in Table 4-3. Step 2 From the Application Template Definitions window, choose the template to edit and click the Edit icon ( ). The template editor window appears, displaying the template code. Step 3 Edit the code as needed. For information about using the ANM template editor to make your edits, see the “Using the ANM Template Editor” section on page 4-29. Step 4 When your edits are complete, do one of the following: • Click Validate to have ANM validate the application template definition file, which means that ANM checks to see that it is a well-formed XML document that follows the rules defined by the ANM Template XML schema. ANM highlights any errors in the code. • Click Save to save your changes using the same filename. This button is not available when you edit a system template (you must use the Save As option). • Click Save As to open the Save As New Template Definition popup window and save your changes under a new application type or version. The popup window text fields are populated with the attributes of the original file opened with the exception of the Version field, which ANM increments by one. If the version is not a number, the “-next” suffix is added to the version. From the popup window, modify the file attributes if needed and click Save. 4-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions Note When using the Save As feature, ANM does not allow you to save a template using the same application type and version number as the original template file. You must change either the application type or the version number. • Click Exit to exit the template editor and return to the Application Template Definitions window. Related Topics • Information About Application Template Definitions and Instances, page 4-1 • Editing an Application Template Instance, page 4-9 • Managing Application Template Definitions, page 4-15 • Editing an Application Template Definition Using an External Editor, page 4-19 • Testing an Application Template Definition, page 4-28 • Deleting an Application Template Definition, page 4-29 • Using the ANM Template Editor, page 4-29 Editing an Application Template Definition Using an External Editor You can export an application template definition file, modify it using a text editor, and then import it back into ANM. Prerequisites You must have a text editor (minimum) such as WordPad or an XML editor (preferred). Procedure Step 1 Choose Config > Global > Application Template Definitions and export the template to edit from the list of available templates. For details, see the “Exporting an Application Template Definition” section on page 4-26. Step 2 Using a text editor such as WordPad, open the template XML file that you exported in Step 1. Step 3 Modify the template identification by doing one or both of the following in the header code: • Assign a new value to the applicationType attribute. • Change the version number attribute. In the example (see Figure 4-2), the template version number is changed from 1 to 1.1. version=”1.1” Note When you change the template name or version number and import the template, ANM displays the template as a new line item in the Application Template Definitions window even if you save the file under the same name (see Step 5). Step 4 Modify the operation of the template as needed. In the example (see Figure 4-2), the following changes are made: 4-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions • The template version number is changed from 1 to 1.1. version=”1.1” • The input variable name probe_interval is added and defined as having a default value of 60 (seconds). • The slb code for the probe interval is changed from the set value of 60 to the {$probe_interval} variable. – To hide a variable array in Basic view, add the advanced attribute to the variable array as follows: 4-22 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions Note ANM does not display the drop-down list for Basic and Advanced viewing options when the advanced attribute is not used in the XML code. Procedure Step 1 Choose Config > Global > Application Template Definitions. The Application Template Definitions window appears, displaying the list of existing templates. Step 2 Click Add (+) to begin creating a new template. The Create New Template Definition dialog box appears. Step 3 From the dialog box, do the following: a. In the Application Type field, enter a brief description of the intended application. b. In the Version field, enter the template version number. By default, this field is set to 1.0. c. In the Description field, describe the intended use of the template. d. Check the Load Balance check box if the configuration is to perform load balancing (it is checked by default). If you uncheck the check box, go to Step e. If you check the check box, do the following: – From the vserver type drop-down list, choose the virtual server type: http, dns, ftp, rdp, terminated-https, or other. – Check the Sticky check box to enable sticky (it is unchecked by default). If you check the check box, choose one of the following from the sticky type drop-down list: ip-sticky, http-cookie-sticky, or http-header-sticky. – Check the SSL check box to include in the template a configuration block with an SSL termination proxy (it is unchecked by default). e. Do one of the following: – Click Go to Editor to open the template editor and the template base code, which is configured with the information that you provided. Go to Step 4. – Click Cancel to return to the The Application Template Definitions window. Step 4 Edit the code as needed. For information about using the ANM template editor to make your edits, see the “Using the ANM Template Editor” section on page 4-29. Step 5 (Optional) Tag specific variable fields or variable arrays with the advanced attribute, which enables the Basic/Advanced display feature when creating a template instance that uses this application template definition. When creating an application template instance, the Basic/Advanced display feature allows the user to set the view to Basic, which displays only the variable fields that require their input. For more information about configuring this feature, see the “Guidelines and Restrictions” section on page 4-21. 4-23 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions Step 6 When your edits are complete, do one of the following: • Click Validate to have ANM validate the application template definition file, which means that ANM checks to see that it is a well-formed XML document that follows the rules defined by the ANM Template XML schema. ANM highlights any errors in the code. • Click Save to save your changes. Related Topics • Managing Application Template Definitions, page 4-15 • Editing an Application Template Definition, page 4-15 • Creating an Application Template Definition, page 4-20 • Using the ANM Template Editor, page 4-29 • Testing an Application Template Definition, page 4-28 • Deleting an Application Template Definition, page 4-29 • Creating an Application Template Instance, page 4-4 Creating an Application Template Definition Using an External XML Editor You can create a basic ACE application template definition using an external XML editor rather than the template editor that comes with ANM. The procedure shows how to create a base XML file with which to base your template on and then use the free form XML tag to encapsulate ACE CLI commands that you copy from a known working configuration and paste into the template. The example template that you create during the procedure will initialize a virtual context by doing the following: • Specify a variable message of the day (MOTD) field. • Enable logging. • Specify a number of SNMP attributes, some of which are variables. Guidelines and Restrictions The ability to create a complex template requires a knowledge of XML programming and the ACE CLI and is beyond the scope of this guide. For information about creating complex templates for configuring your ACEs, go to the Cisco Developer Network (CDN) site at the following URL: http://developer.cisco.com/web/anm/application-templates Prerequisites This topic has the following requirements: • Basic knowledge of XML programming and the ACE CLI. • Text editor (minimum), such as WordPad, or an XML editor (preferred). • The application template definition XML schema. You can obtain a copy of this file from the CDN site at the following URL: http://developer.cisco.com/web/anm/docs From this site, use the schemas hyperlink located under the “Application Template Schemas” heading to download the XML schema. 4-24 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions • Access to an ACE CLI and the output of the show running config command from which you copy the commands that you need and paste them into the template. Procedure Step 1 From the ACE CLI, enter the show running config command. Step 2 Create a folder in which to work while creating a template and place the application template definition XML schema file in it. Step 3 Using a text editor or XML editor, create an XML template file, save it to your work folder, and copy in the following base code: Step 4 Do the following (shown in bold text in the example): a. Assign values to the application type and provide a brief description. b. Within the input tags, add the required variable tags. c. Within the free form tags, paste the required ACE CLI commands that you copy from the show running config command output. In the following example, the modified code is shown in bold text: d. (Optional) Tag specific variable fields or variable arrays with the advanced attribute, which enables the Basic/Advanced display feature when creating a template instance that uses this application template definition. When creating an application template instance, the Basic/Advanced display feature allows the user to set the view to Basic, which displays only the variable fields that require their input. For more information about configuring this feature, see the “Guidelines and Restrictions” section on page 4-21. e. To configure a template not to display in Application Setup, change the following code in the template root element from true to false: showsInGuidedSetup=”false” By default, templates that you create using the base code in Step 3 display as options when using Application Setup in Guided Setup (see the “Using Application Setup” section on page 3-14). Step 5 Save the template file as an .xml file. Step 6 (Optional) Do the following: a. Import the template into ANM (see the “Importing an Application Template Definition” section on page 4-26). b. From ANM, test the template (see the “Testing an Application Template Definition” section on page 4-28). c. From ANM, create an application template instance using the new template and deploy it (see the “Creating an Application Template Instance” section on page 4-4). Related Topics • Managing Application Template Definitions, page 4-15 • Editing an Application Template Definition, page 4-15 • Creating an Application Template Definition, page 4-20 • Exporting an Application Template Definition, page 4-26 • Importing an Application Template Definition, page 4-26 • Testing an Application Template Definition, page 4-28 • Deleting an Application Template Definition, page 4-29 • Creating an Application Template Instance, page 4-4 4-26 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions Exporting an Application Template Definition You can export an application template definition for editing or to create a backup that you can import into another ANM server. Procedure Step 1 Choose Config > Global > Application Template Definitions. The Application Template Definitions window appears, displaying the information described in Table 4-3. Step 2 From the Application Template Definitions window, choose the template to export and click Export. The File Download dialog box opens. Step 3 From the File Download dialog box, click Save. The Save As dialog box window appears. Step 4 From the Save As dialog box, navigate to where you want to save the template definitions file. Rename the file if you want. Step 5 Click Save. The template definitions file is saved to the specified location. Related Topics • Information About Application Template Definitions and Instances, page 4-1 • Managing Application Template Definitions, page 4-15 • Editing an Application Template Definition, page 4-15 • Creating an Application Template Definition, page 4-20 • Importing an Application Template Definition, page 4-26 • Testing an Application Template Definition, page 4-28 • Deleting an Application Template Definition, page 4-29 Importing an Application Template Definition You can import an application template definition. The import process checks the file to ensure that the XML conforms to the application template schema, using valid tags and attributes. Guidelines and Restrictions This topic includes the following guidelines and restrictions: • ANM allows you to import files that do not conform to the XML schema and does the following: – Issues an error message when importing the file that indicates the detected issues. – Places an error icon in the Validity column of the template listing in the Application Template Definitions window (Config > Global > Application Template Definitions). 4-27 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions This feature allows you import a template file that is not complete and that you may want to edit further using the ANM template editor (see the “Editing an Application Template Definition Using the ANM Template Editor” section on page 4-18). • The import process does not check the file to ensure that the ACE configuration attributes are structured correctly. To test the ACE configuration attributes, use the template test feature (see the “Testing an Application Template Definition” section on page 4-28). • You can import application template definitions that you created for use with ANM 5.1, which used an earlier version of the XML schema. When you import the template, ANM modifies the template root element as required by the current version of the XML schema. This modification does not affect the ACE configuration. Procedure Step 1 Choose Config > Global > Application Template Definitions. The Application Template Definitions window appears, displaying the information described in Table 4-3. Step 2 From the Application Template Definitions window, click Import. The Select a Template Definition File to Upload dialog box appears. Step 3 In the dialog box, click Browse to navigate to and choose the template file to upload. Step 4 Click Upload. The upload status box appears and displays one of the following messages: • “Template is imported”—The template definition conforms to the XML schema. Click OK to close the popup window and complete the upload process. • “Template is not imported because its XML structure is not valid”—ANM detected that the file does not contain properly structured XML code and cannot import the file. • “Template is not imported because upload error was found”—A system or network error has occurred that prevented the upload. This message is not an indication that a problem exists with the template. • “Template is imported, but the following errors were found”—The template contains properly structure XML code; however, the code does not conform to the XML schema. The message includes the errors found in the code. ANM displays the template in the Application Template Definitions window. Related Topics • Information About Application Template Definitions and Instances, page 4-1 • Managing Application Template Definitions, page 4-15 • Editing an Application Template Definition, page 4-15 • Creating an Application Template Definition, page 4-20 • Exporting an Application Template Definition, page 4-26 • Testing an Application Template Definition, page 4-28 • Deleting an Application Template Definition, page 4-29 4-28 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions Testing an Application Template Definition You can test an application template definition. The test performs the following tasks: • Displays the application configuration window to verify that the variable information the user is expected to fill in displays correctly. • Performs a test deployment and displays the configuration attributes that will be deployed for a live application configuration deployment. If there is a problem with the template definition, an error message displays that indicates what the problem is with the source code. Note The test deployment is done locally on ANM only. No commands are sent to an ACE. Procedure Step 1 Choose Config > Global > Application Template Definitions. The Application Template Definitions window appears, displaying the information described in Table 4-3. Step 2 From the Application Template Definitions window, choose a template to test and click Test. The Application Configuration window appears. Step 3 From the Application Configuration window, enter the required variable information and click Test Deploy. The Test popup window appears displaying the application configuration attributes that the template generates. Note If the template contains a boolean statement that allows you to choose one of two values, be sure to test both values. For example, if the template includes the Secure Backend Servers checkbox option, test the template with the check box checked (enabled) and unchecked (disabled). Step 4 Click Cancel to close the Test popup window and return to the Application Template Definitions window. Related Topics • Information About Application Template Definitions and Instances, page 4-1 • Managing Application Template Definitions, page 4-15 • Editing an Application Template Definition, page 4-15 • Creating an Application Template Definition, page 4-20 • Exporting an Application Template Definition, page 4-26 • Importing an Application Template Definition, page 4-26 • Deleting an Application Template Definition, page 4-29 4-29 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions Deleting an Application Template Definition You can delete a user-defined application template definition. Guidelines and Restrictions You cannot delete a system template. Caution When you delete an application template definition and you have staged application template instances that were created using the template, you cannot edit or deploy the template instances. Procedure Step 1 Choose Config > Global > Application Template Definitions. The Application Template Definitions window appears, displaying the information described in Table 4-3. Step 2 From the Application Template Definitions window, choose a user-defined template to delete and click the Delete icon ( ). The Delete Verification popup window appears. Step 3 From the popup window, do one of the following: • Click OK to delete the template. • Click Cancel to ignore the template delete request. Related Topics • Information About Application Template Definitions and Instances, page 4-1 • Managing Application Template Definitions, page 4-15 • Editing an Application Template Definition, page 4-15 • Creating an Application Template Definition, page 4-20 • Importing an Application Template Definition, page 4-26 • Exporting an Application Template Definition, page 4-26 • Testing an Application Template Definition, page 4-28 Using the ANM Template Editor ANM includes a template editor that you can use to create or edit application template definitions from within the ANM GUI. This section describes the editor components and how to use them. You access the ANM template editor by doing one of the following: • Create a new template (see the “Creating an Application Template Definition Using the ANM Template Editor” section on page 4-21). • Edit an existing template (see the “Editing an Application Template Definition Using the ANM Template Editor” section on page 4-18). 4-30 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions Figure 4-3 shows a sample view of the ANM template editor. The sample code includes invalid code in line 6 to show how the editor highlights problem code. Figure 4-3 ANM Template Editor Components Table 4-5 describes the editor GUI components called out in Figure 4-3. Table 4-5 ANM Template Editor Component Descriptions Item Description 1 Template Identifier Template type and version number. ANM displays an asterisk (*) next to the template type to indicate that a change to the template has been made but not saved. 4-31 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions 2 Tool Bar Editing tools that work as follows: • Undo button—With each click, undoes the changes that you made but did not save, beginning with the most recent change made. • Redo button—With each click, redoes the changes reversed by the Undo button, beginning with the most recent undo operation. • Fix Indentation button—Corrects any indentation errors in the code. • Wrap with: – If button—Wraps the code that you highlight with the “if” opening and closing tags to create an if block. – For button—Wraps the code that you highlight with the “foreach” opening and closing tags to create a foreach block. If you do not highlight the code to wrap, ANM places the If or For block at the location of the cursor. • Toggle Comments button—Makes the code that you highlighted a comment. You can use this feature to add description comments to sections of the code. You can also tag incomplete code as a comment until you are ready to complete it. At that time, you would highlight the commented code and click Toggle Comments again. • Search text box—String to locate in the code. The template editor highlights all instances of the string. Use the following associated tools: – Up button—Moves to the next instance of the search string above the currently highlighted instance. – Down button—Moves to the next instance of the search string below the currently highlighted instance. • Replace text box—String that is to replace the search string as follows: – Replace button—Replaces only the currently highlighted occurrence of the search string. – Replace All button—Replaces all occurrences of the search string. 3 Work Area Area where the code is displayed and modified. The work area includes the following editing tools: • Code folding—Allows you to expand or collapse sections of code as follows: – —Collapses code group. – —Expands code group. ANM hides these icons and expands the code when an error exists. • Code auto complete—ANM completes the code tag being entered or displays a list of possible options that match what has been entered so far. This feature works for a predefined set of elements only and is not available with every element type. To use this feature, begin entering the start-tag and then press Ctrl + Space. Enter at least one character after the open character (<) before pressing Ctrl + Space. For example: Press Ctrl + Space Table 4-5 ANM Template Editor Component Descriptions (continued) Item Description 4-32 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 4 Using Application Template Definitions Managing Application Template Definitions 4 Error and Warning Indicators Icons that appear when the code that does not conform to the XML schema as follows: • —Warning indicator: Error exists; however, the error will not prevent deployment of the template. • —Error indicator: Error exists that will prevent deployment of the template. For details about the indicated error, see the Error Description Pane located at the bottom of the window or hover over the icon to open the popup error message display. 5 Error Description Pane Descriptions of the detected errors in the code, which are also highlighted with Error and Warning Indicators. Because the error description text does not wrap, it can extend beyond the display. To view the entire description, hover over the message to open the popup error message display. Displayed errors remain in this pane until you fix the issue and validate the fix by clicking Validate. 6 Function Buttons Buttons that work as follows: • Validate—ANM validates the application template definition file, which means that ANM checks to see that it is a well-formed XML document that follows the rules defined by the ANM Template XML schema. When ANM detects errors in the code, it highlights the errors with Error and Warning Indicators and displays the Error Description Pane. If you correct the code and click Validate again, ANM removes the error indicators and closes the error description pane if no other errors exist. • Save—Saves your changes using the same filename. Note the following when using this button: – If any errors exist in the code, ANM displays a verification popup window, asking you to verify that you want to save the information regardless of the detected errors. – If the code is not properly structured, ANM displays an error message stating that the template cannot be saved because the XML structure is not valid. For example, if you enter a tag and do not close it, this error occurs. You must correct the code error before ANM allows you to save the template. – The Save button is not available when editing a system template, which requires that you use the Save As button. • Save As—Saves the file to a different filename. This option opens the Save As New Template Definition popup window to save your changes under a new application type name or version. From the popup window, modify the file attributes if needed and click Save. Note the following when using this button: – ANM populates the popup window text fields with the attributes of the original file opened with the exception of the Version field, which ANM increments by one. If the version is not a number, ANM adds the “-next” suffix to the version. – ANM does not allow you to save a template using the same application type and version number as the original template file. You must change either the application type or version number (or both). • Exit—Exits the editor without saving your changes. Table 4-5 ANM Template Editor Component Descriptions (continued) Item Description CHAPTER 5-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 5 Importing and Managing Devices Date: 3/28/12 This chapter describes how to import and manage Cisco Application Networking Manager (ANM) devices. You can import the following Cisco devices to ANM: • Application Control Engine (ACE) module or appliance • Global Site Selector (GSS) • Content Services Switch (CSS) • Catalyst 6500 Virtual Switching System (VSS) 1440 • Catalyst 6500 series switch • Cisco 7600 series router • Cisco Content Switching Module (CSM) • Cisco Content Switching Module with SSL (CSM-S) • VMware vCenter Server Note The terms add and import are interchangeable in this document. Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • Information About Device Management, page 5-2 • Information About Importing Devices, page 5-4 • Preparing Devices for Import, page 5-4 • Modifying the ANM Timeout Setting to Compensate for Network Latency, page 5-9 • Importing Network Devices into ANM, page 5-10 5-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Information About Device Management • Discovering Large Numbers of Devices Using IP Discovery, page 5-27 • Configuring Devices, page 5-34 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 • Managing Devices, page 5-66 • Replacing an ACE Module Managed by ANM, page 5-82 Information About Device Management ANM includes many device management features. You can import devices and then configure them for use in your network. In addition to configuring ports, VLANs, and routes, you can modify device configurations, and manage them. Table 5-1 identifies common management categories and related topics. Table 5-1 Device Management Options Device Management Activities Related Topics Importing devices • Information About Importing Devices, page 5-4 • Preparing Devices for Import, page 5-4 • Enabling SSH or Telnet Access on Catalyst 6500 Series Switches and Cisco 7600 Series Routers, page 5-5 • Modifying the ANM Timeout Setting to Compensate for Network Latency, page 5-9 • Importing Network Devices into ANM, page 5-10 • Importing Cisco IOS Host Chassis and Chassis Modules, page 5-11 • Importing ACE Appliances, page 5-21 • Importing CSS Devices, page 5-22 • Importing GSS Devices, page 5-23 • Importing VMware vCenter Servers, page 5-24 • Discovering Large Numbers of Devices Using IP Discovery, page 5-27 5-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Information About Device Management Configuring device attributes • Configuring Devices, page 5-34 • Configuring CSM Primary Attributes, page 5-34 • Configuring CSS Primary Attributes, page 5-35 • Configuring GSS Primary Attributes, page 5-36 • Configuring Catalyst 6500 Series Chassis and Cisco 7600 Series Router Primary Attributes, page 5-38 • Configuring Catalyst 6500 Series Chassis, Catalyst 6500 Virtual Switching System 1440 Devices, and Cisco 7600 Series Routers Static Routes, page 5-39 • Configuring VMware vCenter Server Primary Attributes, page 5-41 • Displaying Chassis Interfaces and Configuring High-Level Interface Attributes, page 5-42 • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 • Creating VLAN Groups, page 5-52 Configuring device role-based access control (RBAC) • Configuring Device RBAC Users, page 5-53 • Configuring Device RBAC Roles, page 5-56 • Configuring Device RBAC Domains, page 5-61 Managing devices • Synchronizing Device Configurations, page 5-66 • Mapping Real Servers to VMware Virtual Machines, page 5-68 • Instructing ANM to Recognize an ACE Module Software Upgrade, page 5-71 • Configuring User-Defined Groups, page 5-72 • Changing Device Credentials, page 5-75 • Changing ACE Module Passwords, page 5-77 • Restarting Device Polling, page 5-78 • Displaying All Devices, page 5-78 • Displaying Modules by Chassis, page 5-79 • Removing Modules from the ANM Database, page 5-80 Table 5-1 Device Management Options (continued) Device Management Activities Related Topics 5-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Information About Importing Devices Information About Importing Devices The quickest and easiest way to add devices to ANM is to import them individually using the Add function available at Config > Devices. If you already know the device IP address, you can use this procedure to add your devices to ANM. Before you begin importing, you need to set up your network devices so that ANM can communicate and monitor them. In the sections that follow, you will perform the following steps to prepare and import devices: 1. Enable SSH access (see the “Preparing Devices for Import” section on page 5-4). 2. Modifying the ANM timeout setting (see the “Modifying the ANM Timeout Setting to Compensate for Network Latency” section on page 5-9). Note This step is required only when network latency is causing a timeout issue that prevents ANM from establishing a communication link with the device to be imported. 3. Import devices (see the “Importing Network Devices into ANM” section on page 5-10). To add large numbers of devices, you can use IP Discovery before you import your devices. This process is not as efficient as using the Add function. IP Discovery shows where devices are but does not add the devices to ANM. We recommend that you use the Config > Devices > Device Management > Add function. For details on IP Discovery, see the “Discovering Large Numbers of Devices Using IP Discovery” section on page 5-27. Note Before importing a device, the ANM server pings the IP address of the device. If you have a firewall between the ANM server and the device that you want to import, your network administrator needs to modify the firewall to allow the ping traffic to reach the device or ACE. Preparing Devices for Import This section describes how to set up your devices to allow ANM to communicate with them and also describes the requirements for adding ACE devices that are high availability peers. ANM uses the following protocols for communication: • For communication to an ACE module or appliance: – XML over HTTPS – SSHv2 (read and write) – SNMP V2C (read-only) – Syslog over User Datagram Protocol (UDP) (inbound notifications only) • For communication to the Catalyst 6500 Virtual Switching System (VSS) 1440: – SSHv2 and Telnet (read and write) – SNMP V2C (read-only) – Syslog over UDP (inbound notifications only) • For communication to a Catalyst 6500 series switch, Cisco 7600 series router, CSM, or CSM-S: – SSHv2 and Telnet (read and write) 5-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Preparing Devices for Import – SNMP V2C (read-only) – Syslog over UDP (inbound notifications only) • For communication to the CSS: – Telnet (read and write) – SNMP V2C (read-only) – Syslog over UDP (inbound notifications only) • For communication to the GSS: – SSHv2 – Remote Method Invocation (RMI) over SSL Note Before you import a GSS device into ANM, you need to set the GSS communication on the GSS Ethernet interface that will be used to import the GSS into ANM. See the Cisco Global Site Selector Command Reference on Cisco.com for instructions on using the gss-communications command. • For communication to a VMware vCenter Server, HTTPS is used. Note For more information about communication between ANM and a VMware vCenter Server, see the “Prerequisites for Using ANM With VMware vSphere Client” section on page B-4 and “Guidelines and Restrictions” section on page B-5. This section includes the following topics: • Enabling SSH or Telnet Access on Catalyst 6500 Series Switches and Cisco 7600 Series Routers, page 5-5 • Enabling SSH Access and the HTTPS Interface on the ACE Module and Appliance, page 5-6 • Enabling SNMP Polling from ANM, page 5-7 • ANM Requirements for ACE High Availability, page 5-8 Enabling SSH or Telnet Access on Catalyst 6500 Series Switches and Cisco 7600 Series Routers You can choose to use Telnet or SSH to import a Catalyst 6500 series switch or Cisco 7600 series router in ANM. Telnet is enabled by default on the Catalyst 6500 series chassis. If you have disabled Telnet on the device, you need to enable it to perform the initial setup and import of an ACE module. If you plan to directly import an ACE module into ANM, Telnet is not mandatory on a Catalyst 6500 series switch. Note If you choose Telnet, the Use Telnet checkbox will be checked in the Primary Attributes window (see the “Configuring Catalyst 6500 Series Chassis and Cisco 7600 Series Router Primary Attributes” section on page 5-38). If you use SSH to communicate with the device, you must do the following: • SSHv2 must be enabled on the chassis, as well as the ACE, in order for ANM to add device information about the chassis. 5-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Preparing Devices for Import • Ensure that the chassis has a K9 (Triple Data Encryption Standard [3DES]) software image in order to enable the SSH server. The ANM requires SSHv2 to be enabled on the chassis. To enable SSH or Telnet access on Catalyst 6500 series switches or Cisco 7600 series routers, use the following commands: Enabling SSH Access and the HTTPS Interface on the ACE Module and Appliance You can enable SSH access and the HTTPS interface on the ACE modules and appliances. ANM uses SSH and XML over HTTPS to communicate with the ACE devices. You need to enable both SSH access and HTTPS as explained in this section. These settings can be enabled during device import as described in the “Importing Network Devices into ANM” section on page 5-10 or in the CLI. Note If the ACE module or appliance is new and still has its factory settings, you do not need to perform the procedure in this section because SSH is enabled by default. Note Ensure that the management policy applied on the management interface permits SSH. To enable SSH access and the HTTPS interface on an ACE module or appliance, enter the following commands in config mode in the Admin context: Command Purpose Step 1 ip ssh version 2 Enables SSHv2. Step 2 ip domain-name abc.com Step 3 crypto key generate rsa general-keys modulus 1024 Generates the key. Step 4 username username password password Enters the username and password. Step 5 line vty 0 4 Step 6 session-timeout 60 Step 7 login local This is an example only. This commands works for Cisco IOS 12.2.18SXF(10), but not for 12.2.18SXF(8). Step 8 transport input telnet ssh Allows SSH and Telnet to the chassis. Step 9 transport output telnet ssh Allows SSH and Telnet from the chassis to the ACE module. Command Purpose Step 1 ssh key rsa 1024 force Configures SSH access on the ACE. Step 2 access-list acl line 10 extended permit ip any any 5-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Preparing Devices for Import For more information about configuring SSH access on the ACE, see either the Cisco Application Control Engine Module Administration Guide or the Cisco 4700 Series Appliance Administration Guide on Cisco.com. Enabling SNMP Polling from ANM You can enable SNMP polling from ANM, which uses SNMPv2 for polling ACE, CSS, CSM, or CSM-S devices. To receive traps from these devices, ANM supports use of SNMPv2 traps. Note To send SNMP traps to ANM, configure the SNMP trap host to the ANM server so that it can receive traps from ANM. For alarm condition notifications, ANM uses SNMPv1 EPM-Notificaton-MIB based SNMP traps. For the ACE, in order for ANM to successfully perform SNMP polling, you must configure the ACE Admin context with a management IP with a suitable management policy that permits SNMP traffic. All other contexts can be polled using this Admin context management IP. For each device type (ACE, CSS, CSM, or CSM-S), see the corresponding configuration guide to configure the device to permit SNMP traffic. Step 3 class-map type management match-any ANM_management 2 match protocol ssh any 3 match protocol telnet any 4 match protocol https any 5 match protocol snmp any 6 match protocol icmp any 7 match protocol xml-https Configures discovery for ANM. The following comments apply to the line number specified before the command text in the left column: • Line 2 classifies the SSH traffic. • Line 4 is needed by ANM for making configuration changes on the ACE. • Line 5 is needed by ANM for periodic statistics. • Line 6 is not mandatory but useful for network and route validation. • Line 7 is needed only for ACE 4710 devices. Step 4 policy-map type management first-match ANM_management class ANM_management permit Allows protocols matched in the management class map. Step 5 interface vlan 30 ip address 192.168.65.131 255.255.255.0 access-group input acl service-policy input ANM_management no shutdown Configures a management interface with the ACL and specifies the management service policy. This configuration is not recommended for a client or server interface. Step 6 username admin password 5 $1$faXJEFBj$TJR1Nx7sLPTi5BZ97v08c/ role Admin domain default-domain Defined by the administrator. Step 7 ip route 0.0.0.0 0.0.0.0 192.168.0.1 Specifies the default route (or appropriate route) for traffic to reach ANM using the management interface if ANM is not on the same subnet. Command Purpose 5-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Preparing Devices for Import ANM Requirements for ACE High Availability ANM automatically identifies ACE high availability (HA) peers if both peers are imported into ANM. For ANM to identify two ACE devices (ACE modules or ACE appliances) as high availability peers, ANM looks for two ACE devices with the same fault-tolerant (FT) interface VLAN configuration and whose peer IP addresses are reversed. For example, ANM would consider Peer 1 with the following configuration: ft interface vlan 4000 ip address 10.10.10.1 255.255.255.0 peer ip address 10.10.10.4 255.255.255.0 and Peer 2 with the following configuration: ft interface vlan 4000 ip address 10.10.10.4 255.255.255.0 peer ip address 10.10.10.1 255.255.255.0 as HA peers because they both use FT interface VLAN 4000 and their IP and peer IP addresses are reversed. However, it is possible that multiple ACE devices imported into ANM have the same FT interface VLAN and IP address/peer IP address combinations. In this case, ANM is not able to identify the ACE HA pair correctly. To resolve this issue, ANM uses the following logic to determine that two ACE devices are an HA pair: 1. Two ACE devices could be identified as a HA pair if their FT interface VLAN IDs match and their FT interface IP and peer IP addresses are reversed. 2. If the Admin context management interface peer IP address is already defined, ANM will conclusively identify its HA peer if the other Admin context management interface reversely matches the management IP and peer IP addresses. 3. If both ACE Admin context management interface peer IP addresses are not defined, and their FT interface configuration combination is unique across all ACE devices, ANM will then identify them as an HA pair. 4. An ACE HA peer is identified as Inconclusive if there is a non unique FT interface configuration combination across all ACE devices and its Admin context management interface peer IP is not defined. When importing an ACE HA pair into ANM, you should follow one of the following configuration requirements so that ANM can uniquely identify the ACE HA pair: • Use a unique combination of FT interface VLAN and FT IP address/peer IP address for every ACE HA pair imported into ANM. For HA, it is critical that the combination of FT interface VLAN and IP address/peer IP address is always unique across every pair of ACE peer devices. • Define a peer IP address in the management interface using the management IP address of the peer ACE (module or appliance). The management IP address and management peer IP address used for this definition should be the management IP address used to import both ACE devices into ANM. An example is as follows: • ACE1 is imported into ANM with management IP 10.10.10.10. • ACE2 is imported into ANM with management IP 10.10.10.12. In this case, you would perform the following actions for both ACE1 and ACE2: • Update the management interface on ACE1 with IP address 10.10.10.10. to have 10.10.10.12 as the peer IP address. 5-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Modifying the ANM Timeout Setting to Compensate for Network Latency • Update the management interface on ACE2 with IP address 10.10.10.12 to have 10.10.10.10 as the peer IP address. An ACE module or appliance may have many other management interfaces defined, but ANM is particularly interested only in the management interface whose IP address is used for importing into ANM. When ANM is unable to determine a unique ACE HA peer pair, it displays an Inconclusive state in the ACE HA State column of the All Virtual Contexts table (Config > Devices > Virtual Context Management) or the Virtual Contexts listing page. The Inconclusive state indicates that ANM was able to determine that the given ACE was configured in HA; however, ANM was able to find more than one ACE module or ACE appliance that appeared to be a peer. In this case, ANM was unable to conclusively find a unique HA peer for the given ACE module or ACE appliance. You must then perform the actions outlined in this section to fix the ACE that is in this state. More information will appear in the tooltip for the Inconclusive state to specify whether this state was reached because the FT interface VLAN and the IP address/peer IP address was not unique, or because the peer IP address on the management interface was not unique. Based on the information provided to you in the tooltip for the Inconclusive state, you must update the ACE configuration as described in the configuration requirements outlined above. After you make these configuration changes, resynchronize the affected ACE devices in ANM to update the configuration and HA mapping. For more information about synchronizing virtual contexts, see the “Creating Virtual Contexts” procedure on page 6-2. Modifying the ANM Timeout Setting to Compensate for Network Latency You can adjust the amount of time that ANM waits for a response from a device that you want ANM to import. You may need to adjust the timeout value when network latency prevents ANM from establishing a communication link with the device to be imported. To establish communications between ANM and the device during the device import process, the device sends requests to ANM for the required device username and password information. After ANM provides the device username, it waits two seconds for the device to make the next request for the password. If network latency prevents the password request from arriving within two seconds of providing the username, the connection times out, preventing ANM from importing the device. This type of issue can occur when importing devices that are Telnet-managed or require remote user authentication. To compensate for the resulting network latency, you can modify the default two-second timeout value by editing the ANM cs-config.properties file. Procedure Step 1 Modify the timeout value to 20000 milliseconds (20 seconds) as follows: • ANM Server—Open the /opt/CSCOanm/etc/cs-config.properties file in a text editor and add the following line to the end of the file: telnet.transport.login.timeout=20000 • ANM Virtual Appliance—Enter the following command: anm-property set telnet.transport.login.timeout 20000 5-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM Step 2 Restart ANM as follows: • ANM Server—Enter the following command: /opt/CSCOanm/bin/anm-tool restart • ANM Virtual Appliance—Enter the following command: anm-tool restart Step 3 Import the device. See one of the following sections: • Importing Network Devices into ANM, page 5-10 • Discovering Large Numbers of Devices Using IP Discovery, page 5-27 Step 4 (Optional) If the timeout issue persists, slowly increase the timeout value by repeating this procedure. Do not increase the timeout value beyond 60000 milliseconds. Related Topics • Importing Network Devices into ANM, page 5-10 • Discovering Large Numbers of Devices Using IP Discovery, page 5-27 Importing Network Devices into ANM ANM allows you to add the following devices individually to its database: • ACE appliances • ACE modules • Catalyst 6500 series chassis • Catalyst 6500 Virtual Switching System (VSS) 1440 • Cisco 7600 series routers • Cisco Content Services Switch (CSS) devices • Cisco Content Switching Module (CSM) devices • Cisco Global Site Selector (GSS) devices • VMware vCenter Servers We recommend that you use the procedures in this section to add your devices to ANM because they are faster and more efficient than running IP Discovery (see the “Discovering Large Numbers of Devices Using IP Discovery” section on page 5-27). Guidelines and Restrictions This topic includes the following guidelines and restrictions: • When adding a module device, such as an ACE module or a CSM, you must first import the host chassis device, such as a Cisco Catalyst 6500 series switch chassis, and then you add the installed modules. The chassis device is referred to as a Cisco IOS device during the device import process. 5-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM • The time required to import devices depends on the number of appliances, chassis, modules, and contexts that you are importing. For example, an ACE appliance with 20 virtual contexts takes longer than an ACE appliance with 5 contexts. While ANM imports devices, you cannot perform other activities in the same session. You can, however, establish a new session with the ANM server and perform activities on other appliances, chassis, modules, or virtual contexts. • Network latency can prevent ANM from establishing a communication link with a device that you want to import. When ANM is providing the device with the device credentials (username and password), by default it waits two seconds after providing the device username for the password prompt to appear. The link times out when it takes longer than two seconds for the next prompt to appear. For information about possible causes of network latency that can create this issue and how to adjust the ANM timeout value, see the “Modifying the ANM Timeout Setting to Compensate for Network Latency” section on page 5-9. Prerequisites This topic includes the following prerequisites: • Before adding a device or ACE module, the ANM server pings the IP address of the device or ACE module. If you have a firewall between the ANM server and the device you want to import, your network administrator needs to modify the firewall to allow the ping traffic to reach the device or ACE module. • To import your devices successfully, ensure the following: – The ACE module or CSM has booted successfully and is in the OK/Pass state (enter the show module supervisor Cisco IOS CLI command to verify this action). – The ACE appliance or the CSS state is up and running. There is no command to validate whether these devices are up and running. This section includes the following topics: • Importing Cisco IOS Host Chassis and Chassis Modules, page 5-11 • Importing ACE Appliances, page 5-21 • Importing CSS Devices, page 5-22 • Importing GSS Devices, page 5-23 • Importing VMware vCenter Servers, page 5-24 Importing Cisco IOS Host Chassis and Chassis Modules This section shows how to import a Cisco IOS host chassis into ANM, such as the Catalyst 6500 series chassis or the Cisco 7600 series router. After you define the Cisco IOS device during the import process, you import the ACE or CSM modules that currently reside in the chassis and are detected by ANM. When you add additional modules to the Cisco IOS device, you import the new modules into ANM without having to redefine the host chassis. This section includes the following topics: • Importing Cisco IOS Devices with Installed Modules, page 5-12 • Importing ACE Modules after the Host Chassis has been Imported, page 5-16 • Importing CSM Devices after the Host Chassis has been Imported, page 5-19 • Importing VSS 1440 Devices after the Host Chassis has been Imported, page 5-20‘ 5-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM Importing Cisco IOS Devices with Installed Modules This section shows how to import the following Cisco IOS chassis devices into ANM along with any installed ACE modules or CSMs that ANM detects in the chassis: • Catalyst 6500 series chassis • Catalyst 6500 Virtual Switching System (VSS) 1440 • Cisco 7600 series routers Procedure Step 1 Choose Config > Devices > All Devices. The Device Management window appears. Step 2 In the device tree or in the All Devices table, click Add. The New Device window appears. Step 3 Enter the information for the device using the information in Table 5-2. Table 5-2 New Device Attributes Field Description Name Unique name for the device. Valid entries are unquoted text strings with no spaces and a maximum of 26 alphanumeric characters. Model Type of device to import. From the Model drop-down list, choose Cisco IOS Device. Primary IP IP address for the device in dotted-decimal format. Access Protocol Protocol to use for communication with the device. Choose Secure/SSH2 (default setting) or Telnet as the protocol that ANM uses to access the Cisco IOS devices. User Name Account name for device access. Note If you did not configure an account on the chassis before starting this procedure, you can enter an alphanumeric string with no spaces to complete this procedure. However, we recommend that you configure an account on the device to prevent unauthorized access. Password Password for the account. Enable Password Provides an extra level of security. SNMP v2c Enabled Check the SNMP v2c Enabled checkbox to configure SNMP access. Description Field that appears if you check the SNMP v2c Enabled checkbox. Enter the community string for the device. Note If you are adding a Catalyst 6500 series chassis, in the Community field, enter the SNMP community string already configured on the Catalyst 6500 series chassis. ANM uses this string to query device status information such as VLAN and interface status. This SNMP community string is also used for any CSM devices contained in the specified Catalyst 6500 series chassis. For Catalyst 6500 series chassis, CSS, and CSM devices, the SNMP community string already configured on the device is used by ANM for polling. For ACE modules and ACE appliances, the SNMP community string entered into ANM is configured on the ACE module/appliance and is used for polling the devices. Custom Prompt Settings 5-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM Step 4 Do one of the following: • Click Next to save your entries and import device information. A progress bar displays while ANM establishes a session with the chassis and collects information about the installed modules. When the information has been collected, ANM displays one of the following windows: – If no CSM devices or ACE or modules are associated with the chassis device, the All Devices table refreshes with the chassis information. – If CSM devices or ACE modules are associated with the chassis device, the Modules configuration window appears and displays information about the first detected module. To view the detected modules, continue to Step 5. • Click Cancel to exit the procedure without saving your entries and to return to the All Devices table. Clicking Cancel prevents device information from being imported and prevents ACE module discovery. Step 5 In the Modules window, verify the information of the first detected chassis module as described in Table 5-3 and use the Next and Previous buttons to navigate through the list of detected chassis modules. Custom Username Prompt Optional field for use with the Cisco Catalyst 6500 series switch and Cisco 7600 series router only. With either device, if you have it configured to use a TACACS+ server for remote authentication, you can also configure it to display a custom username prompt during the login process rather than the default username prompt. If you have the device configured to use a custom username prompt, enter the custom prompt in this field. Custom Password Prompt Optional field for use with the Cisco Catalyst 6500 series switch and Cisco 7600 series router only. With either device, if you have it configured to use a TACACS+ server for remote authentication, you can also configure it to display a custom password prompt during the login process rather than the default password prompt. If you have the device configured to use a custom password prompt, enter the custom prompt in this field. Table 5-2 New Device Attributes (continued) Field Description Table 5-3 Detected Modules in Imported Chassis Device Item Description Card Slot Chassis IP address, detected module type, and chassis slot number. For example, 10.10.10.1:ACE:2. Card Type Version information about the detected module. For example, ACE v2.3. This field displays major release information only. For example, 8.2x might be supported by a module, but only 8.2 displays. Module Has Been Imported Into ANM Read only information to indicate that the module has already been imported (checked) or that it has not been imported (unchecked). Operation To Perform Drop down list to specify the action to take as follows: • Do Not Import (default setting) • Import • Perform Initial Setup and Import 5-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM Step 6 To import a displayed module, in the Operation to Perform field, choose one of the following: • Import—ANM is to import the CSM device or ACE module. For the ACE module, ANM displays additional configuration fields when the Import option is selected. For both modules types, skip to Step 7 after selecting Import. • Perform Initial Setup And Import—(ACE module only) Allows you to perform initial setup manually required for ANM to communicate with the ACE module and imports ACE module configuration. Skip to Step 8. Note We recommend that you choose this option for ACE modules that are configured only with factory defaults. Step 7 If you chose Import for a CSM device or ACE module, do one of the following: • To import a CSM device, no further device information is required. Click Next or Previous to navigate to the next module to specify to import or click Finish to import the specified modules. • To import an ACE module, perform the following steps: a. In the Admin Context IP field, enter the module IP address. b. In the User Name field, enter the username for accessing this module. Valid entries are unquoted text strings with a maximum of 24 characters. The default admin credentials are admin/admin. Note For security reasons, we recommend that you change the username and password on your ACE device (and modules) after you import them. The security on your ACE module can be compromised because the administrative username and password are configured to be the same for every ACE module shipped from Cisco. See the “Changing ACE Module Passwords” procedure on page 5-77. c. In the Password field, enter the password for accessing this module. Reenter the password in the Confirm field. Valid entries are unquoted text strings with a maximum of 64 characters. The default admin credentials are admin/admin. d. Click Next or Previous to navigate to the next module to specify to import or click Finish to import the specified modules. Skip to Step 10. Step 8 If you chose Perform Initial Setup And Import for an ACE module, perform the following steps: a. In the Host Name field, enter a unique name for this ACE module. Valid entries are alphanumeric strings with no spaces and a maximum of 32 characters. b. In the Admin Context IP field, enter the IP address for this ACE module. c. In the Netmask field, from the drop-down list, choose the subnet mask to apply to this IP address. d. In the Gateway field, enter the IP address of the gateway router to use. e. In the VLAN field, choose the VLAN to which this module belongs. f. Check the Blade Is Configured With Factory Default Admin Credentials check box if the ACE module is currently configured with the default admin credentials (admin/admin). g. In the User Name field, enter the username for accessing this module. Valid entries are unquoted text strings with a maximum of 24 characters. The default admin credentials are admin/admin. 5-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM Note For security reasons, we recommend that you change the username and password on your ACE after you import it. The security on your ACE module can be compromised because the administrative username and password are configured to be the same for every ACE shipped from Cisco. See the “Changing ACE Module Passwords” procedure on page 5-77. h. In the Password field, enter the password for accessing this module. Reenter the password in the Confirm field. Valid entries are unquoted text strings with a maximum of 64 characters. The default admin credentials are admin/admin. Step 9 Do one of the following: • Click OK to save your entries and to continue with the device configuration. A progress bar reports status and the Device configuration window appears. • Click Cancel to exit the procedure without importing ACE modules and to return to the All Devices table. Note Clicking Cancel in this window does not cancel the chassis importing process. Step 10 (Optional) To confirm that the virtual contexts on the ACE module were successfully imported into ANM, do the following: a. Choose Config > Devices. The device tree appears. b. In the device tree, choose the chassis device and ACE module that you just imported. The Virtual Contexts table appears, listing the contexts for that device. c. Confirm that the contexts imported successfully: – If OK appears in the Config Status column, it means that the context imported successfully. – If Import Failed appears in the Config Status column, it means that the context did not import successfully. d. To synchronize the configurations for the context import that failed, choose the context, and then click Sync. ANM will synchronize the context by uploading it from the ACE device. For more information on synchronizing virtual contexts, see the “Creating Virtual Contexts” procedure on page 6-2. Note If you receive authentication errors or incorrect username/password errors when trying to import ACE devices, refer to the ACE documentation regarding username and password settings and limitations. Tip After you add an ACE module, see the “Enabling a Setup Syslog for Autosync for Use With an ACE” section on page 5-27 to enable auto sync, which allows ANM to synchronization with the ACE CLI when ANM receives a syslog message from the ACE rather wait the default polling period. Relate Topics • Importing ACE Modules after the Host Chassis has been Imported, page 5-16 • Importing CSM Devices after the Host Chassis has been Imported, page 5-19 5-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM • Importing ACE Appliances, page 5-21 • Importing CSS Devices, page 5-22 • Importing GSS Devices, page 5-23 • Importing VMware vCenter Servers, page 5-24 • Removing Modules from the ANM Database, page 5-80 • Synchronizing Module Configurations, page 5-67 Importing ACE Modules after the Host Chassis has been Imported You can add ACE modules into the ANM database at any time after the host chassis been added. Before You Begin • Ensure that the module to be imported has booted successfully and is in OK/Pass state. To check the module state, enter the show module supervisor Cisco IOS CLI command. • Note that time needed to import ACE modules depends on the number of modules and contexts that you are importing. For example, an ACE module with 20 virtual contexts takes longer than an ACE module with 5 contexts. While ANM imports the module, you cannot perform other activities in the same session. You can, however, establish a new session with the ANM server and perform activities on other devices, modules, or virtual contexts. • If you receive authentication errors or incorrect username/password errors when you try to import an ACE module, see the ACE documentation regarding username and password settings and limitations. • If you physically replace an ACE module in a chassis, you need to synchronize the chassis in ANM. We recommend you start by adjusting syslog settings to facilitate the ANM auto synchronization process as described in the “Enabling a Setup Syslog for Autosync for Use With an ACE” section on page 5-27. Guidelines and Restrictions ANM 3.0 and greater releases do not support the importing of an ACE module that contains an A1(6.x) software release or an ACE appliance that contains an A1(7.x) or A1(8.x) software release. If you attempt to import an ACE that supports one of these releases, ANM displays a message to instruct you that it failed to import the unrecognized ACE configuration and that device discovery failed. However, if you perform an ANM upgrade (for example, from ANM 2.2 to ANM 3.0), and the earlier ANM release contained an inventory with an ACE module that supported the A1(6x) software release or an ACE appliance that supported the A1(7.x) or A1(8.x) software release, ANM 3.0 (and greater) allows the A1(x) software release to reside in the ANM database and will support operations for the release. ANM prevents a new import of an ACE module or ACE appliance that contains the unsupported software version. We strongly recommend that you upgrade your ACE module or ACE appliance to a supported ACE software release, and that you instruct ANM to recognize the updated release. See the “Instructing ANM to Recognize an ACE Module Software Upgrade” section on page 5-71. See the Supported Device Tables for the Cisco Application Networking Manager for a complete list of supported ACE module and ACE appliance software releases. Prerequisites The host chassis of the ACE module that you are adding has been imported (see the “Importing Cisco IOS Host Chassis and Chassis Modules” section on page 5-11). 5-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Step 2 In the All Devices table, choose the host device that contains the ACE module you want to import and click Modules. The Modules table appears, which displays a list of the installed modules. Step 3 In the Modules table, choose the module that you want to import and click Import. The Modules configuration window appears. Step 4 In the Modules window, verify the information of the selected module as described in Table 5-4. Step 5 To import a displayed module, in the Operation to Perform field, choose one of the following: • Import—ANM is to import the ACE module. ANM displays additional configuration fields when the Import option is selected. For both modules types, skip to Step 6 after selecting Import. • Perform Initial Setup And Import—Allows you to perform initial setup manually required for ANM to communicate with the ACE module and imports ACE module configuration. Skip to Step 7. Note We recommend that you choose this option for ACE modules that are configured only with factory defaults. Step 6 If you chose Import, perform the following steps: a. In the Admin Context IP field, enter the module IP address. b. In the User Name field, enter the username for accessing this module. Valid entries are unquoted text strings with a maximum of 24 characters. The default admin credentials are admin/admin. Table 5-4 Importing ACE Modules Item Description Card Slot Chassis IP address, detected module type, and chassis slot number. For example, 10.10.10.1:ACE:2. Card Type Version information about the detected module. For example, ACE v2.3. This field displays major release information only. For example, 8.2x might be supported by a module, but only 8.2 displays. Module Has Been Imported Into ANM Read only information to indicate that the module has already been imported (checked) or that it has not been imported (unchecked). Operation To Perform Drop down list to specify the action to take as follows: • Do Not Import (default setting) • Import • Perform Initial Setup and Import 5-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM Note For security reasons, we recommend that you change the username and password on your ACE device (and modules) after you import them. The security on your ACE module can be compromised because the administrative username and password are configured to be the same for every ACE module shipped from Cisco. See the “Changing ACE Module Passwords” procedure on page 5-77. c. In the Password field, enter the password for accessing this module. Reenter the password in the Confirm field. Valid entries are unquoted text strings with a maximum of 64 characters. The default admin credentials are admin/admin. d. Click Next or Previous to navigate to the next module to specify to import or click Finish to import the specified modules. Skip to Step 9. Step 7 If you chose Perform Initial Setup And Import, perform the following steps: a. In the Host Name field, enter a unique name for this ACE module. Valid entries are alphanumeric strings with no spaces and a maximum of 32 characters. b. In the Admin Context IP field, enter the IP address for this ACE module. c. In the Netmask field, from the drop-down list, choose the subnet mask to apply to this IP address. d. In the Gateway field, enter the IP address of the gateway router to use. e. In the VLAN field, choose the VLAN to which this module belongs. f. Check the Blade Is Configured With Factory Default Admin Credentials check box if the ACE module is currently configured with the default admin credentials (admin/admin). g. In the User Name field, enter the username for accessing this module. Valid entries are unquoted text strings with a maximum of 24 characters. The default admin credentials are admin/admin. Note For security reasons, we recommend that you change the username and password on your ACE after you import it. The security on your ACE module can be compromised because the administrative username and password are configured to be the same for every ACE shipped from Cisco. See the “Changing ACE Module Passwords” procedure on page 5-77. h. In the Password field, enter the password for accessing this module. Reenter the password in the Confirm field. Valid entries are unquoted text strings with a maximum of 64 characters. The default admin credentials are admin/admin. Step 8 Do one of the following: • Click OK to save your entries and to continue with the device configuration. A progress bar reports status and the Device configuration window appears. • Click Cancel to exit the procedure without importing ACE modules and to return to the All Devices table. Note Clicking Cancel in this window does not cancel the chassis importing process. Step 9 (Optional) To confirm that the virtual contexts on the ACE module were successfully imported into ANM, do the following: a. Choose Config > Devices. The device tree appears. 5-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM b. In the device tree, choose the chassis device and ACE module that you just imported. The Virtual Contexts table appears, listing the contexts for that device. c. Confirm that the contexts imported successfully: – If OK appears in the Config Status column, it means that the context imported successfully. – If Import Failed appears in the Config Status column, it means that the context did not import successfully. d. To synchronize the configurations for the context import that failed, choose the context, and then click Sync. ANM will synchronize the context by uploading it from the ACE device. For more information on synchronizing virtual contexts, see the “Creating Virtual Contexts” procedure on page 6-2. Note If you receive authentication errors or incorrect username/password errors when trying to import ACE devices, refer to the ACE documentation regarding username and password settings and limitations. Tip After you add ACE devices, see the “Enabling a Setup Syslog for Autosync for Use With an ACE” section on page 5-27 to enable auto sync, which allows ANM to synchronization with the ACE CLI when ANM receives a syslog message from the ACE rather wait the default polling period. Related Topics • Importing Cisco IOS Host Chassis and Chassis Modules, page 5-11 • Importing ACE Appliances, page 5-21 • Importing CSS Devices, page 5-22 • Importing GSS Devices, page 5-23 • Importing VMware vCenter Servers, page 5-24 • Removing Modules from the ANM Database, page 5-80 • Synchronizing Module Configurations, page 5-67 Importing CSM Devices after the Host Chassis has been Imported You can import CSM devices into the ANM database at any time after the host chassis or router has been imported. Note ANM assigns the device type CSM to both CSM and CSM-S devices. This assignment has to do with how ANM collects and assigns the information that it receives from the device and does not affect functionality. To differentiate between these devices, see the description information in the user interface. Prerequisites The host chassis of the CSM that you are adding has been imported (see the “Importing Cisco IOS Host Chassis and Chassis Modules” section on page 5-11). 5-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Step 2 In the All Devices table, choose the host device that contains the CSM that you want to import, and then click Modules. The Modules table appears. Step 3 In the Modules table, choose the CSM that you want to import, and then click Import. The Modules configuration window appears. Step 4 Verify that the information is correct in the following read-only fields: • Card Slot—The slot in the chassis in which the module resides. • Card Type—The device type; in this instance, CSM. • Module Has Been Imported Into ANM—The checkbox is checked to indicate that the module has already been imported or cleared to indicate that it has not been imported. Step 5 In the Operation to Perform field, choose Import. Step 6 Do one of the following: • Click OK to save your entries. A progress bar reports status and the Modules table refreshes with updated information. • Click Cancel to exit the procedure without importing the device and to return to the Modules table. Related Topics • Importing Cisco IOS Host Chassis and Chassis Modules, page 5-11 • Importing ACE Appliances, page 5-21 • Importing CSS Devices, page 5-22 • Importing GSS Devices, page 5-23 • Importing VMware vCenter Servers, page 5-24 • Removing Modules from the ANM Database, page 5-80 • Synchronizing Module Configurations, page 5-67 Importing VSS 1440 Devices after the Host Chassis has been Imported Catalyst 6500 Virtual Switching Systems (VSS) 1440 devices allow for the combination of two switches into a single, logical network entity from the network control plane and management perspectives. To the neighboring devices, the Cisco Virtual Switching System appears as a single, logical switch or router. VSS devices will be discovered as normal Cisco IOS devices in ANM if the devices are already converted to virtual switch mode. 5-21 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM Note ANM does not recognize failure scenarios as discussed in the “Configuring Virtual Switching System” section of the “Catalyst 6500 Release 12.2SXH and Later Software Configuration Guide” on Cisco.com at http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/vss.html# wp1062314. Related Topics Importing Cisco IOS Host Chassis and Chassis Modules, page 5-11 Importing ACE Appliances This section shows how to import an ACE appliance into ANM. Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Step 2 In the All Devices table, choose the Add button. The New Device window appears. Step 3 In New Device window, define the ACE appliance to import using the information in Table 5-5. Step 4 Do one of the following: • Click OK to save your entries. After ANM adds the specified device, the Primary Attributes window for the device appears. • Click Cancel to exit the procedure without importing the device and to return to the Modules table. Related Topics • Importing Network Devices into ANM, page 5-10 • Importing Cisco IOS Host Chassis and Chassis Modules, page 5-11 Table 5-5 ACE Appliance Configuration Options Field Description Name Name assigned to the ACE appliance. Model Drop-down list to specify the device type. From the Model drop-down list, choose ACE 4710 (appliance). Primary IP ACE appliance IP address. User Name Username that has the administrator role. Password Password that corresponds to the username. Confirm Confirmation of the password. Description Brief device description. 5-22 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM • Importing CSS Devices, page 5-22 • Importing GSS Devices, page 5-23 • Importing VMware vCenter Servers, page 5-24 Importing CSS Devices This section shows how to import CSS devices into ANM. Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Step 2 In the All Devices table, choose the Add button. The New Device window appears. Step 3 In New Device window, define the CSS device to import using the information in Table 5-6. Step 4 Do one of the following: • Click OK to save your entries. After ANM adds the specified device, the Primary Attributes window for the device appears (see the “Configuring CSS Primary Attributes” section on page 5-35). • Click Cancel to exit the procedure without importing the device and to return to the Modules table. Related Topics • Importing Network Devices into ANM, page 5-10 • Importing Cisco IOS Host Chassis and Chassis Modules, page 5-11 • Importing ACE Appliances, page 5-21 Table 5-6 CSS Configuration Options Field Description Name Name assigned to the device. Model Drop-down list to specify the device type. From the Model drop-down list, choose CSS. Primary IP Device IP address. Access Protocol Protocol that ANM is to use when communicating with the CSS. Choose one of the following: • Secure/SSH (default setting) • Telnet User Name Username that has the administrator role. Password Password that corresponds to the username. Confirm Confirmation of the password. SNMP v2c Enabled Checkbox to enable SNMP v2c. Description Brief device description. 5-23 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM • Importing GSS Devices, page 5-23 • Importing VMware vCenter Servers, page 5-24 Importing GSS Devices This section shows how to import GSS devices into ANM. Guidelines and Restrictions Follow these guidelines for importing GSS devices into ANM: • You only need to import the primary GSSM into ANM—You are not required or permitted to add either the standby GSSM or GSS device. ANM communicates only with the primary GSSM for activation and suspension of DNS rules and virtual IP (VIP) answers and for collecting statistics. • GSS graphical user interface (GUI) and CLI must have matching passwords—The username that you configure while adding a GSS device to ANM must be the same on both the GSS GUI and GSS CLI. • Communication between ANM and the primary GSSM is accomplished using the GSS Communication Ethernet Interface—This interface is used for internal communication between the primary GSSM and the other GSS devices in the GSS cluster. Beginning with ANM 4.3, ANM uses Java Remote Method Invocation (RMI) only to communicate with GSS devices using software Version 3.3 or later versions. If the GSS device is using an earlier version of software and ANM cannot communicate with it using RMI, ANM uses Secure Shell (SSH). Table 5-7 lists the TCP ports that ANM uses to communicate with GSS devices. Note When ANM uses SSH for GSS communication, terminal length settings are set to 0 during import, synchronization, and background polling. The previous terminal length settings that you had before import, synchronization, and background polling is performed are not preserved. Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Step 2 In the All Devices table, choose the Add button. The New Device window appears. Step 3 In New Device window, define the GSS device to import using the information in Table 5-8. Table 5-7 TCP Ports Used by ANM for GSS Port Description 22 SSH 2001 Java RMI 3009 Secure RMI 5-24 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM Step 4 Do one of the following: • Click OK to save your entries. After ANM adds the specified device, the Primary Attributes window for the device appears (see the “Configuring GSS Primary Attributes” section on page 5-36). • Click Cancel to exit the procedure without importing the device and to return to the Modules table. Related Topics • Importing Network Devices into ANM, page 5-10 • Importing Cisco IOS Host Chassis and Chassis Modules, page 5-11 • Importing ACE Appliances, page 5-21 • Importing CSS Devices, page 5-22 • Importing VMware vCenter Servers, page 5-24 Importing VMware vCenter Servers This section shows how to import VMware vCenter Servers that are part of a VMware virtual datacenter containing virtual machines (VM). When you import a VMware vCenter Server, ANM discovers the following network entities associated with the server: datacenters, VMs, and hosts (VMware ESX servers). During the VMware vCenter Server import process, you can enable the ANM plug-in that allows you to access ANM ACE real server functionality from a VMware vSphere Client. Registering the plug-in provides the client with a URL to access ANM and retrieve the required XML definition file. ANM uses HTTPS for communication with VMware vCenter Server. Guidelines and Restrictions This topic includes the following guidelines and restrictions: Table 5-8 GSS Configuration Options Field Description Name Name assigned to the device. Model Drop-down list to specify the device type. From the Model drop-down list, choose GSS. Primary IP Device IP address. User Name Username that has the administrator role. Password Password that corresponds to the username. Confirm Confirmation of the password. Enable Password Password for remote authorization. When the GSS is configured for remote authorization with the enable command in the user privilege, then the enable password is not used. Confirm Confirmation of the enable password. Description Brief description for this device. 5-25 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM • ANM does not recognize all the special characters that VMware allows you to use in a VM name. If you import a VMware vCenter Server containing VM names that use certain special characters, ANM encounters issues that affect the VM Mappings window (Config > Devices > vCenter > System > VM Mappings). This window shows how VMs map to real servers. The issues associated with certain special characters in VM names are as follows: – When a VM name contains a double quote (“), ANM is not able to display the VM Mappings window (a blank window displays). – When a VM name contains a percent sign (%), backslash (\), or forward slash (/), ANM displays the VM name in the VM Mappings window; however, these special characters display as hex values (%25 for %, %5c for \, and %2f for /). To avoid these issues, remove these special characters from the VM name before you use the following procedure to import the VMware vCenter Server in to ANM. • ANM supports importing a VMware vCenter Server operating in standard mode only. You cannot import a vCenter Server operating in linked mode. Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Step 2 In the All Devices table, choose the Add button. The New Device window appears. Step 3 In New Device window, configure the VMware vCenter Server using the information in Table 5-9. Table 5-9 VMware vCenter Server Configuration Options Field Description Name Name assigned to the device. Model Drop-down list of available device types. From the Model drop-down list, choose vCenter. Primary IP VMware vCenter Server IP address. HTTPS Port Port that the VMware vCenter Server uses to communicate with ANM using HTTPS. User Name VMware vCenter Server username that has the administrator role or an equivalent role that has privilege on “Extension,” “Global->Manage custom attribute,” and “Global->Set custom attribute.” Password Password that corresponds to the VMware vCenter Server username. 5-26 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Importing Network Devices into ANM Step 4 Do one of the following: • Click OK to save your entries. After ANM adds the VMware vCenter Server, the Primary Attributes window for the VMware vCenter Server appears (see the “Configuring VMware vCenter Server Primary Attributes” section on page 5-41). • Click Cancel to exit the procedure without importing the device and to return to the Modules table. Related Topics • Configuring VMware vCenter Server Primary Attributes, page 5-41 • Using the ANM Plug-In With Virtual Data Centers, page B-1 • Mapping Real Servers to VMware Virtual Machines, page 5-68 • Importing Network Devices into ANM, page 5-10 • Importing Cisco IOS Host Chassis and Chassis Modules, page 5-11 • Importing ACE Appliances, page 5-21 • Importing CSS Devices, page 5-22 • Importing GSS Devices, page 5-23 ANM vCenter Plug-in Registers the ANM plug-in when adding the VMware vCenter Server. Registering the plug-in provides the VMware vCenter Server and associated VMware vSphere Clients with a URL to access ANM and retrieve the required XML definition file. ANM uses HTTPS for communication with the VMware vCenter Server and vSphere Clients. When the plug-in is registered, you can access ANM ACE real server functionality from a VMware vSphere Client. Choose one of the following options: • Import vCenter and register plug-in • Import vCenter and but do not register plug-in (default setting) To register or unregister the ANM plug-in at a later time, see the “Registering or Unregistering the ANM Plug-in” section on page B-5. ANM Server DNS name or IP address of the ANM server that will be used by the VMware vCenter Server and vSphere Client. By default, ANM populates this field with the virtual IP address or hostname or all of the available IP addresses. If you enter a DNS name, make sure that the name can be resolved on the VMware vSphere Client side of the network. Note For ANM servers operating in an HA configuration, choose the shared alias IP address or VIP address for the HA pair so that the plug-in can still be used after an HA failover occurs. Table 5-9 VMware vCenter Server Configuration Options (continued) Field Description 5-27 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Discovering Large Numbers of Devices Using IP Discovery Enabling a Setup Syslog for Autosync for Use With an ACE You can set up auto synchronization to occur when ANM receives a syslog message from ACE devices. This feature allows a faster, more streamlined synchronization process between ANM and any out-of-band configuration changes. Rather than wait the default polling period, ANM will synchronize when a syslog message is received if you enable the Autosync feature. Note ANM does not support Autosync for GSS devices. Procedure Step 1 Choose Config > Devices. From the device tree, select either an ACE module or an ACE appliance. Step 2 Choose Setup Syslog for Autosync. The Setup Syslog for Autosync window appears. Step 3 Choose one or more virtual contexts for which you want to receive Autosync syslog messages. Step 4 Click the Setup Syslog button. A progress bar window appears. The following CLI commands are sent to the enabled ACE devices: logging enable logging trap 2 logging device-id string /Admin logging host udp/514 logging message 111008 level 2 Step 5 If the setup is successful, a checkbox with check mark will appear in the Setup Syslog for Autosync? column for each virtual context that you selected. If there are any errors, the errors will be shown in a popup window. Discovering Large Numbers of Devices Using IP Discovery The IP Discovery feature allows you to discover and import Cisco chassis and ACEs into the ANM database as follows: 1. Preparing devices for discovery. This process involves enabling SSH and XML over HTTPS and adding device credentials. See the “Preparing Devices for IP Discovery” section on page 5-28. 2. Discovering devices residing on your network. The ANM uses SSH, XML over HTTPS, and Telnet to discover its supported devices. When you run IP Discovery, you locate IP addresses of ACE chassis and appliances. See the “Running IP Discovery to Identify Devices” section on page 5-31. After discovery, devices do not appear in the Devices table until device import is completed. To import a specific chassis into the ANM database, you need to enter IP and credentials information for the chassis and then import it and any associated modules. While this discovery method requires you to add more information initially, it provides more control over the discovery process. 5-28 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Discovering Large Numbers of Devices Using IP Discovery 3. Importing the device information into the ANM database to add the device into the Devices table. See the “Importing Network Devices into ANM” section on page 5-10. 4. After importing a module host device, such as a Catalyst 6500 series chassis, you can add ACE modules and CSMs into the ANM database. See the “Importing ACE Modules after the Host Chassis has been Imported” section on page 5-16 or the “Importing CSM Devices after the Host Chassis has been Imported” section on page 5-19. 5. After you start a discovery job, you can monitor its status. See the “Monitoring IP Discovery Status” section on page 5-33. ANM offers multiple ways to accomplish some of these steps. For example, you can either run a discovery job to identify the available chassis, and then choose the ones to import, or you can import a specific chassis into the ANM database. To add a chassis without running discovery, see the “Importing Cisco IOS Host Chassis and Chassis Modules” section on page 5-11. See the Supported Devices Table for Cisco Application Networking Manager for more information about the devices that ANM supports. This section includes the following topics: • Preparing Devices for IP Discovery, page 5-28 • Running IP Discovery to Identify Devices, page 5-31 • Monitoring IP Discovery Status, page 5-33 Preparing Devices for IP Discovery This section describes how to prepare your Cisco devices for IP Discovery by enabling SSH and Telnet on each device and by configuring device SSH and Telnet credentials though ANM. These tasks enable ANM to communicate with the devices and collect data from them. Caution IP Discovery sends unencrpyted credentials (Telnet and SNMP) to all devices on the specified subnet who respond to the associated ports. This is a potential security risk because credentials are broadcast out to one or more networks. IP Discovery may also find devices that cannot be imported or may not be able to locate devices that could be imported. Guidelines and Restrictions Network latency can prevent ANM from establishing a communication link with a device that you want to import. When ANM is providing the device with the device credentials (username and password), by default it waits two seconds after providing the device username for the password prompt to appear. The link times out when it takes longer than two seconds for the next prompt to appear. For information about possible causes of network latency that can create this issue and how to adjust the ANM timeout value, see the “Modifying the ANM Timeout Setting to Compensate for Network Latency” section on page 5-9. Before You Begin Ensure that you have enabled SSH and Telnet in your Cisco network devices by performing the tasks described in the following sections: • Enabling SSH or Telnet Access on Catalyst 6500 Series Switches and Cisco 7600 Series Routers, page 5-5 • Enabling SSH Access and the HTTPS Interface on the ACE Module and Appliance, page 5-6 5-29 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Discovering Large Numbers of Devices Using IP Discovery This section includes the following topics: • Configuring Device Access Credentials, page 5-29 • Modifying Credential Pools, page 5-30 Configuring Device Access Credentials You can add device credentials to ANM before running IP Discovery. Procedure Step 1 Choose Config > Tools > Credential Pool Management. The New Credential Pool window appears. Step 2 In the Name field, enter the name of the new credential pool. Step 3 Click Save to save this entry and to proceed with credentials configuration. The configuration window appears. Step 4 Set the Telnet credentials as follows: a. Choose Configuration > Telnet Credentials. The Telnet Credentials table appears. b. In the table, click Add to add a set of credentials to this credential pool, or choose an existing set of credentials, and click Edit to modify it. c. Enter the credentials (see Table 5-10). d. Do one of the following: – Click OK to save your entries and to return to the Telnet Credentials table. – Click Cancel to exit this procedure without saving your entries and to return to the Telnet Credentials table. – Click Next to deploy your entries and to add another set of Telnet credentials. Step 5 Set the SNMP credentials as follows: a. Choose Configuration > SNMP Credentials. The SNMP Credentials table appears. b. Click Add to add a set of credentials to this credential pool, or choose an existing set of credentials, and click Edit to modify it. Table 5-10 Telnet Credentials Field Description IP Address Specific IP address in dotted-decimal notation or use an asterisk (*) as a wildcard character to identify a number of devices, such as 192.168.11.*. User Name Telnet username for the specified devices. Password Telnet password for the specified devices. Confirm Telnet password that you reenter. Enable Password Telnet enable password for the specified devices. ANM uses this password during the Catalyst 6500 series chassis and Catalyst 6500 Virtual Switching System (VSS) 1440 import process. Confirm Telnet enable password that you reeenter. 5-30 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Discovering Large Numbers of Devices Using IP Discovery c. Enter the SNMP credentials (see Table 5-11). Step 6 Do one of the following: • Click OK to save your entries and to return to the SNMP Credentials table. • Click Cancel to exit without saving your entries and to return to the SNMP Credentials table. • Click Next to deploy your entries and to configure another set of SNMP credentials. After establishing the Telnet and SNMP credentials, you are ready to run IP Discovery. See the “Running IP Discovery to Identify Devices” section on page 5-31. Related Topics • Running IP Discovery to Identify Devices, page 5-31 • Configuring Device Access Credentials, page 5-29 • Discovering Large Numbers of Devices Using IP Discovery, page 5-27 Modifying Credential Pools You can modify existing Telnet or SNMP credentials. Procedure Step 1 Choose Config > Tools > Credential Pool Management. The Credential Pools configuration window appears. Step 2 Choose the credential pool that you want to modify. The Edit Credential Pool configuration window appears. Step 3 Click Edit. Step 4 To modify the existing Telnet credentials, do the following: a. Choose Configuration > Telnet Credentials. The Telnet Credentials table appears. b. In the table, click Add to add a set of credentials to this credential pool, or choose an existing set of credentials, and click Edit to modify it. Table 5-11 SNMP Credentials Field Description IP Address Specific IP address in dotted-decimal notation is used or an asterisk (*) is used as a wildcard character to identify a number of devices, such as 192.168.11.*. Mode Default version of SNMP is selected for this credential pool. Snmpv2 indicates that SNMP version 2 is to be used for this credential pool for the specified devices. RO Community SNMP read-only string for the specified devices. This entry is case sensitive. Timeout Time, in seconds, that the ANM is to wait for response from a device before performing the first retry. Retries Number of times that the ANM is to attempt to communicate with a device before declaring that the device has timed out. 5-31 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Discovering Large Numbers of Devices Using IP Discovery c. Enter the Telnet credentials (see Table 5-10). d. Do one of the following: – Click OK to save your entries and to return to the Telnet Credentials table. – Click Cancel to exit this procedure without saving your entries and to return to the Telnet Credentials table. – Click Next to deploy your entries and to add another set of Telnet credentials. Step 5 To modify the existing SNMP credentials, do the following: a. Choose Configuration > SNMP Credentials. The SNMP Credentials table appears. b. Click Add to add a set of credentials to this credential pool, or choose an existing set of credentials, and click Edit to modify it. c. Enter the SNMP credentials (see Table 5-11). d. Do one of the following: – Click OK to save your entries and to return to the SNMP Credentials table. – Click Cancel to exit without saving your entries and to return to the SNMP Credentials table. – Click Next to deploy your entries and to configure another set of SNMP credentials. Related Topics • Running IP Discovery to Identify Devices, page 5-31 • Configuring Device Access Credentials, page 5-29 • Discovering Large Numbers of Devices Using IP Discovery, page 5-27 Running IP Discovery to Identify Devices You can run IP Discovery to locate IP addresses of the Catalyst 6500 series chassis (hosting the ACE module), ACE appliance, and Catalyst 6500 Virtual Switching System (VSS) devices. After establishing Telnet and SNMP credentials (see the “Configuring Device Access Credentials” section on page 5-29), use this procedure to identify chassis and ACEs on your network. Caution IP Discovery sends unencrpyted credentials (Telnet and SNMP) to all devices on the specified subnet that respond to the associated ports. This is a potential security risk because credentials are broadcast out to one or more networks. IP Discovery may also find devices that cannot be imported or be unable to find devices that could be imported. Before You Begin For this procedure, you need the follow items: • IP address for the discovery process. • Applicable subnet mask. • Valid credentials for this discovery (see the “Configuring Device Access Credentials” section on page 5-29). 5-32 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Discovering Large Numbers of Devices Using IP Discovery • Verification that the devices have SSH enabled (see the “Preparing Devices for IP Discovery” section on page 5-28). Procedure Step 1 Choose Config > Tools > IP Discovery. The Discovery Jobs table appears. Tip If you already know the IP address of your devices, use the Config > Devices > Add function. See the “Importing Network Devices into ANM” section on page 5-10. Step 2 To create a discovery job, click Add. The Discovery Jobs window appears. Step 3 In the IP Address field, enter the IP address of a specific device in dotted-decimal notation such as 192.168.11.1. Step 4 In the Netmask field, choose the subnet mask to be used. When you specify a subnet mask, the discovery process discovers all devices in the range of the IP address and its subnet mask. The default netmask is 255.255.255.0. Note Choose a higher subnet mask only if you are certain that it is appropriate for your network and you understand the impact. If you choose the subnet mask for a class A or class B network, the discovery process becomes extensive and can take a substantial amount of time to complete. Step 5 In the Credential Pool field, choose the credential pool to be used for this discovery. Step 6 Click Discover to run discovery now or Cancel to exit this procedure without running discovery. When you run IP Discovery, the Discovery Jobs table reflects the state of the discovery as it runs. The amount of time to finish a discovery job depends on the size of your network and network activity. If necessary, click Stop to stop the discovery process. When the process has stopped, the Discovery Jobs table appears with the discovery job in the table with the state Aborted. Tip Click Refresh during IP Discovery to see the number of devices found as the discovery process progresses. Step 7 (Optional) View the discovery process status (see the “Monitoring IP Discovery Status” section on page 5-33). Step 8 (Optional) Import ACE devices into the ANM when the discovery process is complete (see the “Importing Network Devices into ANM” section on page 5-10). Related Topics • Creating Virtual Contexts, page 6-2 • Importing Network Devices into ANM, page 5-10 • Using Configuration Building Blocks, page 16-1 5-33 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Discovering Large Numbers of Devices Using IP Discovery Monitoring IP Discovery Status You can monitor device discovery status after starting a discovery job. Procedure Step 1 Click Config > Tools > IP Discovery. The Discovery Jobs table appears with the following information for each discovery job: • IP address • Subnet mask • Start Time in the format hh:mm:ss.nnn • End Time, if available, in the format hh:mm:ss.nnn • Credential Pool being used • State of the discovery job, such as Running or Completed • Number of devices found Step 2 Locate your discovery job to see its current status. If necessary, click Stop to stop the discovery process. When the process has stopped, the Discovery Jobs table appears with the discovery job in the table with the state Aborted. Step 3 When discovery is complete, choose the discovery job in the table. A list of the discovered devices appears below the Discovery Jobs table. You can now populate the ANM with chassis and ACEs. See the “Importing Network Devices into ANM” section on page 5-10. Related Topics • Importing Network Devices into ANM, page 5-10 • Running IP Discovery to Identify Devices, page 5-31 • Information About Importing Devices, page 5-4 5-34 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices Configuring Devices This section describes how to configure the devices that you add to ANM and includes the following topics: • Configuring Device System Attributes, page 5-34 • Configuring Catalyst 6500 Series Chassis or Cisco 7600 Series Router Interfaces, page 5-41 • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 Note The ANM does not detect changes made to a chassis device though the CLI. Be sure to synchronize chassis configurations whenever chassis configuration has been modified via the CLI. Configuring Device System Attributes This section shows how to configure the device system attributes. For the CSM, CSS, and GSS devices, the system attributes consist of the primary attributes only. For the Catalyst 6500 series chassis, Catalyst 6500 Virtual Switching System (VSS) 1440 devices, and Cisco 7600 series routers, the system attributes also include the static route attributes. This section includes the following topics: • Configuring CSM Primary Attributes • Configuring CSS Primary Attributes • Configuring GSS Primary Attributes • Configuring Catalyst 6500 VSS 1440 Primary Attributes • Configuring Catalyst 6500 Series Chassis and Cisco 7600 Series Router Primary Attributes • Configuring Catalyst 6500 Series Chassis, Catalyst 6500 Virtual Switching System 1440 Devices, and Cisco 7600 Series Routers Static Routes • Configuring VMware vCenter Server Primary Attributes Configuring CSM Primary Attributes You can configure primary attributes for CSM devices. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the CSM that you want to configure, and then choose System > Primary Attributes. The Primary Attributes window appears. Step 3 In the Description field, enter a brief description of the module. Step 4 Choose another CSM for high availability pairing from the Redundant Device field, which displays any other CSM devices that have been imported into ANM. 5-35 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices Step 5 Click Deploy Now to deploy this configuration on the CSM and save your entries to the running-configuration and startup-configuration files. To exit this procedure without deploying your entries, choose another device in the device tree or in the object selector above the configuration pane. Related Topics • Configuring Devices, page 5-34 • Importing ACE Modules after the Host Chassis has been Imported, page 5-16 Configuring CSS Primary Attributes You can configure primary attributes for CSS devices. Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Step 2 In the All Devices table, choose the CSS that you want to configure, and then choose System > Primary Attributes. The Primary Attributes window appears with information about the device. Step 3 Configure the CSS using the information in Table 5-12. Note Most of the information is read directly from the device during the import process and cannot be changed using the ANM interface. Table 5-12 CSS Primary Attributes Configuration Options Field Description Description Brief description for this device. Device Type Read-only field that has the device type in gray. Use Telnet Read-only field that will be checked if the device was imported using Telnet. IP Address Read-only field with the device IP address. Redundant Device Field that displays any other CSS devices that have been imported into the ANM database. Choose another CSS for high availability pairing. 5-36 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices Step 4 Click Deploy Now to deploy this configuration on the CSS and to save your entries to the running-configuration and startup-configuration files. To exit this procedure without deploying your entries, choose another device in the device tree or in the object selector above the configuration pane. Related Topics • Configuring Devices, page 5-34 • Importing Network Devices into ANM, page 5-10 Configuring GSS Primary Attributes You can configure primary attributes for Cisco Global Site Selector devices. Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Step 2 In the All Devices table, choose the GSS that you want to configure, and then choose System > Primary Attributes. The Primary Attributes window appears with information about the device. Step 3 Configure the GSS using the information in Table 5-13. SNMP v2c Enabled Checkbox to enable SNMP version 2c access. Uncheck the checkbox to disable this feature. If you enable this feature, in the SNMP Trap Community string field, enter the SNMP community string. SNMP v3 Enabled Checkbox to enable SNMP Version 3 access. Uncheck the checkbox to disable this feature. If you enable this feature, do the following: 1. In the SNMP V3 User Name field, enter the SNMP username. 2. In the SNMP V3 Mode field, choose the level of security to be used when accessing the chassis: • NoAuthNoPriv—SNMP uses neither authentication nor encryption in its communications. • AuthNoPriv—SNMP uses authentication, but the data is not encrypted. 3. If you choose AuthNoPriv, do the following: a. In the SNMP V3 Auth Proto field, choose MD5 or DES to specify the authentication mechanism. b. In the SNMP V3 Auth Pass field, enter the user authentication password. Valid entries are unquoted text strings with no spaces and a maximum of 130 characters. c. In the Confirm field, reenter the user authentication password. Table 5-12 CSS Primary Attributes Configuration Options (continued) Field Description 5-37 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices Step 4 (Optional) To update the IP address and/or password for the GSS on the ANM server only, click Update IP Address/Password. The Update IP Address/Password window appears. Note The password changes are for the ANM server only. The Password/Enable password on the device will not be changed. Enter new credentials in the Update IP Address/Password window using the information in Table 5-14. Step 5 Do one of the following: • Click OK to save any changes made to GSS server IP address or password to the ANM server. • Click Cancel. You return to the Primary Attributes Page. Step 6 Click Deploy Now to deploy this configuration save your entries to the gslb-configuration file. To exit this procedure without deploying your entries, choose another device in the device tree or in the object selector above the configuration pane. Table 5-13 GSS Primary Attributes Configuration Options Field Description Description Brief description for this device. Device Type Read-only field that has the device type, in this case GSS, in gray. IP Address Device IP address. Table 5-14 GSS Change IP Address and Password Options Field Description Old Primary IP Address Read-only field displaying the device IP address. New Primary IP Address IP address that you wish to have GSS associated with on the server. Update Available password update choices are as follows: • Both—Update both the password and enable passwords. • Enable Password Only—Update only the enable password. • Password Only—Update only the password. New Password New password. Confirm New Password New password that you reenter. New Enable Password New enable password. Confirm New Enable Password New enable password that you reenter. 5-38 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices Related Topics • Configuring Devices, page 5-34 • Importing ACE Appliances, page 5-21 Configuring Catalyst 6500 VSS 1440 Primary Attributes You can configure primary attributes for VSS devices. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the device you want to configure, then choose System > Primary Attributes. The Primary Attributes window appears with information about the chassis. Most of the information is read directly from the device during the import process and cannot be changed using the ANM interface. For example, a VSS-enabled checkbox will display as a read-only field. You can, however, add a description and configure the device for SNMPv2 or SNMPv3 access. Note For the ACE devices in VSS, the slot number is represented in the format switch number/slot number. Step 3 In the Description field, enter a brief description for the device. Step 4 To enable SNMPv2c access, do the following: a. Check the SNMPv2c Enabled checkbox. b. In the SNMP Trap Community string field, enter the SNMP community string. Step 5 Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the All Devices table. Related Topics • Displaying Chassis Interfaces and Configuring High-Level Interface Attributes, page 5-42 • Displaying Modules by Chassis, page 5-79 • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 Configuring Catalyst 6500 Series Chassis and Cisco 7600 Series Router Primary Attributes You can configure primary attributes for Catalyst 6500 series chassis and Cisco 7600 series routers. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the device that you want to configure, and choose System > Primary Attributes. 5-39 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices The Primary Attributes window appears. Most of the information is read directly from the device during the import process and cannot be changed using the ANM interface. However, you can add a description and configure the device for SNMPv2 or SNMPv3 access. Step 3 In the Description field, enter a brief description for the device. Step 4 To enable SNMPv2c access, do the following: a. Check the SNMPv2c Enabled checkbox. b. In the SNMP Trap Community string field, enter the SNMP community string. Step 5 Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the All Devices table. Related Topics • Displaying Chassis Interfaces and Configuring High-Level Interface Attributes, page 5-42 • Displaying Modules by Chassis, page 5-79 • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 Configuring Catalyst 6500 Series Chassis, Catalyst 6500 Virtual Switching System 1440 Devices, and Cisco 7600 Series Routers Static Routes You can configure static routes for the Catalyst 6500 Series Chassis, Catalyst 6500 Virtual Switching System 1440 Devices, and Cisco 7600 Series Routers. Though interfaces can be shared across contexts, the ACE supports only static routes for virtual contexts. You can configure static routes for Catalyst 6500 series chassis, Catalyst 6500 Virtual Switching System (VSS) 1440 devices, and Cisco 7600 series routers. Note After a device static route has been created, you can modify only its administrative distance. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the device that you want to configure, and choose Network > Static Routes. The Static Routes table appears. Step 3 In the Static Routes table, click Add to configure a new static route for the device, or choose an existing static route, and click Edit to modify it. The Static Routes configuration window appears. Step 4 In the Destination Prefix field, enter the IP address for the route. The address that you specify for the static route is the address that is in the packet before entering the ACE and performing network address translation. Step 5 In the Destination Prefix Mask field, choose the subnet for the static route. Step 6 In the Next Hop field, enter the IP address of the gateway router for the route. 5-40 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices The gateway address must be on the same network as a VLAN interface for the device. Step 7 In the Admin Distance field, enter the administrative distance value of the route. The administrative distance is the first criterion that a router uses to determine which routing protocol to use if two protocols provide route information for the same destination. The administrative distance is a measure of the trustworthiness of the source of the routing information. A lower administrative distance value indicates that the protocol is more reliable. Valid entries are from 0 to 255, with lower numbers indicating greater reliability. For example, a static route has an administrative distance value of 1 while an unknown protocol has an administrative distance value of 255. Table 5-15 lists default distance values of the protocols that Cisco supports. Step 8 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Static Route table. • Click Cancel to exit the procedure without saving your entries and to return to the Static Route table. • Click Next to deploy your entries and to add another static route. Related Topics • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 • Displaying All Device VLANs, page 5-49 • Importing Network Devices into ANM, page 5-10 Table 5-15 Cisco Default Distance Value Table Route Source Administrative Distance Value Connected interface 0 Static route 1 Enhanced Interior Gateway Routing Protocol (EIGRP) summary route 5 External Border Gateway Protocol (BGP) 20 Internal EIGRP 90 IGRP 100 OSPF (Open Shortest Path First) 110 Intermediate System-to-Intermediate System (IS-IS) 115 Routing Information Protocol (RIP) 120 Exterior Gateway Protocol (EGP) 140 On-Demand Routing (ODR) 160 External EIGRP 170 Internal BGP 200 Unknown 255 5-41 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices Configuring VMware vCenter Server Primary Attributes You can configure the primary attributes for a selected VMware vCenter Server. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the VMware vCenter Server that you want to configure, and choose System > Primary Attributes. The Primary Attributes window appears. Step 3 In the Primary Attributes window, configure the VMware vCenter Server primary attributes as described in Table 5-16. Step 4 Click Deploy Now to deploy this configuration on the VMware vCenter Server and return to the All Devices table. Related Topics • Importing VMware vCenter Servers, page 5-24 Configuring Catalyst 6500 Series Chassis or Cisco 7600 Series Router Interfaces This section shows how to configure the interface attributes for the Catalyst 6500 series chassis or Cisco 7600 series router. This section includes the following topics: • Displaying Chassis Interfaces and Configuring High-Level Interface Attributes, page 5-42 • Configuring Access Ports, page 5-43 Table 5-16 VMware vCenter Server Primary Attributes Item Description Description Brief description for the VMware vCenter Server. Version VMware vCenter Server version number. IP Address IP address of the VMware vCenter Server. HTTPS Port Port number used by the VMware vCenter Server. ANM vCenter Plug-in Registration Status Current status of the ANM plug-in: • Registered • Not Registered For more information about ANM plug-in registration or to change the plug-in registration status, see the “Registering or Unregistering the ANM Plug-in” section on page B-5. ANM IP Address IP address of the ANM server. 5-42 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices • Configuring Trunk Ports, page 5-44 • Configuring Switch Virtual Interfaces, page 5-45 • Configuring Routed Ports, page 5-46 Displaying Chassis Interfaces and Configuring High-Level Interface Attributes You can display a complete list of interfaces on a selected Catalyst 6500 series chassis or Cisco 7600 series router. From this display, you can configure the following high-level attributes for a specified interface: interface description, operating mode, and administrative state. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the device, and choose Interfaces > Summary. The Interfaces table appears, listing all interfaces on the device and related information as follows: • Interface name • Description, if available • Configured state, such as Up or Down • Current operational state, if known • Mode of operation, such as Access, Routed, or Trunk • Interface hardware type Step 3 Choose the interface to configure, and click Edit. The configuration window appears. Step 4 Enter the following: a. In the Description field, enter a brief description of the interface. b. In the Administrative State field, choose Up or Down to indicate whether the port should be up or down. c. In the Mode field, choose the operational mode of the interface: Trunk, Access, or Routed. d. Click Apply to save your changes or Cancel to exit the procedure without saving your changes. The Interfaces table appears. Related Topics • Configuring Access Ports, page 5-43 • Configuring Trunk Ports, page 5-44 • Configuring Routed Ports, page 5-46 • Configuring Switch Virtual Interfaces, page 5-45 • Creating VLAN Groups, page 5-52 • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 5-43 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices Configuring Access Ports You can configure access port attributes for a selected device. An access port receives and sends traffic in native formats with no VLAN tagging. Traffic that arrives on an access port is assumed to belong to the VLAN assigned to the port. If an access port receives a tagged packet (Inter-Switch Link [ISL] or 802.1Q tagged), the packet is dropped, and the source address is not learned. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the device that you want to configure an access port for, and choose Interfaces > Access Ports. The Interfaces table appears. Step 3 From the Interfaces table, choose the port that you want to configure, and click Edit. The Access Ports configuration window appears. Step 4 In the Description field, enter a description for the port. Valid entries are unquoted text strings with a maximum of 240 characters including spaces. Step 5 In the Administrative State field, choose Up or Down to indicate whether the port should be up or down. Step 6 In the Speed field, either specify the speed at which the interface is to operate or that the interface is to automatically negotiate its speed: • Auto—The interface is to automatically negotiate speed with the connected device. • 10 Mbps—The interface is to operate at 10 Mbps. • 100 Mbps—The interface is to operate at 100 Mbps. • 1000 Mbps—The interface is to operate at 1000 Mbps. Step 7 In the Duplex Mode field, specify whether the interface is to automatically negotiate its duplex mode or use full- or half-duplex mode: • Auto—The interface is to automatically negotiate duplex mode with the connected device. • Full—The interface is to operate in full-duplex mode. In this mode, two connected devices can send and receive traffic at the same time. • Half—The interface is to operate in half-duplex mode. In this mode, two connected devices can either send or receive traffic. Step 8 In the VLANs field, enter individual names for each VLAN to which the interface belongs. The allowable range is 1 to 4094. Step 9 Do one of the following: • Click Apply to save your entries and to return to the Interfaces table. • Click Cancel to exit the procedure without saving your entries and to return to the Interfaces table. Related Topics • Configuring Trunk Ports, page 5-44 • Configuring Switch Virtual Interfaces, page 5-45 5-44 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices • Configuring Routed Ports, page 5-46 • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 Configuring Trunk Ports You can configure trunk ports for a selected device. A trunk port carries the traffic of multiple VLANs and by default is a member of all VLANs in the VLAN database. Two types of trunk ports are as follows: • In an Inter-Switch Link (ISL) trunk port, all received packets are expected to be encapsulated with an ISL header, and all transmitted packets are sent with an ISL header. Native (nontagged) frames received from an ISL trunk port are dropped. • An IEEE 802.1Q trunk port supports simultaneous tagged and untagged traffic. An 802.1Q trunk port is assigned a default port VLAN ID or native VLAN, and all untagged traffic travels on the native VLAN. All untagged traffic and tagged traffic with a NULL VLAN ID are assumed to belong to the native VLAN. A packet with a VLAN ID that is equal to the outgoing port native VLAN is sent untagged. All other traffic is sent with a VLAN tag. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the device that you want to configure, and choose Interfaces > Trunk Ports. The Interfaces table appears. Step 3 In the Interfaces table, choose the port that you want to configure, and click Edit. The Trunk Port configuration window appears. Step 4 Configure the port using the information in Table 5-17. Table 5-17 Trunk Port Configuration Attributes Field Description Description Description for the port. Valid entries are unquoted text strings with a maximum of 240 characters including spaces. Administrative State Up or Down to indicate whether the port should be up or down. Speed Speed at which the interface is to operate or that the interface is to automatically negotiate its speed: • Auto—The interface is to automatically negotiate speed with the connected device. • 10 Mbps—The interface is to operate at 10 Mbps. • 100 Mbps—The interface is to operate at 100 Mbps. • 1000 Mbps—The interface is to operate at 1000 Mbps. Duplex Mode Whether the interface is to automatically negotiate its duplex mode or use full-duplex or half-duplex mode: • Auto—The interface is to automatically negotiate duplex mode with the connected device. • Full—The interface is to operate in full-duplex mode. In this mode, two connected devices can send and receive traffic at the same time. • Half—The interface is to operate in half-duplex mode. In this mode, two connected devices can either send or receive traffic. 5-45 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices Step 5 Do one of the following: • Click Apply to save your entries and to return to the Interfaces table. • Click Cancel to exit the procedure without saving your entries and to return to the Interfaces table. Related Topics • Configuring Access Ports, page 5-43 • Configuring Switch Virtual Interfaces, page 5-45 • Configuring Routed Ports, page 5-46 • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 Configuring Switch Virtual Interfaces You can configure a switch virtual interface on a Multilayer Switch Feature Card. A VLAN defined on the Multilayer Switch Feature Card (MSFC) is called a switch virtual interface (SVI). If you assign the VLAN used for the SVI to an ACE, then the MSFC routes between the ACE and other Layer 3 VLANs. By default, only one SVI can exist between an MSFC and an ACE. However, for multiple contexts, you might need to configure multiple SVIs for unique VLANs on each context. Trunk Mode How the interface is to interact with neighboring interfaces: • Dynamic—The interface is to convert a link to a trunk link if the neighboring interface is set to trunk or desirable mode. • Dynamic Desirable—The interface is to actively attempt to convert a link to a trunk link. The interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode. • Static—The interface is to enter permanent trunking mode and to negotiate converting a link into a trunk link. The interface becomes a trunk interface even if the neighboring interface does not change. Desired Encapsulation Type of encapsulation to be used on the trunk port: • Dot1Q—The interface is to use 802.1Q encapsulation. • Negotiate—The interface is to negotiate with the neighboring interface to use ISL (Inter-Switch Link) (preferred) or 802.1Q encapsulation, depending on the configuration and capabilities of the neighboring interface. • ISL—The interface is to use ISL encapsulation. Native VLAN VLAN to use as the native VLAN for the trunk in 802.1Q trunking mode. VLAN 1 (1) is the default native VLAN. VLANs VLANs to which the interface belongs (allowable range is 1-4094). You can also enter ranges of VLANs, such as 101-120, 130. Prune VLANs VLANs that can be pruned (allowable range is 1-4094). VTP pruning blocks unneeded flooded traffic to VLANs on trunk ports that are included in this field. Only VLANs included in this field can be pruned. You can also specify ranges of VLANs that can be pruned, such as 75, 121-250, 351. Table 5-17 Trunk Port Configuration Attributes (continued) Field Description 5-46 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the device that you want to configure, and choose Interfaces > Switched Virtual Interfaces. The Interfaces table appears. Step 3 In the Interfaces table, click Add to add a new SVI, or choose the interface you want to configure, and click Edit. The Switched Virtual Interfaces configuration window appears. Step 4 In the VLANs field, specify the VLAN to use in one of the following ways: • To specify a new VLAN, choose the first radio button, and then enter a new VLAN. • To choose an existing VLAN, choose the second radio button, and choose one of the existing VLANs. Note You cannot modify a VLAN for an existing SVI. Step 5 In the Description field, enter a description for the SVI. Valid entries are unquoted text strings with a maximum of 240 characters including spaces. Step 6 In the Administrative State field, choose Up or Down to indicate whether the SVI should be up or down. Step 7 In the IP Address field, enter the IP address to be used for the interface on the MSFC in dotted-decimal format. Step 8 In the Netmask field, choose the subnet mask to be used for the IP address. Step 9 Do one of the following: • Click Apply to save your entries and to return to the Interfaces table. • Click Cancel to exit the procedure without saving your entries and to return to the Interfaces table. Related Topics • Configuring Access Ports, page 5-43 • Configuring Trunk Ports, page 5-44 • Configuring Routed Ports, page 5-46 • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 Configuring Routed Ports You can configure routed ports on a specified device. A routed port is a physical port that acts like a port on a router; however, it does not have to be connected to a router. A routed port is not associated with a particular VLAN, as is an access port. A routed port behaves like a regular router interface, except that it does not support VLAN subinterfaces. Routed ports can be configured with a Layer 3 routing protocol. A routed port is a Layer 3 interface only and does not support Layer 2 protocols, such as Dynamic Trunking Protocol (DTP) and Spanning Tree Protocol (STP). 5-47 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the device that you want to configure, and choose Interfaces > Routed Ports. The Interfaces table appears. Step 3 In the Interfaces table, choose the interface that you want to configure, and click Edit. The Routed Ports configuration window appears. Step 4 In the Description field, enter a description for the interface. Valid entries are unquoted text strings with a maximum of 240 characters including spaces. Step 5 In the Administrative State field, choose Up or Down to indicate whether the interface should be up or down. Step 6 In the Speed field, either specify the speed at which the interface is to operate or that the interface is to automatically negotiate its speed: • Auto—The interface is to automatically negotiate speed with the connected device. • 10 Mbps—The interface is to operate at 10 Mbps. • 100 Mbps—The interface is to operate at 100 Mbps. • 1000 Mbps—The interface is to operate at 1000 Mbps. Step 7 In the Duplex Mode field, specify whether the interface is to automatically negotiate its duplex mode, or use full- or half-duplex mode: • Auto—The interface is to automatically negotiate duplex mode with the connected device. • Full—The interface is to operate in full-duplex mode. In this mode, two connected devices can send and receive traffic at the same time. • Half—The interface is to operate in half-duplex mode. In this mode, two connected devices can either send or receive traffic. Step 8 In the IP Address field, enter the IP address to be used for the interface in dotted-decimal format. Step 9 In the Netmask field, choose the subnet mask to be used for the IP address. Step 10 Do one of the following: • Click Apply to apply your entries and to return to the Interfaces table. • Click Cancel to exit the procedure without saving your entries and to return to the Interfaces table. Related Topics • Configuring Trunk Ports, page 5-44 • Configuring Switch Virtual Interfaces, page 5-45 • Configuring Access Ports, page 5-43 • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 5-48 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs You can add a VLANs and VLAN groups to a Catalyst 6500 series chassis or Cisco 7600 series router that you use when configuring the interfaces for an installed ACE module, which does not have any external physical interfaces. Instead, the ACE module uses internal VLAN interfaces. For information about configuring VLANs for use with virtual contexts, see the “Configuring Virtual Context VLAN Interfaces” section on page 12-6. For more information about VLANs and their use with ACE modules, see the Cisco Application Control Engine Module Routing and Bridging Configuration Guide. This section includes the following topics: • Adding Device VLANs, page 5-48 • Displaying All Device VLANs, page 5-49 • Configuring Device Layer 3 VLANs, page 5-51 • Configuring Device Layer 2 VLANs, page 5-50 • Displaying All Device VLANs, page 5-49 • Creating VLAN Groups, page 5-52 Adding Device VLANs You can add a VLAN to a Catalyst 6500 series chassis or Cisco 7600 series router. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the device that you want to configure, and choose VLANs > Layer 2 or VLANs > Layer 3. The VLANs table appears. Step 3 From the VLANs table, click Add. The VLAN configuration window appears. Step 4 Configure the VLAN using the information in Table 5-18. Table 5-18 Device VLAN Configuration Attributes Field Description VLAN Unique identifier for the VLAN. Valid entries are from 1 to 4094. Name Name for the VLAN. Description Description for the VLAN. Valid entries are unquoted text strings with a maximum of 240 characters including spaces. Access Ports Access ports. From the Available Items list, click Add.To remove a port that you do not want to use, choose the port from the Selected Items list, and click Remove. Trunk Ports Trunk ports. From the Available Items list, click Add.To remove a port that you do not want to use, choose the port from the Selected Items list, and click Remove. 5-49 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices Step 5 Do one of the following: • Click Apply to apply your entries and to return to the VLAN Management table. • Click Cancel to exit the procedure without saving your entries and to return to the VLAN Management table. Related Topics • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 • Configuring Device Layer 2 VLANs, page 5-50 • Configuring Device Layer 3 VLANs, page 5-51 • Displaying All Device VLANs, page 5-49 • Creating VLAN Groups, page 5-52 Displaying All Device VLANs You can display all configured VLANs on a Catalyst 6500 series chassis or Cisco 7600 series router. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the device with VLANs that you want to display, and choose VLANs > Summary. The VLANs table appears, listing all VLANs on the selected chassis and related information: • VLAN number • Name given to the VLAN • VLAN type, such as Layer 2 or Layer 3 • Number of access ports • Number of trunk ports VTP Domain Name of the VTP domain to which the VLAN belongs. A VTP domain is made up of one or more interconnected network devices that share the same VTP domain name. A network device can be configured to be in one and only one VTP domain. IP Address Field that appears for Layer 3 VLANs only. Enter the IP address to be used for the VLAN interface. Enter the IP address in dotted-decimal notation, such as 192.168.1.1. Mask Field that appears for Layer 3 VLANs only. Choose the subnet mask to apply to the IP address. Table 5-18 Device VLAN Configuration Attributes (continued) Field Description 5-50 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices • VLAN Trunking Protocol (VTP) domain to which the VLAN belongs Related Topics • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 • Configuring Device Layer 2 VLANs, page 5-50 • Configuring Device Layer 3 VLANs, page 5-51 • Displaying All Device VLANs, page 5-49 • Creating VLAN Groups, page 5-52 Configuring Device Layer 2 VLANs You can add or modify a Layer 2 VLAN on a Catalyst 6500 series chassis or Cisco 7600 series router. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the device that you want to configure a Layer 2 VLAN for, and choose VLANs > Layer 2. The VLANs table appears, listing all Layer 2 VLANs associated with the chassis. Step 3 Click Add to add a new VLAN, or choose an existing VLAN, and then click Edit to modify it. The VLAN configuration window appears. Step 4 Configure the VLAN using the information in Table 5-18. Step 5 Do one of the following: • Click Apply to apply your entries and to return to the VLAN Management table. • Click Cancel to exit the procedure without saving your entries and to return to the VLAN Management table. Related Topics • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 • Adding Device VLANs, page 5-48 • Configuring Device Layer 3 VLANs, page 5-51 • Displaying All Device VLANs, page 5-49 • Creating VLAN Groups, page 5-52 5-51 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices Configuring Device Layer 3 VLANs You can add or modify a Layer 3 VLAN on a Catalyst 6500 series chassis or Cisco 7600 series router. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the device that you want to configure a Layer 3 VLAN for, and choose VLANs > Layer 3. The VLANs table appears, listing all Layer 3 VLANs associated with the chassis. Step 3 In the VLANs table, click Add to add a new VLAN, or choose an existing VLAN, and click Edit to modify it. The VLAN configuration window appears. Step 4 Configure the VLAN using the information in Table 5-18. Step 5 Do one of the following: • Click Apply to apply your entries and to return to the VLAN Management table. • Click Cancel to exit the procedure without saving your entries and to return to the VLAN Management table. Related Topics • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 • Information About Virtual Contexts, page 6-2 Modifying Device VLANs You can modify VLANs for a specific device. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the device with the VLAN that you want to modify, and choose VLANs > Layer 2 or VLANs > Layer 3. The VLANs table appears. Step 3 Choose the VLAN you want to modify, and then click Edit. The VLAN configuration window appears. Step 4 Modify the VLAN configuration using the information in Table 5-18. Step 5 Do one of the following: • Click Apply to save your entries and to return to the VLANs table. 5-52 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring Devices • Click Cancel to exit the procedure without saving your entries and to return to the VLANs table. Related Topics • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 • Displaying All Device VLANs, page 5-49 • Adding Device VLANs, page 5-48 • Creating VLAN Groups, page 5-52 Creating VLAN Groups You can create VLAN groups on a Catalyst 6500 series chassis or Cisco 7600 series router and assign each group an ACE module. For an ACE module to receive traffic from the Catalyst supervisor module and VSS devices, you must create VLAN groups on the supervisor module, and then assign the groups to the ACE module. When the VLANs are configured on the supervisor module to the ACE module, you can configure the VLANs on the ACE module. You cannot assign the same VLAN to multiple groups; however, you can assign multiple groups to an ACE module. VLANs that you want to assign to multiple ACE modules, for example, can reside in a separate group from VLANs that are unique to each ACE module. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the device that you want to create a VLAN group for, and choose VLANs > Groups. The Groups table appears. Step 3 Click Add to add a new VLAN group, or choose an existing VLAN group, and click Edit to modify it. The Groups configuration window appears. Step 4 In the VLAN Group Id field, enter a unique numerical identifier for the VLAN group. Valid entries are unquoted number strings with any value between 1-65535. Available Module Slot numbers will appear underneath this field. Step 5 In the Module Slot Numbers field, select the ACE module(s) that you want to associate with the VLAN group. Step 6 Double click or the number, or single click the arrow to the right of the Available Modules field for the slot numbers to the Selected field. Step 7 In the VLANs field, enter the VLANs to be included in the VLAN group. Valid entries are individual names for each VLAN or ranges of VLANs (allowable range is 1-4094), such as 10, 50-110. Step 8 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Groups table. • Click Cancel to exit the procedure without saving your entries and to return to the Groups table. 5-53 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring ACE Module and Appliance Role-Based Access Controls • Click Next to deploy your entries and to add another VLAN group. Related Topics • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 • Configuring Device Layer 3 VLANs, page 5-51 • Configuring Device Layer 2 VLANs, page 5-50 • Displaying All Device VLANs, page 5-49 Configuring ACE Module and Appliance Role-Based Access Controls ANM provides an interface to allow you to configure device Role-Based Access Control (RBAC) on the device only. The RBAC feature applies to ACE modules and appliances only and is applicable only on the device and is not enforced by ANM. If you want to set up authorization in ANM, go to Admin > Role-Based Access Control. This section includes the following topics: • Configuring Device RBAC Users, page 5-53 • Configuring Device RBAC Roles, page 5-56 • Configuring Device RBAC Domains, page 5-61 Configuring Device RBAC Users ANM provides an interface that allows you to configure user access to your device through role-based access controls on the device only. This configuration is applicable only on the device and will not be enforced by ANM. Use the Role-Based Access Control feature to specify the people that are allowed to log onto a device. This section includes the following topics: • Guidelines for Managing Users, page 5-53 • Displaying a List of Device Users, page 5-54 • Configuring Device User Accounts, page 5-54 • Modifying Device User Accounts, page 5-55 • Deleting Device User Accounts, page 5-56 Guidelines for Managing Users Follow these guidelines for managing users: • For users that you create in the Admin context, the default scope of access is for the entire ACE. • If you do not assign a role to a new user, the default user role is Network-Monitor. For users that you create in other contexts, the default scope of access is the entire context. • Users cannot log in until they are associated with a domain and a user role. 5-54 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring ACE Module and Appliance Role-Based Access Controls • You cannot delete roles and domains that are associated with an existing user. Related Topics • Configuring Device RBAC Users, page 5-53 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Displaying a List of Device Users You can display of list of users that can access an ACE context. Procedure Step 1 Choose Config > Devices > context > Role-Based Access Control > Users. The Users table appears with the following fields: • User Name • Expiry Date • Role • Domains Step 2 (Optional) You can use the options in this window to create a new user or modify or delete any existing user to which you have access (see Table 5-19). Related Topics • Configuring Device RBAC Users, page 5-53 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Configuring Device User Accounts You can add or modify a user account in a selected ACE context. Note This configuration is applicable only on the device or building block and is not enforced by ANM. To manipulate ANM RBAC, go to Admin > Role-Based Access Control. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Device RBAC > Users. • To configure a configuration building block, choose Config > Global > Building Blocks > building_block > Role-Based Access Control > Users. A list of users appears. Step 2 In the Users table, click Add to add a new user, or choose the user that you want to configure and click Edit. The Users configuration window appears. 5-55 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring ACE Module and Appliance Role-Based Access Controls Step 3 Configure the user attributes using the information in Table 5-19. Step 4 Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The Users table appears. Related Topics • Configuring Device RBAC Users, page 5-53 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Modifying Device User Accounts You can modify an existing user account in a selected ACE context. Note This configuration is applicable only on the device or building block and will not be enforced by ANM. To manipulate ANM RBAC, go to Admin > Role-Based Access Control. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Device RBAC > Users. • To configure a configuration building block, choose Config > Global > Building Blocks > building_block > Role-Based Access Control > Users. A table of users, expiration dates, roles, and domains appears. Step 2 Choose the user account that you want to modify. Step 3 Click Edit. Step 4 Modify any of the attributes in the table (see Table 5-19). Table 5-19 User Attributes Field Description User Name Name by which the user is to be identified (up to 24 characters). Only letters, numbers, and an underscore can be used. The field is case sensitive. Expiry Date Date that user account expires (optional). Password Entered As Password for this user account. You can choose Clear Text or Encrypted Text. Password Password for the user account. Confirm Password Password for this account that you reenter. Encryption Password in either clear or encrypted text. Role Role that you customize or accept as an existing role. To enter the Role for this user, see the “Configuring Device User Roles” section on page 5-58. See Table 5-20 for details about setting up new roles. Domains Domains to which this user belongs. Use the Add and Remove buttons. 5-56 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring ACE Module and Appliance Role-Based Access Controls Step 5 Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The Users table appears. Related Topics • Configuring Device RBAC Users, page 5-53 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Deleting Device User Accounts You can delete an existing device RBAC user account in a selected ACE context. Note This configuration is applicable only on the device or building block and will not be enforced by ANM. To manipulate ANM RBAC, go to Admin > Role-Based Access Control. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Device RBAC > Users. • To configure a configuration building block, choose Config > Global > Building Blocks > building_block > Role-Based Access Control > Users. A table of users, roles, and domains appears. Step 2 In the table, choose the user account to delete, and click Delete. A confirmation window appears. Step 3 In the confirmation window, do one of the following: • Click OK to remove the user account from the ANM database and return to the Users table. • Click Cancel to return to the Users table without deleting the user account. Related Topics • Configuring Device RBAC Users, page 5-53 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Configuring Device RBAC Roles This section shows how to configure RBAC roles and includes the following topics: • Guidelines for Managing User Roles, page 5-57 • Role Mapping in Device RBAC, page 5-57 • Configuring Device User Roles, page 5-58 • Modifying Device User Roles, page 5-60 5-57 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring ACE Module and Appliance Role-Based Access Controls • Deleting Device User Roles, page 5-60 Guidelines for Managing User Roles Follow these guidelines to manage user roles: • Administrators can view and modify all roles. • Other users can view only the roles assigned to them. • You cannot change the default roles. • Role permissions are different based on whether they were created in either an Admin context or in a user context. If you want to allow users to switch between contexts, ensure that they have a predefined role. If you want to restrict a user to only their home context, assign them a customized user role. • Certain role features are available only to default roles, for example, an Admin role in the Admin context would have changeto and system permissions to perform tasks such as license management, resource class management, HA setup, and so on. User-created roles cannot use these features. Related Topics • Role Mapping in Device RBAC, page 5-57 • Controlling Access to Cisco ANM, page 18-3 • Configuring Device RBAC Users, page 5-53 • Configuring Device RBAC Roles, page 5-56 • Configuring Device RBAC Domains, page 5-61 • How ANM Handles Role-Based Access Control, page 18-8 Role Mapping in Device RBAC When you are logged into a specific device RBAC, you see the tasks that you have been given permission to access. Features and menus that are not applicable for your role will not display. Since the predefined roles encompass all the role types you may need, we encourage you to use them. If you choose to define your own roles, be aware that rules features are not a one-to-one mapping from a CLI feature to ANM menu task. Defining the proper rules for your user-defined role will require you to create a mapping between the features in Device RBAC and the ANM menu tasks. For example, in order to manage virtual servers, you must choose the following six menu features (Real Servers, Server Farms, VIP, Probes, Loadbalance, NAT, and Interface) in your role. Note Certain features in ANM do not have a corresponding feature mapping on the CLI. For example, class maps and SNMP do not have a corresponding feature mapping. To modify these features, you need to choose a predefined role that a contains at least one feature with the Modify permission on it. Related Topics • How ANM Handles Role-Based Access Control, page 18-8 • Understanding Roles, page 18-6 5-58 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring ACE Module and Appliance Role-Based Access Controls Configuring Device User Roles You can edit the predefined roles, or you can create or edit user-defined roles. When you create a new role, you specify a name and description of the new role, and then choose the operations privileges for each task. You can also assign this role to one or more users. Note This configuration is applicable only on the device or building block and will not be enforced by the ANM. To manipulate the ANM RBAC, go to Admin > Role-Based Access Control. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Device RBAC > Roles. • To configure a configuration building block, choose Config > Global > Building Blocks > building_block > Role-Based Access Control > Roles. A table of the defined roles and their settings appears. Step 2 In the table, choose the type of configuration that you want to perform as follows: • To add a new role, click Add, enter the attributes described in Table 5-20, and then click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • To edit an existing role, choose the role, and click Edit. The Roles configuration window appears. Step 3 Click Edit. The Rule table appears. Step 4 In the Rule table, click Add to create rules for this role, or choose the rule that you want to configure, and click Edit. See Table 5-21 for rule attribute descriptions. Table 5-20 Role Attributes Attribute Description Name Name of the role. Description Brief description of the role. 5-59 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring ACE Module and Appliance Role-Based Access Controls Step 5 Click Deploy Now to update the rule for this role or click Next to deploy this rule and move to another rule. Step 6 Click Deploy Now to update this role and save this configuration to the running-configuration and startup-configuration files. Related Topics • Configuring Device RBAC Roles, page 5-56 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Table 5-21 Rule Attributes Attribute Description Rule Number Number assigned to this rule. Permission Permit or deny the specified operation. Operation Create, debug, modify1 , and monitor the specified feature. 1. Certain features are not available for certain operations. For modify, the following features cannot be used: Changeto, config-copy, DHCP, Exec-commands, NAT, real-inservice, routing, and syslog. Feature AAA, Access List, Change To Context, Config Copy, Connection, DHCP, Exec-Commands, Fault Tolerant, Inspect, Interface, Load Balance, NAT, PKI, Probe, Real Inservice, Routing, Real Server, Server Farm, SSL2 , Sticky, Syslog, and VIP. The Changeto feature allows you to move from the Admin context to another virtual context and maintain the same role with the same privileges in the new context that you had in the Admin context. This feature applies only to the Admin context and to the following ACE software versions: • ACE module software Version A2(1.3) and later releases. • ACE appliance software Version A3(2.2) and later releases. The Exec-commands feature enables all default custom role commands in the ACE. The default custom role commands are capture, debug, gunzip, mkdir, move, rmkdir, tac-pac, untar, write, and undebug. This feature applies to both Admin and user contexts and to the following ACE software versions: • ACE module software Version A2(1.3) and later releases. • ACE appliance software Version A3(2.2) and later releases. 2. For all SSL-related operations, a user with a custom role should include the following two rules: A rule that includes the SSL feature, and a rule that includes the PKI feature. 5-60 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring ACE Module and Appliance Role-Based Access Controls Modifying Device User Roles You can modify any user-defined role. Note This configuration is applicable only on the device or building block and will not be enforced by ANM. To manipulate ANM RBAC, go to Admin > Role-Based Access Control. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Device RBAC > Roles. • To configure a configuration building block, choose Config > Global > Building Blocks > building_block > Role-Based Access Control > Roles. A table of the defined roles and their settings appears. Step 2 In the table, choose the role that you want to modify. Step 3 Click Edit. For details on updating role rules, see Table 5-21. Step 4 Make the changes. For details on updating role rules, see the “Adding, Editing, or Deleting Rules” section on page 5-61. Step 5 Click Deploy Now to update the rules for this role and save this configuration to the running-configuration and startup-configuration files. Related Topics • Configuring Device RBAC Roles, page 5-56 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Deleting Device User Roles You can delete any user-defined roles. Note This configuration is applicable only on the device or building block and will not be enforced by ANM. To manipulate ANM RBAC, go to Admin > Role-Based Access Control. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Device RBAC > Roles. • To configure a configuration building block, choose Config > Global > Building Blocks > building_block > Role-Based Access Control > Roles. The Roles table appears. Step 2 In the Roles table, choose the role to delete, and click Delete. 5-61 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring ACE Module and Appliance Role-Based Access Controls Step 3 Click OK to confirm the deletion. Users that have the deleted role no longer have that access. Related Topics • Configuring Device RBAC Roles, page 5-56 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Adding, Editing, or Deleting Rules You can change or delete rules to redefine what feature access a specific role contains. Note This configuration is applicable only on the device or building block and will not be enforced by ANM. To manipulate ANM RBAC, go to Admin > Role-Based Access Control. Procedure Step 1 After selecting the user-defined role, click Edit. The Rule window appears. Step 2 Do one of the following: • To create a new rule, click Add. Enter the rule information (see Table 5-21 on page 5-59), and then click Deploy Now to add the rule or Next to deploy this rule and add another rule. • To change an existing rule, choose a rule and click Edit. Click Deploy Now to save this rule to the running-configuration and startup-configuration files. • To remove rules from a role, choose the rules to remove, and click Delete. Click OK to confirm its deletion. Step 3 Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. Related Topics • Configuring Device RBAC Roles, page 5-56 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Configuring Device RBAC Domains You can configure device RBAC domains. This section includes the following topics: • Guidelines for Managing Domains, page 5-62 • Displaying Domains for a Device, page 5-62 • Configuring Device Domains, page 5-63 • Modifying Device Domains, page 5-65 5-62 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring ACE Module and Appliance Role-Based Access Controls • Deleting Device Domains, page 5-65 Related Topics • Information About Device Management, page 5-2 • How ANM Handles Role-Based Access Control, page 18-8 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Guidelines for Managing Domains Follow these guidelines for managing domains: • Devices and their components must already be configured in order for them to be added to a domain. • Domains are logical concepts. You do not delete a member of a domain when you delete the domain. • The predefined default domain cannot be modified or deleted. • Normally, a user is associated with the default domain, which allows the user to see all configurations within the context. When a user is configured with a customized domain, then the user can see only what is in the domain. Related Topics • Configuring Device RBAC Domains, page 5-61 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Displaying Domains for a Device You can display domains for a device. Note Your user role determines whether you can use this option. Procedure Step 1 Choose the item to view: • To view a domain for the device’s virtual context, choose Config > Devices > context > Device RBAC > Domains. • To view a domain for a configuration building block, choose Config > Global > Building Blocks > building block > Role-Based Access Control > Domains. The Domains table appears. Step 2 Expand the Domains table until you can see all the network domains. Step 3 Choose a domain to display the settings for that domain. You can also perform these tasks from this window: • Configuring Device Domains, page 5-63 • Modifying Device Domains, page 5-65 • Deleting Device Domains, page 5-65 5-63 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring ACE Module and Appliance Role-Based Access Controls Related Topics • Configuring Device RBAC Domains, page 5-61 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Configuring Device Domains You can add or modify domains on a selected device, such as a Catalyst 6500 series chassis. Note This configuration is applicable only on the device or building block and will not be enforced by ANM. To manipulate ANM RBAC, go to Admin > Role-Based Access Control. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Device RBAC > Domains. • To configure a configuration building block, choose Config > Global > Building Blocks > building_block > Role-Based Access Control > Domains. The Domains table appears. Step 2 In the Domains table, choose the type of configuration that you want to perform: • To add a new domain, click Add, enter the Domain Name, and then click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • To edit a domain, choose the domain that you want to configure, and then click Edit. The Domain Object field appears below the Domain Name in the content area. Step 3 Click Edit to enter the Domain Object table. 5-64 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring ACE Module and Appliance Role-Based Access Controls Step 4 In the Domain Object table, choose the type of configuration that you want to perform: • Click Add to create domain objects for this domain. See Table 5-22 for Domain Object attributes. • To remove an object, choose the object that you want to remove, and then click Delete. Step 5 Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The Domains Edit window updates and displays the total object number next to the object name. Related Topics • Configuring Device RBAC Domains, page 5-61 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Table 5-22 Domain Attributes Field Description Name Field that appears when any specific object type is selected. Name of an existing object defined. All Objects Collection of objects in this domain. The following options may be available depending on your virtual context: • All • Access List EtherType • Access List Extended • Class Map • Interface VLAN • Interface BVI • Parameter Map • Policy Map • Probe • Real Server • Script • Server Farm • Sticky 5-65 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Configuring ACE Module and Appliance Role-Based Access Controls Modifying Device Domains You can change the settings in a domain. Note This configuration is applicable only on the device or building block and will not be enforced by ANM. To manipulate ANM RBAC, go to Admin > Role-Based Access Control. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Device RBAC > Domains. • To configure a configuration building block, choose Config > Global > Building Blocks > building_block > Role-Based Access Control > Domains. Step 2 Choose the domain that you want to edit. Step 3 Click Edit. The Edit Domain window appears. Step 4 Edit the object fields (see Table 5-22). Step 5 Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. Related Topics • Configuring Device RBAC Domains, page 5-61 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Deleting Device Domains You can delete a network domain from ANM, and all the devices and subdomains that it contains. Note This configuration is applicable only on the device or building block and will not be enforced by ANM. To manipulate ANM RBAC, go to Admin > Role-Based Access Control. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Device RBAC > Domains. • To configure a configuration building block, choose Config > Global > Building Blocks > building_block > Role-Based Access Control > Domains. The Domains table appears. Step 2 In the Domains table, choose the domain that you want to delete. Step 3 Click Delete. A prompt asks you to confirm this action. 5-66 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices Step 4 Click OK. The domain is removed from the ANM database. Related Topics • Configuring Device RBAC Domains, page 5-61 • Configuring ACE Module and Appliance Role-Based Access Controls, page 5-53 Managing Devices This section describes how to manage devices. This section includes the following topics: • Synchronizing Device Configurations, page 5-66 • Mapping Real Servers to VMware Virtual Machines, page 5-68 • Instructing ANM to Recognize an ACE Module Software Upgrade, page 5-71 • Configuring User-Defined Groups, page 5-72 • Changing Device Credentials, page 5-75 • Changing ACE Module Passwords, page 5-77 • Restarting Device Polling, page 5-78 • Displaying All Devices, page 5-78 • Displaying Modules by Chassis, page 5-79 • Removing Modules from the ANM Database, page 5-80 Synchronizing Device Configurations ANM provides three levels of synchronization. You can choose to synchronize from the device to ANM as follows: • From the chassis level—Use this level when you want to synchronize Catalyst 6500 series chassis and module updates. See the “Synchronizing Chassis Configurations” section on page 5-67. • From the ACE module level—Use this level when you want to synchronize changes to your ACE or CSM modules, such as new virtual contexts. See the “Synchronizing Module Configurations” section on page 5-67. • From the virtual context level —Use this level in the Admin context to synchronize all current and new virtual contexts or at the user context level to synchronize a specific user context. See the “Synchronizing Virtual Context Configurations” section on page 6-105. Caution If you see a difference in device information between what ANM displays and what you see by directly accessing the device through the CLI, ANM displays the data that is the least accurate. This condition can occur when the device is modified outside of ANM by using the CLI. We recommend that you synchronize the network devices up to the ANM using the synchronization option, which makes the ANM data more accurate. 5-67 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices Synchronizing Chassis Configurations You can manually synchronize the configuration for Catalyst 6500 series switches, CSS devices, GSS devices and ACE appliances when there have been changes to a device that are not tracked in ANM. Note ANM does not support auto synchronization for the Catalyst 6500 series switches, Cisco 7600 series routers, CSM, CSS, GSS, or VSS devices. Be sure to synchronize configurations on these devices after import, and whenever their configurations have been modified through the CLI. The following require synchronization: • Upgrading chassis hardware or software • Adding new modules to the chassis • Removing a module from a chassis • Rearranging modules within the chassis • Upgrading module software • Changing the chassis configuration using the CLI instead of the ANM Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Step 2 In the All Devices table, choose the device with the configuration that you want to synchronize, and click CLI Sync. A popup confirmation window appears asking you to confirm the synchronization. Step 3 In the confirmation window, click OK to synchronize the configuration or Cancel to cancel the synchronization. ANM displays the status while synchronization is in progress and returns to the All Devices table when synchronization is complete. Related Topics • Configuring Devices, page 5-34 • Synchronizing Module Configurations, page 5-67 • Restarting Device Polling, page 5-78 Synchronizing Module Configurations You can synchronize configurations for ACE modules or CSM modules when changes are made that have not been tracked in ANM. The following module changes require synchronization: • Upgrading module software • Changing the module configuration using the CLI instead of the ANM 5-68 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Step 2 In the All Devices table, choose the chassis that contains the module with the configuration that you want to synchronize, and click Modules. The Modules table appears. Step 3 In the Modules table, choose the module with the configuration you want to synchronize, and click Sync. A popup confirmation window appears asking you to confirm the synchronization. Step 4 In the confirmation window, click OK to synchronize the configuration or Cancel to cancel the synchronization. ANM displays the status while synchronization is in progress and returns to the Modules table when synchronization is complete. Related Topics • Configuring Devices, page 5-34 • Managing Devices, page 5-66 • Synchronizing Device Configurations, page 5-66 Mapping Real Servers to VMware Virtual Machines This section describes how ANM maps ACE, CSS, CSM, or CSM-S real servers to VMware vCenter Server VMs when you integrate ANM with a VMware virtual data center. This section also shows how you can display and manage the mappings associated with a VMware vCenter Server. Note To map a real server to a VM, the real server must be associated with a server farm (see the “Configuring Server Farms” section on page 8-30). ANM uses the following methods to map a real server to a VM: • IP Match—ANM matching the real server IP addresses to the VM IP address. This is the default mapping method that ANM uses and requires the following items: – Before you import a VMware vCenter Server into ANM along with its associated VMs, configure a real server in ANM for each VM about to be imported with the vCenter Server. Configure each real server with the IP address of a VM. For more information, see the “Configuring Real Servers” section on page 8-5 and the “Importing VMware vCenter Servers” section on page 5-24. – ANM must be able to determine the IP address of a VM, which is accomplished by installing VMware Tools on the guest operating system (OS) of the VM. • Name Match—ANM matches the real server name to the VM name. This is the backup mapping method that ANM uses if it cannot match any IP address for the VM. This method requires consistent use of the device names throughout the network. 5-69 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices Note For the CSM and CSM-S, the VM name must be in uppercase because the CSM and CSM-S real server names are always in upper case and the mapping is case sensitive though the CSM and CSM-S is case insensitive. From vSphere Client, you can change a VM name to uppercase by right-clicking on the VM in the VM tree and choosing Rename. • Override—You specify the real server-to-VM mapping. • Ignore—ANM ignores any mapping method. ANM can detect when VMs are added or deleted to a VMware vCenter Server by listening to the server events or by polling the server. When a new VM is detected, ANM uses the IP match method to try and match the new VM with a real server. Prerequisites This topic includes the following prerequisites: • Import the VMware vCenter Server into ANM (see the “Importing VMware vCenter Servers” section on page 5-24). • Register the ANM plug-in with the VMware vCenter Servers that you want to view and manage. Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Step 2 In the All Devices table, choose the VMware vCenter Server that contains the VMs that you want to display and map. The Primary Attribute table appears. Step 3 Click VM Mappings. The VM Mappings table appears. Table 5-3 describes the information that displays in the VM Mappings table. Table 5-23 VM Mappings Table Item Description VM Name Name of the VM associated with the selected VMware vCenter Server. IP Address(es) IP address of the VM. Full Path Path of the VM on the VMware vCenter Server. Rule Currently Applied Mapping rule applied: IP Match, Name Match, Override, or Ignore. This field is blank if ANM is unable to find a real server match for the VM. You can manually map a real server to the VM using the Edit Mapping feature (see Step 5). 5-70 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices Note If the VM Mappings window does not display or a VM name contains hex values rather than certain special characters, these conditions indicate that VM names associated with a vCenter Server that you imported in to ANM contain special characters that ANM does not recognize. For example, a VM name that contains a double quote (“) prevents ANM from displaying the VM Mappings window. If a VM name contains a percent sign (%), backslash (\), or forward slash (/), ANM displays the VM name in the VM Mappings window; however, these special characters display as hex values (%25 for %, %5c for \, and %2f for /). To correct these issues, remove the special characters from the VM names and then manually perform a CLI synchronization (see Step 4). Step 4 (Optional) To update the displayed real server to VM mapping information, manually perform a CLI synchronization with the vCenter Server as follows: a. Choose Config > Devices > All Devices. The All Devices table appears. b. From the All Devices table, click the radio button associated with the desired vCenter Server. c. Click CLI Sync. Note You must perform this step to update the display if you import a Cisco device after you import an associated vCenter Server. Step 5 (Optional) To change the mapping rule applied to a VM, in the VM Mappings window, check the checkbox next to the VM names to edit and click Edit Mappings. The VM Mappings edit window appears, providing a list of the selected VMs and the mapping rule options. Step 6 From the VM Mappings edit window, choose one of the following options from the Mapping Rule drop-down list: • IP Match—Map the VMs to ACE real servers based on matching IP addresses. Skip to Step 8. • Name Match—Map the VMs to ACE real servers based on matching device names. Skip to Step 8. • Ignore—Ignore any mapping rule and do not map the VM to an ACE real server. Skip to Step 8. ACE Real Server(s) ACE real server that the VM maps to on ANM. Note the following: • This field is blank if ANM is unable to find a real server match for the VM. You can manually map a real server to the VM using the Edit Mapping feature (see Step 5). • If the VM has been deleted in the vCenter Server but ANM still has the mapping, a delete icon (red circle with an “x”) appears at the end of the real server ID. Click the icon to remove the mapping from the table. Last Updated Time Timestamp when the mapping information was obtained. Table 5-23 VM Mappings Table (continued) Item Description 5-71 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices • Override—Map the VMs the specified ACE real servers. This option is available only when you have one VM selected from the All Devices table (see Step 2). When you choose Override, ANM displays the Select Real Server(s) table of available ACE real servers that includes the device information, real server name, IP address, port number, and server farm to which the real server belongs. Step 7 If you chose the Override mapping rule, do one or both of the following: • Check the checkbox next to the real servers to map the selected real servers to the VM. To select all of the available real servers, check the Device checkbox located at the top of the table. • Click Add to add a new real server. The Add a Real Server popup window appears. Define the new real server as described in Table 5-24 and click Deploy Now. Step 8 In the VM Mappings window, click OK to save the new mapping rule or Cancel to cancel the change. Related Topics • Configuring Real Servers, page 8-5 • Importing VMware vCenter Servers, page 5-24 • Configuring VMware vCenter Server Primary Attributes, page 5-41 Instructing ANM to Recognize an ACE Module Software Upgrade When you upgrade the software of an ACE module that has been imported to the ANM database, perform the procedure outlined in this section to enable ANM to recognize the updated release and display features and functions in the ANM GUI that are appropriate for the ACE module software upgrade. For example, if an imported ACE module contains software Version A2(2.1), and you wish to upgrade to software Version A2(3.0) to take advantage of features such as backup and restore, you must perform the steps outlined below to instruct ANM to recognize the upgraded ACE module software version and Table 5-24 Adding a Real Server for VM Mapping Item Description Real Server Name Unique name for this server or accept the automatically incremented value in this field. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. Real Server IP Address Unique IP address in dotted-decimal format (such as 192.168.11.1). The IP address cannot be an existing virtual IP address (VIP). Real Server Port Port used for communication with the real server. Real Server Weight Weight to be assigned to this real server in a server farm. Valid entries are from 1 to 100, and the default is 8. Real Server State State of the real server when deployed: • In Service—The real server is in service. • Out Of Service—The real server is out of service. ACE Virtual Context Virtual context that is associated with the real server. Serverfarm Server farm to which the real server belongs. Virtual Servers Virtual server that is associated with the real server. 5-72 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices display the features and functions associated with this release. If you do not instruct ANM to recognize an ACE module software upgrade, the ACE module import will occur without issue but the new features and functions associated a specific ACE module software release will not appear in the ANM GUI. Procedure Step 1 After you upgrade an ACE module software image, perform a CLI sync on the module’s host device (see the “Synchronizing Chassis Configurations” section on page 5-67). Step 2 After you complete the CLI sync, whenever ANM detects an upgrade on an imported ACE module, ANM issues a warning to instruct you to perform a CLI sync on the ACE module to recognize the upgrade. Perform the procedure described in the “Synchronizing Module Configurations” section on page 5-67. The ACE software upgrade sequence is completed. Configuring User-Defined Groups You can create logical groupings of virtual contexts or chassis for ease of management. These logical groups are known as user-defined groups and appear in the device tree (Config > Devices) in the folder named Groups for quick access. Users can create their own groups, add and remove members, and assign group names that suit their environment and are meaningful to them. This section includes the following topics: • Adding a User-Defined Group, page 5-72 • Modifying a User-Defined Group, page 5-73 • Duplicating a User-Defined Group, page 5-74 • Deleting a User-Defined Group, page 5-75 Note Device groups continue to display device information even after you remove that device from ANM, which allows the device group information to be easily reassociated if you reimport the device. The device name must remain the same. Adding a User-Defined Group You can add a user-defined group. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose Groups. The Groups table appears. Step 3 Click Add to add a new group, or choose an existing group, and click Edit to modify it. 5-73 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices The Group configuration window appears. Step 4 In the Name field of the Group configuration window, enter a unique name for this group. Valid entries are unquoted text strings with no spaces and a maximum of 26 alphanumeric characters. The window identifies the objects by type and provides a search field for each: • Virtual Context Members • Device Members • Module Members • CSM Members Step 5 To add objects to the group, for each object type, choose the object in the Available Items list, and click Add. The selected objects appear in the Selected Items list. To remove objects that you do not want to include, choose the objects in the Selected Items list, and click Remove. The items then appear in the Available Items list. To search for specific objects, enter a search string that contains the object name or part of the object name in the Search field, and then click Search. The Available Items list refreshes with the objects that meet the search criteria. Step 6 In the Description field, enter a description for this group. Step 7 Do one of the following: • Click Save to accept your entries and to return to the Groups table. • Click Cancel to exit this procedure without saving your entries and to return to the Groups table. Related Topics • Configuring User-Defined Groups, page 5-72 • Modifying a User-Defined Group, page 5-73 • Duplicating a User-Defined Group, page 5-74 • Deleting a User-Defined Group, page 5-75 Modifying a User-Defined Group You can change the members or the description of a user-defined group. You cannot change the name of an existing user-defined group. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, click Groups. The Groups table appears. Step 3 In the Groups table, choose the group that you want to modify, and click Edit. The Group configuration window appears. 5-74 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices Step 4 In each Members field of the Group configuration window, add or remove group members as follows: • Choose the items that you want to add to this group in the Available Items list, and click Add. • Choose the items that you want to remove from this group in the Selected Items list, and click Remove. Step 5 In the Description field, modify the description as needed. Step 6 Do one of the following: • Click Save to accept your entries and to return to the Groups table. • Click Cancel to exit this procedure without saving your entries and to return to the Groups table. Related Topics • Configuring User-Defined Groups, page 5-72 • Adding a User-Defined Group, page 5-72 • Duplicating a User-Defined Group, page 5-74 • Deleting a User-Defined Group, page 5-75 Duplicating a User-Defined Group You can duplicate a user-defined group. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, click Groups. The Groups table appears. Step 3 In the Groups table, choose the user-defined group that you want to duplicate, and click Duplicate. A popup window appears asking you to enter a new name. Step 4 In the popup window, type the new group name, and click OK. The Groups table refreshes and the duplicated group name appears in the list. Related Topics • Configuring User-Defined Groups, page 5-72 • Adding a User-Defined Group, page 5-72 • Modifying a User-Defined Group, page 5-73 • Deleting a User-Defined Group, page 5-75 5-75 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices Deleting a User-Defined Group You can delete a user-defined group. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, click Groups. The Groups table appears. Step 3 In the Groups table, choose the user-defined group that you want to remove, and click Delete. A popup confirmation window appears asking you to confirm the deletion. Step 4 In the popup confirmation window, do one of the following: • Click OK to delete the selected user-defined group. The Groups table refreshes and the deleted group no longer appears. • Click Cancel to exit this procedure without deleting the group. The Groups table refreshes. Related Topics • Configuring User-Defined Groups, page 5-72 • Adding a User-Defined Group, page 5-72 • Modifying a User-Defined Group, page 5-73 • Duplicating a User-Defined Group, page 5-74 Changing Device Credentials You can change the credentials associated with a device managed by ANM. Each device that you import into ANM has a device username and password associated with it that ANM uses to access the device. Some device types, such as the GSS, also have a device enable password associated with them. From ANM, you can change the device credentials in the ANM database to match a change made to the credentials on a device using the CLI. This feature allows you to change the device credentials without having to rediscover or reimport the device. This procedure applies to the following device types that have been imported into ANM: • ACE appliance • Global Site Selector (GSS) • Content Services Switch (CSS) • Catalyst 6500 Virtual Switching System (VSS) 1440 • Catalyst 6500 series switch • Cisco 7600 series router • VMware vCenter Server 5-76 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices Note To change the credentials of an ACE module, see the “Changing ACE Module Passwords” section on page 5-77. Guidelines and Restrictions This topic includes the following guidelines and restrictions: • You can change a device username, password, or both. • We recommend changing the device credentials on the device before changing the credentials on ANM. Caution To maintain communication between ANM and the device, it is important that whatever device credential change you make on the device, you make the same change on ANM. Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Step 2 In the All Devices table, choose the device with the passwords that you want to update in ANM, and click Update Credentials. The Update Credentials popup window appears. Step 3 From the popup window, update the device credential using the information in Table 5-25. Note All credential fields are mandatory, so even if you are updating the device password only, you must enter the current device username. Step 4 Do one of the following: • Click OK to save your changes to ANM. Do the following: a. If you have not already made a similar change to the device credentials on the device, use the device CLI to make the changes now. b. Perform a CLI synchronization to test communications between ANM and the device with the new credentials (see the “Synchronizing Device Configurations” section on page 5-66). Table 5-25 Update Device Credentials Field Description Username Existing or new device username. New Password Existing or new device password. Confirm New Password Confirmation of the device password. New Enable Password1 1. GSS and Catalyst 6500 series switch only. Existing or new device enable password. Confirm Enable Password1 Confirmation of the device enable password. 5-77 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices • Click Cancel to ignore any changes that you made and close the popup window. Related Topics • Configuring Devices, page 5-34 • Managing Devices, page 5-66 • Changing ACE Module Passwords, page 5-77 Changing ACE Module Passwords You can change the ACE module username and password. All ACE modules shipped from Cisco are configured with the same administrative username and password. Because changing the module credentials can compromise network security, we recommend that you change the username and passwords after you import the module into the ANM database. Note This functionality is available only in Admin contexts. Before You Begin Import the ACE module into ANM and ensure that it is operational (see the “Importing ACE Modules after the Host Chassis has been Imported” section on page 5-16). Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 In the device tree, choose the chassis device containing the ACE module with the password that you want to change. The Primary Attributes window appears. Step 3 From the side menu, choose System > Module/Slots. The Modules table appears. Step 4 In the Modules table, choose the module with the password that you want to change and click Update Credentials. The Modules configuration window appears. Step 5 In the Card Slot field, confirm that the correct module is selected. Step 6 In the Card Type field, confirm that the correct version appears. Step 7 In the Module Has Been Imported Into ANM field, confirm that the checkbox is checked to indicate that the module has been imported. This is a read-only field. Step 8 From the Operation To Perform drop-down list, choose Update Credentials. Step 9 In the User Name field, enter the existing module username or enter a new username. Step 10 In the New Password field, enter the existing device password or enter a new password. Valid passwords are unquoted text strings with a maximum of 64 characters. Step 11 In the Confirm field, verify the password that you entered in the New Password field. 5-78 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices Step 12 Do one of the following: • Click OK to save your changes to ANM. Do the following: a. If you have not already made a similar change to the device credentials on the device, use the device CLI to make the changes now. b. Perform a CLI synchronization to test communications between ANM and the device with the new credentials (see the “Synchronizing Device Configurations” section on page 5-66). • Click Cancel to exit the procedure without saving your entries and to return to the Modules table. Related Topics • Importing ACE Modules after the Host Chassis has been Imported, page 5-16 • Configuring Devices, page 5-34 • Managing Devices, page 5-66 • Changing Device Credentials, page 5-75 Restarting Device Polling You can restart monitoring on a device that has stopped or failed to start. Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Step 2 In the All Devices table, choose the device whose monitoring has stopped or failed, and click Restart Polling. The All Devices table refreshes with updated polling status. For a description of the various polling status variables, see Table 5-26 on page 5-79. If ANM cannot monitor the selected device, it displays an error message stating the reason. Related Topics • Configuring Devices, page 5-34 Displaying All Devices You can display all devices that have been imported into the ANM database. Procedure Step 1 Choose Config > Devices. The device tree appears. 5-79 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices Step 2 In the device tree, choose All Devices. The All Devices table displays information for the devices being managed by the ANM (see Table 5-26). Related Topics • Importing Network Devices into ANM, page 5-10 • Configuring Catalyst 6500 Series Chassis and Cisco 7600 Series Router Primary Attributes, page 5-38 • Displaying Chassis Interfaces and Configuring High-Level Interface Attributes, page 5-42 Displaying Modules by Chassis You can display all modules on a specific chassis. Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Table 5-26 All Devices Table Attributes Field Description Name Name assigned to the device. Type Type of the device, such as Chassis, ACE 4710, or CSS. Version Version of the software running on the device, if available. IP Address Device IP address. Polling Status Current polling status of the device: • Missing SNMP Credentials—SNMP credentials are not configured for this device; therefore, statistics are not collected. Add SNMPv2C credentials to fix this error. • Not Polled—SNMP polling has not started. Add SNMP V2C credentials to fix this error. • Monitoring Not Supported—This status appears at the device level only and applies to Catalyst 6500 series chassis, Cisco 7600 series routers, and ACE appliances. • Polling Failed—SNMP polling failed due to some internal error. Try enabling the SNMP collection again. • Polling Started—No action is required; everything is working properly. Polling states will display the activity. • Polling Timed Out—SNMP polling has timed out. This situation might occur if the wrong credentials were configured or an internal error exists, such as the SNMP protocol is configured incorrectly or the destination is not reachable. Verify that SNMP credentials are correct. If the problem persists, enable SNMP collection again. • Unknown—SNMP polling is not working due to one of the above-mentioned conditions. Check the SNMPv2C credential configuration. 5-80 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices Step 2 In the All Devices table, choose the chassis containing the modules that you want to view, and click Modules. The Modules table appears, listing all modules on that chassis with the following information: • Slot number • Service module model • Module type, such as Cisco Content Switching Module (CSM), ACE module and version, or other modules, such as supervisor modules • Serial number • Module operational state, such as Up, Powered Off, or Not Imported • Version of software the module is running • Brief description • For ACE modules, the number of virtual contexts configured on the module • For VSS devices, a Virtual Switch number column indicating the switch, slot, and port number. For example, command interface 1/5/4 specifies port 4 of the switching module in slot 5 of switch 1. Depending on the type of module selected, such as CSM or ACE modules, the following options are available from this window: • Import—Imports a CSM or ACE module that resides in the selected chassis but has not been imported into the ANM database. For more information, see the “Importing ACE Modules after the Host Chassis has been Imported” section on page 5-16 or the “Importing CSM Devices after the Host Chassis has been Imported” section on page 5-19. • Change Card Password—Changes the administrative password on an ACE module that has been imported into the ANM database. For more information, see the “Changing ACE Module Passwords” section on page 5-77. • Do Not Manage—Removes a selected ACE module from the ANM database. For more information, see the “Removing Modules from the ANM Database” section on page 5-80. Step 3 (Optional) To display the modules of another chassis, choose another chassis in the device tree or use the chassis selector field at the top of the window. Related Topics • Importing ACE Modules after the Host Chassis has been Imported, page 5-16 • Importing CSM Devices after the Host Chassis has been Imported, page 5-19 • Displaying Chassis Interfaces and Configuring High-Level Interface Attributes, page 5-42 • Managing Catalyst 6500 Series Chassis or Cisco 7600 Series Router VLANs, page 5-48 Removing Modules from the ANM Database You can remove a module from the ANM database. Note If you physically replace an ACE module in a chassis, you need to synchronize the chassis in the ANM. See the “Synchronizing Chassis Configurations” section on page 5-67 for more information. 5-81 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Managing Devices Procedure Step 1 Choose Config > Devices > All Devices. The All Devices table appears. Step 2 In the All Devices table, choose the device containing the module that you want to remove, and click Modules. The Modules table appears. Step 3 In the Modules table, choose the module that you want to remove from ANM management, and click Do Not Manage. The Modules configuration window appears. Step 4 In the Modules configuration window, confirm the information in the following fields: • Card Slot • Card Type • Module Has Been Imported Into ANM Step 5 In the Operation To Perform field, choose Do Not Manage. Step 6 Do one of the following: • Click OK to confirm removal of the module. The Modules table refreshes and the removed module appears with the state Not Imported. You can import the module again when desired (see the “Importing ACE Modules after the Host Chassis has been Imported” section on page 5-16). • Click Cancel to exit the procedure without removing the ACE module and to return to the Modules table. Related Topics • Importing Network Devices into ANM, page 5-10 • Changing ACE Module Passwords, page 5-77 5-82 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Replacing an ACE Module Managed by ANM Replacing an ACE Module Managed by ANM This section describes the process that you must follow when replacing an ACE module that is currently managed by ANM.You may need to replace an ACE module to perform a hardware upgrade or replace a device associated with a Return Materials Authorization (RMA). The procedures in this section show how to replace an ACE module using either the preferred method, which uses the ANM GUI, or the alternate method, which uses a combination of the ACE CLI and the ANM GUI. Guidelines and Restrictions This topic includes the following guidelines and restrictions: • The replacement process includes creating a backup of the ACE module being removed and installing the backup on the replacement module. The final step is to run a script that maps the domain attributes that were mapped to the old ACE module serial number to the new module serial number. These domain attributes include items such as real servers, virtual servers, user groups, custom groups, mobile favorites, and so forth. Caution When replacing your ACE module, it is important that you complete the entire replacement procedure before attempting to edit the properties of any domain. Editing the domains before running the script that remaps existing domain attributes to the new ACE module serial number can result in the attributes being removed. • If you currently use an ACE10 or ACE20 module, you must upgrade to the ACE30 module with ACE software Version A5(1.0) to use the new features associated with the A5(1.0) release in ANM 5.1. For more information about a module upgrade, see the Cisco Application Control Engine (ACE30) Module Installation Note. Caution When replacing an ACE module that is part of a redundant pair providing high availability, be sure that the ACE module being replaced is operating in the standby state and not in the active state. Replacing an active redundant ACE module is a service-affecting operation. The state information is displayed in the HA State and HA Autosync fields when you choose Config > Devices > virtual_context. Force a switchover if needed to place the ACE module in the standby state before you replace it. Prerequisites To perform the procedures in this section, you need a copy of the Cisco Application Control Engine (ACE30) Module Installation Note which you can obtain on Cisco.com. This section includes the following topics: • Using the Preferred Method to Replace an ACE Module, page 5-82 • Using the Alternate Method to Replace an ACE Module, page 5-84 Using the Preferred Method to Replace an ACE Module You can replace an ACE module currently managed by ANM by using the ANM GUI-based method. 5-83 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Replacing an ACE Module Managed by ANM Note For details about any of the ANM GUI functions discussed in the following procedure, click Help to display the context-sensitive help associated with the current GUI window. Procedure Step 1 From the ANM GUI, create a backup the ACE module that you are replacing using one of the following methods: • Choose Config > Devices > context > System > Backup / Restore. The Backup/Restore window appears. • Choose Config > Global > All Backups. The Backup window appears. Note The Backup/Restore feature requires ACE module software Version A2(3.0) or later. Save or copy the backup to a network location. Step 2 Record the module serial number of the ACE module being replaced, which you will need in Step 11. To obtain the module serial number, choose Config > Devices > All Devices, click the chassis that contains the module being replaced, and click Modules. Step 3 From the Cisco IOS host chassis, remove the ACE module that you want to replace (see the Cisco Application Control Engine (ACE30) Module Installation Note). Step 4 From the ANM GUI, perform a CLI synchronization with the Cisco IOS host chassis. Note When you perform the CLI synchronization, all the threshold groups associated with the removed ACE module are deleted. Do the following: a. Choose Config > Devices > All Devices. The Device Management window appears. b. From the Device Management window, click the radio button associated with the host chassis. c. Click CLI Sync. A message similar to the following appears: Warning: The module has been removed: serial#=SAL1413E2YK Step 5 From the Cisco IOS host chassis, insert the replacement (new) ACE module into the chassis (see the Cisco Application Control Engine (ACE30) Module Installation Note). Step 6 Using the CLI, verify that the software on the replacement ACE is equal to or greater than the software version used in the original ACE. Upgrade the ACE software on the new device if needed. After the upgrade, reboot the ACE module and verify that it is running with the correct software image to ensure that ANM can recognize it. Step 7 From the ANM GUI, do the following to perform a CLI synchronization with the Cisco IOS host chassis by doing the following: a. Choose Config > Devices > All Devices. The Device Management window appears. b. From the Device Management window, click the radio button associated with the host chassis. 5-84 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Replacing an ACE Module Managed by ANM c. Click CLI Sync. A message similar to the following appears: The module has been added: serial#=SAD140102XR Record the new ACE module serial number, which you will need for Step 11. Step 8 From the Device Management window, import the replacement module in to ANM as follows: a. Click the radio button associated with the host chassis and click Modules. The Modules window appears. b. From the Modules window, click the radio button associated with the replacement module and click Import. The Module configuration window appears. c. From the configuration window, choose Perform Initial Setup and Import from the Operation To Perform drop-down list and enter the module configuration information that you recorded in Step 2. d. Click OK to save the module configuration information. Step 9 Install a license in the replacement module that is consistent with the removed module by choosing Config > Devices > chassis > module > Admin > System > Licenses. The Licenses window appears. Step 10 Copy and restore the saved ACE configuration to the replacement module by choosing Config > Devices > chassis > module > Admin > System > Backup / Restore. Note The Backup/Restore feature requires ACE module software Version A2(3.0) or later. Step 11 Remap the ANM objects mapped to the old ACE module serial number to the new ACE module serial number as follows: a. Enter the following command to list the module serial numbers that are unassociated with a device in ANM: anm-RMA-helper-query Verify that the list includes the serial number of the old ACE module that you recorded in Step 2. b. Enter the following command to map the objects to the new ACE module serial number: anm-RMA-helper-replace c. Follow the prompts that appear to log in to ANM and specify the old ACE module serial number recorded in Step 2 and the new module serial number recorded in Step 7. t Related Topics • Importing ACE Modules after the Host Chassis has been Imported, page 5-16 Using the Alternate Method to Replace an ACE Module This procedure describes the alternate method for replacing an ACE module currently managed by ANM. This method uses a combination of the ACE CLI and ANM GUI during the replacement process. To see the preferred method for replacing an ACE module, see the “Using the Preferred Method to Replace an ACE Module” section on page 5-82. 5-85 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Replacing an ACE Module Managed by ANM Note For details about using the ACE CLI to perform the procedures discussed in the following procedure, see the Cisco Application Control Engine (ACE30) Module Installation Note). For details about any ANM GUI function discussed in the following procedure, click Help to display the context-sensitive help associated with the current GUI window. Procedure Step 1 Referring to the Cisco Application Control Engine (ACE30) Module Installation Note, do the following: a. SSH in to the ACE and backup all contexts from the Admin context (requires ACE module software Version A2(3.0) or later). b. Copy the backup to a network location (requires ACE module software Version A2(3.0) or later). c. Obtain and record the old module serial number using the show hardware command. You will need the serial number in Step 4. d. From the Cisco IOS host chassis, remove the ACE module that you want to replace. e. From the Cisco IOS host chassis, insert the replacement ACE module into the chassis. f. Verify that the software on the replacement ACE is equal to or greater than the software version used in the original ACE. Upgrade the ACE software on the new device if needed. g. SSH in to the chassis and session in to the new ACE module. h. Configure basic ACE module connectivity. i. Obtain and record the new module serial number using the show hardware command. j. Copy and install necessary licenses. k. Copy and restore the ACE backup. Step 2 From the ANM GUI, delete the Cisco IOS host chassis that hosts the replacement ACE module as follows: a. Choose Config > Devices > All Devices. The Device Management window appears. b. Click the radio button associated with the chassis in which the module was replaced. c. Click Delete. Step 3 From the Device Management window, import the Cisco IOS host chassis and associated chassis modules, including the replacement ACE module by clicking Add. The Add New Device window appears; complete the required chassis and module information. Step 4 Remap the ANM objects mapped to the old ACE module serial number to the new ACE module serial number as follows: a. Enter the following command to list the module serial numbers that are unassociated with a device in ANM: anm-RMA-helper-query Verify that the list includes the serial number of the old ACE module that you recorded in Step 1c. b. Enter the following command to map the objects to the new ACE module serial number: anm-RMA-helper-replace 5-86 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 5 Importing and Managing Devices Replacing an ACE Module Managed by ANM c. Follow the prompts that appear to log in to ANM and specify the old ACE module serial number recorded in Step 1c and the new module serial number. Related Topics • Importing ACE Modules after the Host Chassis has been Imported, page 5-16 CHAPTER 6-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 6 Configuring Virtual Contexts Date: 3/28/12 This chapter describes how to configure and manage the Cisco Application Control Engine (ACE) using Cisco Application Networking Manager (ANM). Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • Information About Virtual Contexts, page 6-2 • Creating Virtual Contexts, page 6-2 • Configuring Virtual Contexts, page 6-8 • Configuring Virtual Context System Attributes, page 6-13 • Configuring Virtual Context Primary Attributes, page 6-14 • Configuring Virtual Context Syslog Settings, page 6-19 • Configuring SNMP for Virtual Contexts, page 6-27 • Applying a Policy Map Globally to All VLAN Interfaces, page 6-35 • Managing ACE Licenses, page 6-36 • Using Resource Classes, page 6-43 • Using Global Resource Classes, page 6-46 • Using Local Resource Classes, page 6-51 • Using the Configuration Checkpoint and Rollback Service, page 6-54 • Performing Device Backup and Restore Functions, page 6-59 • Performing Global Device Backup and Copy Functions, page 6-68 • Configuring Security with ACLs, page 6-78 6-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Information About Virtual Contexts • Configuring Object Groups, page 6-89 • Managing ACLs, page 6-99 • Configuring Virtual Context Expert Options, page 6-101 • Comparing Context and Building Block Configurations, page 6-101 • Managing Virtual Contexts, page 6-103 Information About Virtual Contexts Virtual contexts use the concept of virtualization to partition your ACE into multiple virtual devices or contexts. Each context contains its own set of policies, interfaces, resources, and administrators. This feature enables you to more closely and efficiently manage resources, users, and the services you provide to your customers. There are two types of virtual contexts; the admin context and the user context. The ACE comes preconfigured with the default Admin context, which you can modify but you cannot delete. From the Admin context, you can create user contexts. You also use the Admin context to configure High Availability (HA or fault tolerance between ACE devices), configure resource classes, and manage ACE licenses. Note If you restore the ANM database from a backup repository and if a virtual context that is in the repository has been removed from the device, ANM removes that context from the database and the context does not appear in the ANM interface. Related Topics • Creating Virtual Contexts, page 6-2 • Configuring Virtual Contexts, page 6-8 • Deleting Virtual Contexts, page 6-107 • Comparing Context and Building Block Configurations, page 6-101 • Restarting Virtual Context Polling, page 6-108 • Managing Virtual Contexts, page 6-103 Creating Virtual Contexts You can create virtual contexts. Note You must have the ability to create virtual contexts in your role and an Admin context in your domain before you can create virtual contexts. For more information about configuring roles and domains, see the “Managing User Roles” section on page 18-25 and the “Managing Domains” section on page 18-32. Procedure Step 1 Choose Config > Devices, and choose the ACE to which you want to add a virtual context. The Virtual Contexts table appears. 6-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Creating Virtual Contexts Step 2 In the Virtual Contexts table, click Add. The New Virtual Context window appears. Step 3 Configure the virtual context using the information in Table 6-1. Click Basic Settings, Management Settings, or More Setting to access the additional configuration attributes. By default, ANM hides the Management Settings and More Settings groups of configuration attributes until you specify a VLAN identifier in the Management Settings group. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Table 6-1 Virtual Context Configuration Attributes Field Description Basic Settings Name Unique name for the virtual context. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. This field is read-only for existing contexts. Device Device to associate with this context. This field appears for new contexts only. Description Brief description of the virtual context. Enter a description as an unquoted text string with a maximum of 240 alphanumeric characters. Module Field that appears when a chassis contains multiple ACE modules and for new contexts only. Choose the module to associate with this context. Resource Class Resource class that this virtual context is to use. Allocated VLANs Number of a VLAN or a range of VLANs used by the traffic that the context is to receive. You can specify VLANs in any of the following ways: • For a single VLAN, enter an integer from 2 to 4096. • For multiple, nonsequential VLANs, use comma-separated entries, such as 101, 201, 302. • For a range of VLANs, use the format -, such as 101-150. Note VLANs cannot be modified in an Admin context. Default Gateway IP for IPv4 IPv4 address of the default gateway. Use a comma-separated list to specify multiple IP addresses, such as 192.168.65.1, 192.168.64.2. Default static routes with a netmask and IP address of 0.0.0.0 previously configured on the ACE appear in this field. 6-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Creating Virtual Contexts Default Gateway IP for IPv6 Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. IPv6 address of the default gateway or choose the forward VLAN interface or BVI, as follows: • IPv6 Address field—Enter the address of the gateway router (the next-hop address for this route). Then, use the right arrow to move it to the Selected field. You can enter a maximum of eight addresses including a selected VLAN or BVI through the Outgoing Interfaces setting. Default static routes with a prefix and IP address of ::0 previously configured on the ACE appear in the Selected field. • Outgoing Interfaces—Select either VLAN or BVI used for the link-local address only. And then select the Interface Number for the VLAN or BVI. Enable High Availability Context to be used in a high availability (HA) group. Note This field is unavailable if the associated FT interface is not configured or if the ACE peer is not known. See Chapter 13, “Configuring High Availability” for details on ACE HA groups. Management Settings VLAN Id VLAN number that you want to assign to the management interface. Valid values are from 2 to 4094. The VLAN ID should be available in the allocated VLAN interface list. By default, all devices are assigned to VLAN1, known as the default VLAN. Note You must enter a VLAN ID before the other Management Settings attribute fields are enabled for configuring. VLAN Description Description for the management interface. Enter an unquoted text string that contains a maximum of 240 alphanumeric characters including spaces. Interface Mode Topology that reflects the relationship of the selected ACE virtual context to the real servers in the network: • Routed—The ACE virtual context acts as a router between the client-side network and the server-side network. In this topology, every real server for the application must be routed through the ACE virtual context, either by setting the default gateway on each real server to the virtual context server-side VLAN interface address, or by using a separate router with appropriate routes configured between the ACE virtual context and the real servers. • Bridged—The virtual ACE bridges two VLANs—a client-side VLAN and a real-server VLAN—on the same subnet using a bridged virtual interface (BVI). The real server routing does not change to accommodate the ACE virtual context. Instead the virtual ACE transparently handles traffic to and from the real servers. Management IP IPv4 address that is to be used for remote management of the context. Note ANM considers an interface as a management interface if it has a management policy map associated with the VLAN interface. See the “Configuring Virtual Context VLAN Interfaces” section on page 12-6. Management Netmask Subnet mask to apply to this IP address. Alias IP Address IP address of the alias this interface is associated with. Peer IP Address IP address of the remote peer. Table 6-1 Virtual Context Configuration Attributes (continued) Field Description 6-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Creating Virtual Contexts Access Permission List of source IP addresses that are allowed on the management interface: • Allow All—Allows all configured client source IP addresses on the management interface as the network traffic matching criteria. • Deny All—Denies all configured client source IP addresses on the management interface as the network traffic matching criteria. • Match—Displays the Match Conditions table, where you specify the match criteria that the ACE is to use for traffic on the management interface. Table 6-1 Virtual Context Configuration Attributes (continued) Field Description 6-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Creating Virtual Contexts Match Conditions Match Conditions table that appears when you choose Match as the Access Permission selection. To add or modify the protocols allowed on this management VLAN, do the following: 1. Click Add to choose a protocol for the management interface, or choose an existing protocol entry listed in the Match Conditions table and click Edit to modify it. 2. In the Protocol drop-down list, choose a protocol: – HTTP—Specifies the Hypertext Transfer Protocol (HTTP). – HTTPS—Specifies the secure (SSL) Hypertext Transfer Protocol (HTTP) for connectivity with the ANM interface using port 443. – ICMP— Specifies the Internet Control Message Protocol (ICMP) for Internet Protocol version 4 (IPv4). – ICMPv6—Option that appears only for ACE module and ACE appliance software Version A5(1.0) or later. Specifies the Internet Control Message Protocol version 6 (ICMPv6) for Internet Protocol version 6 (IPv6). – – KALAP-UDP—Specifies the Keepalive Appliance Protocol over UDP. – SNMP—Specifies the Simple Network Management Protocol (SNMP). Note If SNMP is not selected, ANM will not be able to poll the context. – SSH—Specifies a Secure Shell (SSH) connection to the ACE. – TELNET—Specifies a Telnet connection to the ACE. – XML-HTTPS—Specifies HTTPS as the transfer protocol for sending and receiving XML documents between the ACE appliance and a Network Management System (NMS) using port 10443. This option is available for ACE appliances only. 3. In the Allowed From field, specify the matching criteria for the client source IP address: – Any—Specifies any client source address for the management traffic classification. – Source Address—Specifies a client source host IP address and subnet mask as the network traffic matching criteria. An ICMPv6 source address only accepts an IPv6 address. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. – Source Netmask—Select a subnet mask. This field is not applicable for ICMPv6. – Source Prefix Length—(ICMPv6 only) Enter the prefix length, a value from 1 to 128. 4. Click OK to accept the protocol selection (or click Cancel to exit without accepting your entries). Note To remove a protocol from the management VLAN, choose the entry in the Match Conditions table, and click Delete. Enable SNMP Get Check box that you can check to add an SNMP Get community string to enable SNMP polling on this context. Table 6-1 Virtual Context Configuration Attributes (continued) Field Description 6-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Creating Virtual Contexts Step 4 Do one of the following: • Click Deploy Now to deploy this context and save this configuration to the running-configuration and startup-configuration files. The window refreshes and you can continue with virtual context configuration (see the “Configuring Virtual Contexts” section on page 6-8). • Click Cancel to exit this procedure without saving your entries. The Virtual Contexts table appears. SNMP v2c Read-Only Community String Field that appears when you check the Enable SNMP Get check box. Enter the SNMPv2c read-only community string to be used as the SNMP Get community string. Enable SNMP Trap Check box that you can check to add an SNMP community string for ANM to receive traps from this context. SNMP Community Field that appears when you check the Enable SNMP Trap check box. Enter the SNMP version 1 or 2c read-only community string or the SNMP version 3 user name that is to be used as the SNMP trap. Enable Syslog Notification Check box that you can check to enable syslog logging or uncheck to disable syslog logging. Add Admin User Check box that you can check to add a user with an administrator role and default-domain access. User Name Field that appears when you check the Add Admin User check box. Specifies the name by which the user is to be identified (up to 24 characters). Only letters, numbers, and underscore can be used. The field is case sensitive. Password Field that appears when you check the Add Admin User check box. Enter the password for the Admin user account. Confirm Password Field that appears when you check the Add Admin User check box. Renter the password for the Admin user account. More Settings Switch Mode Feature that applies only to the ACE module A2(1.1), ACE appliance A4(1.0), or later releases of either device type. Choose Switch Mode to change the way that the ACE processes TCP connections that are not destined to a VIP or that do not have any policies associated with their traffic. For such traffic, the ACE still creates connection objects, but processes the connections as stateless connections, which means that they do not undergo any TCP normalization checks. With this option enabled, the ACE also creates stateless connections for non-SYN TCP packets if they satisfy all other configured requirements. This process ensures that a long-lived persistent connection passes through the ACE successfully (even if it times out) by being reestablished by any incoming packet related to the connection. By default, these stateless connections time out after 2 hours and 15 minutes unless you configure the inactivity timeout otherwise in a parameter map. When a stateless connection times out, the ACE does not send a TCP RST packet but silently closes the connection. Even though these connections are stateless, the TCP RST and FIN-ACK flags are honored and the connections are closed when the ACE sees these flags in the received packets. Building Block To Apply Configuration building block to apply to this context. Table 6-1 Virtual Context Configuration Attributes (continued) Field Description 6-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Contexts Related Topics • Information About Virtual Contexts, page 6-2 • Configuring Virtual Contexts, page 6-8 Configuring Virtual Contexts After creating a virtual context, you can configure it. Configuring a virtual context involves configuring a number of attributes, grouped into configuration subsets. The options that appear when you choose Config > Devices > context depend on the following: • Type of ACE device associated with the context: ACE module or ACE appliance. • Role associated with your account, such as Admin, Network-Admin, or SSL-Admin. • Context that you are configuring; an Admin context or a user context. Table 6-2 describes configuration options for Admin contexts for ACE modules and ACE appliances although not all options are available for both types of devices. Table 6-3 identifies the configuration options that are available for each ACE device type. Note You cannot modify a virtual context when its CLI Sync Status is in the Import Failed state. You must synchronize the context before you can make changes to it. You can view CLI Sync Status and synchronize contexts from the Virtual Contexts table (Config > Devices > ACE). 6-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Contexts Table 6-2 Virtual Context Configuration Options Configuration Subset Description Related Topics System The System configuration subset includes the following: • Primary attributes such as building block, resource class, and VLAN options • Syslog attributes that allow you to identify the type and severity of syslog messages that are to be logged, the syslog log host, log messages, and log rate limits • SNMP attributes • Global policy maps for all VLANs on a virtual context • ACE license attributes that allow you to view, install, remove, update, and copy licenses for ACE hardware • Resource classes that allow you to manage virtual context access to individual ACE devices • Checkpoint (snapshot in time) of a known stable running configuration • Back up or restore the configuration and dependencies of an entire ACE or of a particular virtual context Note ACE licenses and resource classes can be configured in an Admin context only. • Configuring Virtual Context Primary Attributes, page 6-14 • Configuring Virtual Context Syslog Settings, page 6-19 • Configuring SNMP for Virtual Contexts, page 6-27 • Applying a Policy Map Globally to All VLAN Interfaces, page 6-35 • Managing ACE Licenses, page 6-36 • Using Resource Classes, page 6-43 • Using the Configuration Checkpoint and Rollback Service, page 6-54 • Performing Device Backup and Restore Functions, page 6-59 • Performing Global Device Backup and Copy Functions, page 6-68 Load Balancing Load-balancing attributes allow you to do the following: • Configure virtual servers, real servers, and server farms for load balancing • Establish the predictor method and return code checking • Implement sticky groups for session persistence • Configure parameter maps to combine related actions for policy maps • Configure NAT so that only one address for the entire network to the outside world is advertised • Configure a secure keepalive-appliance protocol (KAL-AP) associated with a virtual context to enable communication between the ACE and a Global Site Selector (GSS) • Information About Load Balancing, page 7-1 • Configuring Virtual Servers, page 7-2 • Configuring Server Farms, page 8-30 • Configuring Health Monitoring for Real Servers, page 8-51 • Configuring Sticky Groups, page 9-7 • Configuring Parameter Maps, page 10-1 • Configuring VLAN Interface NAT Pools, page 12-26 • Configuring Secure KAL-AP, page 8-77 6-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Contexts SSL Secure Sockets Layer (SSL) configuration options allow you to import and export SSL certificates and keys, set up SSL parameter maps and chain group parameters, generate certificate signing requests for submission to a certificate authority, authenticate peer certificates, and configure certificate revocation lists for use during client authentication. Note You cannot configure all SSL options in a building block. Instead, configure them in an Admin virtual context. • Configuring SSL, page 11-1 • Using SSL Certificates, page 11-5 • Using SSL Keys, page 11-10 • Generating CSRs, page 11-26 • Configuring SSL Parameter Maps, page 11-18 • Configuring SSL Chain Group Parameters, page 11-23 • Configuring SSL Proxy Service, page 11-27 • Configuring SSL Authentication Groups, page 11-31 • Configuring CRLs for Client Authentication, page 11-33 Security Security configuration options enable you to create access control lists, set access control list (ACL) attributes, resequence ACLs, delete ACLs, and configure object groups. • Configuring Security with ACLs, page 6-78 • Creating ACLs, page 6-79 • Configuring Object Groups, page 6-89 Network Network configuration options allow you to configure the following: • VLAN interfaces • Bridged-group virtual interfaces (BVI) • Network Address Translation (NAT) pools for a VLAN interface • Static routes • Dynamic host configuration protocol (DHCP) relay agents • Port channel interfaces • Gigabit Ethernet interfaces • Over 8,000 static network address translation (NAT) configurations • Configuring Virtual Context VLAN Interfaces, page 12-6 • Configuring Virtual Context BVI Interfaces, page 12-19 • Configuring VLAN Interface NAT Pools, page 12-26 • Configuring Virtual Context Static Routes, page 12-28 • Configuring Virtual Context BVI Interfaces, page 12-19 • Configuring Port-Channel Interfaces for the ACE Appliance, page 12-35 • Configuring Gigabit Ethernet Interfaces on the ACE Appliance, page 12-32 • Configuring Static VLANs for Over 8000 Static NAT Configurations, page 12-31 High Availability High availability (HA) attributes allow you to configure two ACE devices for fault-tolerant redundancy and the tracking and detection of failures for timely switchover. Note You can set up high availability in an Admin context only. • Configuring ACE High Availability, page 13-14 • Configuring ACE High Availability Peers, page 13-15 • Configuring ACE High Availability Groups, page 13-17 Table 6-2 Virtual Context Configuration Options (continued) Configuration Subset Description Related Topics 6-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Contexts HA Tracking and Failure Detection HA tracking and failure detection attributes allow you to configure tracking processes that can help ensure reliable fault tolerance. • ACE High Availability Tracking and Failure Detection Overview, page 13-23 • Tracking ACE VLAN Interfaces for High Availability, page 13-24 • Tracking Hosts for High Availability, page 13-25 • Configuring ACE HSRP Groups, page 13-29 Role-Based Access Control Role-based access control (RBAC) attributes allow you to configure RBAC for individual virtual contexts. Note Virtual context RBAC is separate from ANM RBAC. For information about ANM RBAC, see the “How ANM Handles Role-Based Access Control” section on page 18-8. • Configuring Device RBAC Users, page 5-53 • Configuring Device RBAC Roles, page 5-56 • Configuring Device RBAC Domains, page 5-61 Expert Expert attributes allow you to configure traffic policies and configure optimization action lists. • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring an HTTP Optimization Action List, page 15-3 Table 6-3 Configuration Options by Device Type Menu Option ACE Device Type Related Topic ACE Module ACE 4710 Appliance System Primary Attributes X X Configuring Virtual Context Primary Attributes, page 6-14 Syslog X X Configuring Virtual Context Syslog Settings, page 6-19 SNMP X X Configuring SNMP for Virtual Contexts, page 6-27 Global Policies X X Applying a Policy Map Globally to All VLAN Interfaces, page 6-35 Licenses X X Managing ACE Licenses, page 6-36 Application Acceleration and Optimization – X Configuring Global Application Acceleration and Optimization, page 15-9 Resource Classes X X Using Resource Classes, page 6-43 Checkpoints X X Using the Configuration Checkpoint and Rollback Service, page 6-54 Backup/Restore X X Performing Device Backup and Restore Functions, page 6-59 Table 6-2 Virtual Context Configuration Options (continued) Configuration Subset Description Related Topics 6-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Contexts Load Balancing Virtual Servers X X Configuring Virtual Servers, page 7-2 Real Servers X X Configuring Real Servers, page 8-5 Server Farms X X Configuring Server Farms, page 8-30 Health Monitoring X X Configuring Health Monitoring for Real Servers, page 8-51 Stickiness X X Configuring Sticky Groups, page 9-7 HTTP Parameter Maps X X Configuring HTTP Parameter Maps, page 10-9 Connection Parameter Maps X X Configuring Connection Parameter Maps, page 10-3 Optimization Parameter Maps – X Configuring Optimization Parameter Maps, page 10-12 Generic Parameter Maps X X Configuring Generic Parameter Maps, page 10-8 RTSP Parameter Maps X X Configuring RTSP Parameter Maps, page 10-20 SIP Parameter Maps X X Configuring SIP Parameter Maps, page 10-21 Skinny Parameter Maps X X Configuring Skinny Parameter Maps, page 10-23 Secure KAL-AP X X Configuring Secure KAL-AP, page 8-77 SSL Setup Sequence X X SSL Setup Sequence, page 11-4 Certificates X X Using SSL Certificates, page 11-5 Keys X X Using SSL Keys, page 11-10 Parameter Map X X Configuring SSL Parameter Maps, page 11-18 Chain Group Parameters X X Configuring SSL Chain Group Parameters, page 11-23 CSR Parameters X X Configuring SSL CSR Parameters, page 11-24 Proxy Service X X Configuring SSL Proxy Service, page 11-27 Auth Group Parameters X X Configuring SSL Authentication Groups, page 11-31 Certificate Revocation Lists (CRLs) X X Configuring CRLs for Client Authentication, page 11-33 Security ACLs X X Creating ACLs, page 6-79 Object Groups X X Configuring Object Groups, page 6-89 Network Port Channel Interfaces – X Configuring Port-Channel Interfaces for the ACE Appliance, page 12-35 Gigabit Ethernet Interfaces – X Configuring Gigabit Ethernet Interfaces on the ACE Appliance, page 12-32 VLAN Interfaces X X Configuring Virtual Context VLAN Interfaces, page 12-6 BVI Interfaces X X Configuring Virtual Context BVI Interfaces, page 12-19 Table 6-3 Configuration Options by Device Type (continued) Menu Option ACE Device Type Related Topic ACE Module ACE 4710 Appliance 6-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context System Attributes Configuring Virtual Context System Attributes This section shows how to configure the ACE virtual context system attributes, which are as follows: • Virtual context primary attributes—See Configuring Virtual Context Primary Attributes, page 6-14. • Syslog – Configuring Virtual Context Syslog Settings, page 6-19 – Configuring Syslog Log Hosts, page 6-23 – Configuring Syslog Log Messages, page 6-24 – Configuring Syslog Log Rate Limits, page 6-26 • SNMP – Configuring SNMP for Virtual Contexts, page 6-27 – Configuring SNMPv2c Communities, page 6-28 NAT Pools X X Configuring VLAN Interface NAT Pools, page 12-26 Static Routes X X Configuring Virtual Context Static Routes, page 12-28 Global IP DHCP X X Configuring Global IP DHCP, page 12-29 Static NAT Overwrite X – Configuring Static VLANs for Over 8000 Static NAT Configurations, page 12-31 NAT Pools X X Configuring VLAN Interface NAT Pools, page 12-26 High Availability Setup X X Configuring ACE High Availability Peers, page 13-15 HA Tracking And Failure Detection Interfaces X X Tracking ACE VLAN Interfaces for High Availability, page 13-24 Hosts X X Tracking Hosts for High Availability, page 13-25 HSRP Groups X X Configuring ACE HSRP Groups, page 13-29 Role-Based Access Control Users X X Configuring Device RBAC Users, page 5-53 Roles X X Configuring Device RBAC Roles, page 5-56 Domains X X Configuring Device RBAC Domains, page 5-61 Expert Class Maps X X Configuring Virtual Context Class Maps, page 14-6 Policy Maps X X Configuring Virtual Context Policy Maps, page 14-32 Action List X X Configuring an HTTP Header Modify Action List, page 14-85 Configuring an HTTP Optimization Action List, page 15-3 Table 6-3 Configuration Options by Device Type (continued) Menu Option ACE Device Type Related Topic ACE Module ACE 4710 Appliance 6-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context Primary Attributes – Configuring SNMPv3 Users, page 6-29 – Configuring SNMP Trap Destination Hosts, page 6-32 – Configuring SNMP Notification, page 6-33 • Global policy maps for all VLANs on a virtual context—See Applying a Policy Map Globally to All VLAN Interfaces, page 6-35. • ACE licenses—See Managing ACE Licenses, page 6-36. • ACE resource classes—See Using Resource Classes, page 6-43. For ACE appliances, you can also configure global application acceleration and optimization. See the “Configuring Global Application Acceleration and Optimization” section on page 15-9. Configuring Virtual Context Primary Attributes Primary attributes allow you to configure essential information for each virtual context including a name, VLANs, a management IP address, and allowed protocols. After providing this information, you can configure other attributes, such as interfaces, load-balancing, or SSL. For a complete list of the configurable items, see the “Configuring Virtual Contexts” section on page 6-8. Procedure Step 1 Choose Config > Devices > context > System > Primary Attributes. The Primary Attributes configuration window appears. Step 2 In the Primary Attributes configuration window, enter the primary attributes for this virtual context using the information in Table 6-4. Certain attribute fields are read-only for existing contexts. Click Basic Settings, Management Settings, or More Setting to access the additional configuration attributes. By default, ANM hides these groups of configuration attributes. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Table 6-4 Primary Attributes Configuration Attributes Field Description Basic Settings Name Unique name for the virtual context. This field is read-only for existing contexts. Description Brief description of the virtual context. Enter a description as an unquoted text string with a maximum of 240 alphanumeric characters. Resource Class Resource class that this virtual context is to use. Click View to see the details of the selected resource class (Resource, Minimum, and Maximum). 6-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context Primary Attributes Allocated VLANs Number of a VLAN or a range of VLANs that contain traffic for the context to receive. You can specify VLANs in any of the following ways: • For a single VLAN, enter an integer from 2 to 4096. • For multiple, nonsequential VLANs, use comma-separated entries, such as 101, 201, 302. • For a range of VLANs, use the format -, such as 101-150. Note VLANs cannot be modified in an Admin context. This field is read-only if configured for existing contexts. Default Gateway IP for IPv4 IPv4 address of the default gateway. Use a comma-separated list to specify multiple IP addresses, such as192.168.65.1, 192.168.64.2. Default static routes with a netmask and IP address of 0.0.0.0 previously configured on the ACE appear in this field. Default Gateway IP for IPv6 Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. IPv6 address of the default gateway or choose the forward VLAN interface or BVI, as follows: • IPv6 Address field—Enter the address of the gateway router (the next-hop address for this route). Then, use the right arrow to move it to the Selected field. You can enter a maximum of eight addresses including a selected VLAN or BVI through the Outgoing Interfaces setting. Default static routes with a prefix and IP address of ::0 previously configured on the ACE appear in the Selected field. • Outgoing Interfaces—Select either VLAN or BVI used for the link-local address only. And then select the Interface Number for the VLAN or BVI. Enable High Availability Context for use in a high availability (HA) group. Note This field is unavailable if the associated FT interface is not configured or if the ACE peer is not known. See Chapter 13, “Configuring High Availability” for details on ACE HA groups. Management Settings VLAN Id VLAN number that you want to assign to the management interface. Valid values are from 2 to 4094. By default, all devices are assigned to VLAN1, known as the default VLAN. ANM identifies the management class maps and policy maps associated with the selected VLAN ID assigned to the management interface. This field is read-only if configured for existing contexts. VLAN Description Description for the management interface. Enter an unquoted text string that contains a maximum of 240 alphanumeric characters including spaces. Table 6-4 Primary Attributes Configuration Attributes (continued) Field Description 6-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context Primary Attributes Interface Mode Topology that reflects the relationship of the selected ACE virtual context to the real servers in the network: • Routed—The ACE virtual context acts as a router between the client-side network and the server-side network. In this topology, every real server for the application must be routed through the ACE virtual context, either by setting the default gateway on each real server to the virtual context server-side VLAN interface address, or by using a separate router with appropriate routes configured between the ACE virtual context and the real servers. • Bridged—The virtual ACE bridges two VLANs—a client-side VLAN and a real-server VLAN—on the same subnet using a bridged virtual interface (BVI). In this case, the real server routing does not change to accommodate the ACE virtual context. Instead, the virtual ACE transparently handles traffic to and from the real servers. This field is read-only if configured for existing contexts. Management IP IPv4 address that is to be used for remote management of the context. Note ANM considers an interface as a management interface if it has a management policy map associated with the VLAN interface. See the “Configuring Virtual Context VLAN Interfaces” section on page 12-6. Management Netmask Subnet mask to apply to this IP address. Alias IP Address IP address of the alias this interface is associated with. Peer IP Address IP address of the remote peer. Access Permission List of source IP addresses that are allowed on the management interface: • Allow All—Allows all configured client source IP addresses on the management interface as the network traffic matching criteria. • Deny All—Denies all configured client source IP addresses on the management interface as the network traffic matching criteria. • Match—Displays the Match Conditions table, where you specify the match criteria that the ACE is to use for traffic on the management interface. Table 6-4 Primary Attributes Configuration Attributes (continued) Field Description 6-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context Primary Attributes Match Conditions Match Conditions table that appears when you choose Match as the Access Permission selection. To add or modify the protocols allowed on this management VLAN, do the following: 1. Click Add to choose a protocol for the management interface, or choose an existing protocol entry listed in the Match Conditions table and click Edit to modify it. 2. In the Protocol drop-down list, choose a protocol: – HTTP—Specifies the Hypertext Transfer Protocol (HTTP). – HTTPS—Specifies the secure (SSL) Hypertext Transfer Protocol (HTTP) for connectivity with the ANM interface using port 443. – ICMP—Specifies the Internet Control Message Protocol (ICMP) for Internet Protocol version 4 (IPv4) – ICMPv6—Option that appears only for ACE module and ACE appliance software Version A5(1.0) or later. Specifies the Internet Control Message Protocol version 6 (ICMPv6) for Internet Protocol version 6 (IPv6). – KALAP-UDP—Specifies the Keepalive Appliance Protocol over UDP. – SNMP—Specifies the Simple Network Management Protocol (SNMP). Note If SNMP is not selected, ANM cannot poll the context. – SSH—Specifies a Secure Shell (SSH) connection to the ACE. – TELNET—Specifies a Telnet connection to the ACE. – XML-HTTPS—Specifies HTTPS as the transfer protocol for sending and receiving XML documents between the ACE appliance and a Network Management System (NMS) using port 10443. This option is available for ACE appliances only. 3. In the Allowed From field, specify the matching criteria for the client source IP address: – Any—Specifies any client source address for the management traffic classification. – Source Address—Specifies a client source host IP address and subnet mask as the network traffic matching criteria. 4. Click OK to accept the protocol selection (or click Cancel to exit without accepting your entries). Note To remove a protocol from the management VLAN, choose the entry in the Match Conditions table, and click Delete. Enable SNMP Get Check box to add an SNMP Get community string to enable SNMP polling on this context. This field is read-only if configured for existing contexts. SNMP v2c Read-Only Community String Field that appears when you check the Enable SNMP Get check box. Enter the SNMPv2c read-only community string to be used as the SNMP Get community string. This field is read-only if configured for existing contexts. Table 6-4 Primary Attributes Configuration Attributes (continued) Field Description 6-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context Primary Attributes Step 3 Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Virtual Contexts table. Related Topics • Information About Virtual Contexts, page 6-2 • Configuring Virtual Context VLAN Interfaces, page 12-6 • Configuring Virtual Context BVI Interfaces, page 12-19 • Configuring Virtual Context Syslog Settings, page 6-19 • Configuring Traffic Policies, page 14-1 Enable SNMP Trap Check box to add an SNMP community string for ANM to receive traps from this context. This field is read-only if configured for existing contexts. SNMP Community Field that appears when you check the Enable SNMP Trap check box. Enter the SNMPv1 or SNMPv2c read-only community string or the SNMPv3 user name that is to be used as the SNMP trap. This field is read-only if configured for existing contexts. Enable Syslog Notification Check box to either enable or disable syslog logging. More Settings Switch Mode Feature that applies only to the ACE module A2(1.1), ACE appliance A4(1.0), or later releases of either device type. Choose Switch Mode to change the way that the ACE processes TCP connections that are not destined to a VIP or that do not have any policies associated with their traffic. For such traffic, the ACE still creates connection objects but processes the connections as stateless connections, which means that they do not undergo any TCP normalization checks. With this option enabled, the ACE also creates stateless connections for non-SYN TCP packets if they satisfy all other configured requirements. This process ensures that a long-lived persistent connection passes through the ACE successfully (even if it times out) by being reestablished by any incoming packet related to the connection. By default, these stateless connections time out after 2 hours and 15 minutes unless you configure the inactivity timeout otherwise in a parameter map. When a stateless connection times out, the ACE does not send a TCP RST packet but silently closes the connection. Even though these connections are stateless, the TCP RST and FIN-ACK flags are honored and the connections are closed when the ACE sees these flags in the received packets. Shared VLAN Host Id Field that is available in the Admin context only.Specific bank of MAC addresses that the ACE uses. Enter a number from 1 to 16. Be sure to configure different bank numbers for multiple ACEs. Regex Compilation Timeout (minutes) Timeout setting for regular expression (regex) compilation. When you configure a regex and its compilation is longer than the configured timeout, the ACE stops the regex compilation.Enter a value from 1 to 500 minutes. The default timeout is 60 minutes. This option is available only in the Admin context. Building Block To Apply Configuration building block to apply to this context. For information about building blocks, see Chapter 16, “Using Configuration Building Blocks.” Table 6-4 Primary Attributes Configuration Attributes (continued) Field Description 6-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context Syslog Settings Configuring Virtual Context Syslog Settings ANM uses syslog logging to send log messages to a process that logs messages to designated locations asynchronously to the processes that generated the messages. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > System > Syslog. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > System > Syslog. The Syslog configuration window appears. Step 2 In the Syslog configuration window, enter the syslog logging attributes in the displayed fields (see Table 6-6). All fields that require you to choose syslog severity levels use the values in Table 6-5. The severity level that you specify indicates that you want syslog messages at that level and the more severe levels. For example, if you specify Error, syslog displays Error, Critical, Alert, and Emergency messages. Note Setting all syslog levels to Debug during normal operations can degrade overall performance. Table 6-5 Syslog Logging Levels Severity Description 0-Emergency Unusable system 1-Critical Critical condition 2-Warning Warning condition 3-Alert Immediate action required 4-Error Error condition 5-Notification Normal but significant condition 6-Information Informational message only 7-Debug Appears only during debugging 6-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context Syslog Settings Table 6-6 Virtual Context Syslog Configuration Attributes Field Description Action Enable Syslog Option that determines whether syslog logging is enabled or disabled. Check the check box to enable syslog logging or clear the check box to disable syslog logging. Facility Syslog daemon that uses the specified syslog facility to determine how to process the messages it receives. Syslog servers file or direct messages based on the facility number in the message. For more information on the syslog daemon and facility levels, see your syslog daemon documentation. Enter the facility appropriate for your network. Valid entries are 0 (LOCAL0) through 23 (LOCAL7). The default for ACE is 20 (LOCAL4). Buffered Level Option that enables system logging to a local buffer and limits the messages sent to the buffer based on severity. Choose the desired level for sending system log messages to a local buffer. By default, logging to a buffer is disabled on the ACE. Console Level Option that specifies the maximum level for system log messages sent to the console. Choose the desired level for sending system log messages to the console. By default, ACE does not display syslog messages during console sessions. Note Logging to the console can degrade system performance. We recommend that you log messages to the console only when you are testing or debugging problems. Do not use this option when the network is busy, because it can reduce ACE performance. History Level Option that specifies the maximum level for system log messages sent as traps to an SNMP network management station. Choose the desired level for sending system log messages as traps to an SNMP network management station. By default, the ACE does not send traps and inform requests to an SNMP network management station. Monitor Level Option that specifies the maximum level for system log messages sent to a remote connection using Secure Shell (SSH) or Telnet on the ACE. Choose the desired level for sending system log messages to a remote connection using SSH or Telnet on the ACE. By default, logging to a remote connection using SSH or Telnet is disabled on the ACE. Note You must enable remote access on the ACE and establish a remote connection using the SSH or Telnet protocol from a PC for this option to work. 6-21 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context Syslog Settings Persistence Level Option that specifies the maximum level for system log messages sent to Flash memory. Choose the desired level for sending system log messages to Flash memory. By default, logging to Flash memory is disabled on the ACE. Note We recommend that you use a lower severity level, such as 3, because logging at a high rate to Flash memory on the ACE might impact performance. Trap Level Option that specifies the maximum level for system log messages sent to a syslog server. Choose the desired level for sending system log messages to a syslog server. By default, logging to a syslog server is disabled on the ACE. Supervisor Level Option that specifies the maximum level for system log messages sent to the supervisor module on the Catalyst 6500 series chassis. Note This option does not appear for ACE appliances or ACE 4710-type configuration building blocks. Choose the desired level for sending system log messages to the supervisor module on the Catalyst 6500 series chassis. Note We recommend that you use a lower severity level, such as 3, because logging at a high rate to the supervisor module might impact performance of the Catalyst 6500 series chassis. Queue Size Option that specifies the size of the queue for storing syslog messages in the message queue while they await processing. Enter the desired queue size. Valid entries are from 0 to 8192 messages. The default is 80 messages. Enable Timestamp Option that determines whether syslog messages should include the date and time that the message was generated. Choose the check box to enable time stamps on syslog messages or clear the check box to disable time stamps on syslog messages. By default, time stamps are not included on syslog messages. Enable Standby Option that determines whether or not logging is enabled or disabled on the failover standby ACE. When enabled: • This feature causes twice the message traffic on the syslog server. • The standby ACE syslog messages remain synchronized if failover occurs. Choose the check box to enable logging on the failover standby ACE or clear the check box to disable logging on the failover standby ACE. Enable Fastpath Logging Option that determines whether or not connection setup and teardown messages are logged. Check the check box to enable the logging of setup and teardown messages or clear the check box to disable the logging of setup and teardown messages. By default, the ACE does not log connection startup and teardown messages. Table 6-6 Virtual Context Syslog Configuration Attributes (continued) Field Description Action 6-22 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context Syslog Settings Reject New Connection When TCP Queue Full Option that indicates whether or not the ACE rejects new connections when the TCP queue is full. This option is not applicable to ACE 4710 appliances running image A3(x.x). Check the check box to reject new connections when the syslog daemon can no longer reach the TCP syslog server. Clear the check box to disable this feature. This option is enabled by default. Reject New Connection When Rate Limit Reached Option that indicates whether or not the ACE rejects new connections when the syslog message rate is reached. This option is not applicable to ACE 4710 appliances running image A3(x.x). Check the check box to reject new connections when the syslog message rate is reached. Clear the check box to disable this feature. This option is disabled by default. Reject New Connection When Control Plane Buffer Full Option that indicates whether or not the ACE rejects new connections when the syslog daemon buffer is full. This option is not applicable to ACE 4710 appliances running image A3(x.x). Check the check box to reject new connections when the syslog daemon buffer is full. This option is disabled by default. Device Id Type Option that specifies the type of unique device identifier to be included in syslog messages sent to the syslog server. The device identifier does not appear in EMBLEM-formatted messages, SNMP traps, or on the ACE console, management session, or buffer. Choose the type of device identifier to use: • Any String—Text string that you specify to uniquely identify the syslog messages sent from the ACE. If you choose this option, enter the text string to use in the Logging Device Id field. • Context Name—Name of the current virtual context used to uniquely identify the syslog messages sent from the ACE. • Host Name—Hostname of the ACE used to uniquely identify the syslog messages sent from the ACE. • Interface—IP address of the interface used to uniquely identify the syslog messages sent from the ACE. If you choose this option, enter the name of the interface in the Device Interface Name field. • Undefined—No identifier is used. Table 6-6 Virtual Context Syslog Configuration Attributes (continued) Field Description Action 6-23 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context Syslog Settings Step 3 Do the following: • For virtual contexts, click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files, or choose another option to exit the procedure without saving your entries. • For configuration building blocks, click Save to save your entries or Cancel to exit the procedure without saving your entries. Related Topics • Configuring Syslog Log Hosts, page 6-23 • Configuring Syslog Log Messages, page 6-24 • Configuring Syslog Log Rate Limits, page 6-26 Configuring Syslog Log Hosts You can configure syslog log hosts. After configuring basic syslog characteristics (see the “Configuring Virtual Context Syslog Settings” section on page 6-19), you can configure the log host, log messages, and log rate limits. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > System > Syslog. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > System > Syslog. The Syslog configuration window appears. Step 2 In the Syslog configuration window, click the Log Host tab. The Log Host table appears. Device Interface Name Field that appears when the Device ID Type is Interface. This option specifies the interface to be used to uniquely identify syslog messages sent from the ACE. Enter the device interface name to use to uniquely identify syslog messages sent from the ACE. Valid entries are 1 to 64 characters with no spaces. Syslog messages sent to an external server contain the IP address of the interface specified, regardless of which interface that the ACE uses to send the log data to the external server. Logging Device Id Field that appears when the Device ID Type is Any String. This option specifies the text string to use to uniquely identify syslog messages sent from the ACE. Enter a text string that uniquely identifies the syslog messages sent from the ACE. The maximum string length is 64 characters without spaces. Do not use the following characters: & (ampersand), ‘ (single quote), “ (double quote), < (less than), > (greater than), or ? (question mark). Table 6-6 Virtual Context Syslog Configuration Attributes (continued) Field Description Action 6-24 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context Syslog Settings Step 3 In the Log Host table, click Add to add a new log host, or choose an existing log host, and click Edit to modify it. The New Log Host configuration window appears. Step 4 In the New Log Host configuration window IP Address field, enter the IP address of the host to use as the syslog server. Step 5 In the Protocol field, choose TCP or UDP as the protocol to use. Step 6 In the Protocol Port field, enter the number of the port that the syslog server listens to for syslog messages. Valid entries are from 1 to 65535. The default port for TCP is 1470 and for UDP it is 514. Step 7 Check the Default UDP check box, which appears if TCP is selected in the Protocol field (Step 5), to specify that the ACE is to default to UDP if the TCP transport fails to communicate with the syslog server. Uncheck this check box to prevent the ACE from defaulting to UDP if the TCP transport fails. Step 8 In the Format field, choose one of the following: • N/A if you do not want to use EMBLEM-format logging. • Emblem to enable EMBLEM-format logging for each syslog server. If you use Cisco Resource Manager Essentials (RME) software to collect and process syslog messages on your network, enable EMBLEM-format logging so that RME can handle them. Similarly, UDP needs to be enabled because the Cisco Resource Manager Essentials (RME) syslog analyzer supports only UDP syslog messages. Step 9 Do one of the following: • Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • OK to save your entry. This option appears for configuration building blocks. • Cancel to exit the procedure without saving your entries and to return to the Log Host table. • Next to configure another syslog host. Related Topics • Configuring Virtual Context Syslog Settings, page 6-19 • Configuring Syslog Log Messages, page 6-24 • Configuring Syslog Log Rate Limits, page 6-26 Configuring Syslog Log Messages You can configure syslog log messages. After configuring basic syslog characteristics (see the “Configuring Virtual Context Syslog Settings” section on page 6-19), you can configure the log host, log messages, and log rate limits. Procedure Step 1 Choose the item to configure: 6-25 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context Syslog Settings • To configure a virtual context, choose Config > Devices > context > System > Syslog. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > System > Syslog. The Syslog configuration window appears. Step 2 In the Syslog configuration window, click the Log Message tab. The Log Message table appears. Step 3 In the Log Message table, click Add to add a new entry to this table, or choose an existing entry, and click Edit to modify it. The Log Message configuration window appears. Step 4 In the Message Id field, choose the system log message ID of the syslog messages that are to be sent to the syslog server or that are not to be sent to the syslog server. Step 5 Check the Enable State check box to enable logging for the specified message ID or uncheck it to disable logging for the specified message ID. If you check the Enable State check box, the Log Level field appears. Step 6 In the Log Level field, choose the desired level of syslog messages to be sent to the syslog server, using the levels identified in Table 6-5. Step 7 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click OK to save your entry. This option appears for configuration building blocks. • Click Cancel to exit the procedure without saving your entries and to return to the Log Message table. • Click Next to deploy your entries and to configure additional syslog message entries for this virtual context. Related Topics • Configuring Virtual Contexts, page 6-8 • Configuring Virtual Context Syslog Settings, page 6-19 • Configuring Syslog Log Hosts, page 6-23 • Configuring Syslog Log Rate Limits, page 6-26 6-26 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context Syslog Settings Configuring Syslog Log Rate Limits You can configure syslog log rate limits after configuring basic syslog characteristics (see the “Configuring Virtual Context Syslog Settings” section on page 6-19). Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > System > Syslog. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > System > Syslog. The Syslog configuration window appears. Step 2 Click the Log Rate Limit tab. The Log Rate Limit table appears. Step 3 In the Log Rate Limit table, click Add to add a new entry to this table, or choose an existing entry, and click Edit to modify it. The Log Rate Limit configuration window appears. Step 4 In the Type field of the Log Rate Limit configuration window, choose the method by which syslog messages are to be limited: • Level—Syslog messages are limited by syslog level. In the Level field, choose the level of syslog messages to be sent to the syslog server, using the levels identified in Table 6-5. • Message—Syslog messages are limited by message identification number. In the Message Id field, choose the syslog message ID for those messages you want to suppress reporting. Step 5 Check the Unlimited check box to apply no limits to system message logging or uncheck it to apply limits to system message logging. If you uncheck the Unlimited check box, the Rate and Time Interval fields appear. Step 6 (Optional) If you uncheck the Unlimited check box, specify the limits to apply to system message logging as follows: a. In the Rate field, enter the number at which the system log messages are to be limited. When this limit is reached, the ACE rejects new syslog messages. Valid entries are from 0 to 2147483647. b. In the Time Interval (Seconds) field, enter the length of time (in seconds) over which the system message logs are to be limited. For example, if you enter 42 in the Rate field and 60 in the Time Interval field, the ACE rejects any syslog messages that arrive after the first 42 messages in that 60-second period. Valid entries are from 0 to 2147483647 seconds. Step 7 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click OK to save your entry. This option appears for configuration building blocks. • Click Cancel to exit the procedure without saving your entries and to return to the Log Rate Limit table. • Click Next to deploy your entries and to add another entry to the Log Rate Limit table. 6-27 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring SNMP for Virtual Contexts Related Topics • Configuring Virtual Contexts, page 6-8 • Configuring Virtual Context Syslog Settings, page 6-19 • Configuring Syslog Log Hosts, page 6-23 • Configuring Syslog Log Messages, page 6-24 Configuring SNMP for Virtual Contexts This section describes how to configure the SNMP attributes for a virtual context and contains the following topics: • Configuring Basic SNMP Attributes, page 6-27 • Configuring SNMPv2c Communities, page 6-28 • Configuring SNMPv3 Users, page 6-29 • Configuring SNMP Trap Destination Hosts, page 6-32 • Configuring SNMP Notification, page 6-33 Configuring Basic SNMP Attributes You can configure the basic SNMP attributes for use with a virtual context. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > System > SNMP. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > System > SNMP. The SNMP configuration window appears. Step 2 In the SNMP configuration window, configure the basic SNMP attributes using the information in Table 6-7. Table 6-7 SNMP Attributes Field Description Contact Information Contact information for the SNMP server as a text string with a maximum of 240 characters including spaces. In addition to a name, you might want to include a phone number or email address. If spaces are included, add quotation marks at the beginning and end of the entry. Location Physical location of the system as a text string with a maximum of 240 characters including spaces. If spaces are included, add quotation marks at the beginning and end of the entry. Unmask Community Checkbox that allows you to unmask the snmpCommunityName and snmpCommunitySecurityName OIDs of the SNMP-COMMUNITY-MIB. By default, they are masked (check box is unchecked). Check the checkbox to unmask them. 6-28 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring SNMP for Virtual Contexts Step 3 Do one of the following: • For virtual contexts, click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files, or choose another configuration option to exit the procedure without saving your entries. • For configuration building blocks, click OK to save your entries or choose another configuration option to exit the procedure without saving your entries. Step 4 If you chose Deploy Now in Step 3, configure the SNMP device access credentials as described in the “Configuring Device Access Credentials” section on page 5-29. Related Topics • Configuring Virtual Contexts, page 6-8 • Configuring SNMPv2c Communities, page 6-28 • Configuring SNMPv3 Users, page 6-29 • Configuring SNMP Trap Destination Hosts, page 6-32 • Configuring SNMP Notification, page 6-33 Configuring SNMPv2c Communities You can configure SNMP communities for a virtual context or configuration building block after configuring basic SNMP information for a virtual context (see the “Configuring Basic SNMP Attributes” section on page 6-27). Note All SNMP communities in ANM are read-only communities and all communities belong to the group network monitors. Assumption You have configured at least one SNMP contact (see the “Configuring Basic SNMP Attributes” section on page 6-27). Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > System > SNMP. Trap Source Interface VLAN that identifies the interface from which SNMP traps originate. IETF Trap Check box to enable the ACE to send linkUp and linkDown traps with the IETF standard IF-MIB (RFC 2863) variable bindings, consisting of ifIndex, ifAdminStatus, and ifOperStatus. Uncheck the check box to not allow the ACE to send linkUp and linkDown traps with the IETF standard IF-MIB (RFC 2863) variable bindings. Instead, the ACE sends Cisco var-binds by default. Table 6-7 SNMP Attributes (continued) Field Description 6-29 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring SNMP for Virtual Contexts • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > System > SNMP. The SNMP configuration window appears. Step 2 In the SNMP configuration window, click the SNMPv2c Configuration tab. The SNMPv2c Configuration table appears. Step 3 From the SNMPv2c Configuration table, configure a read-only community string as follows: • To make “public” the read-only community string, click the associated radio button and click Deploy Now. By default, this radio button is selected. • To create a read-only community string, do the following: a. In the SNMPv2c Configuration table, click Add to add an SNMPv2c read-only community string. The New SNMPv2c Configuration window appears. Note You cannot modify an existing SNMPv2c community string. Instead, delete the existing SNMP v2c community string, and then add a new one. b. In the Read-Only Community field of the New SNMPv2c Configuration window, enter the SNMPv2c read-only community name. Valid entries are unquoted text strings with no spaces and a maximum of 32 characters. c. Do one of the following: – Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. – Click OK to save your entry. This option appears for configuration building blocks. – Click Cancel to exit this procedure without saving your entry and to return to the SNMP v2c Community String table. – Click Next to deploy your entry and to configure another SNMP community string. The window refreshes and you can enter another community string. Related Topics • Configuring Virtual Contexts, page 6-8 • Configuring Basic SNMP Attributes, page 6-27 • Configuring SNMPv3 Users, page 6-29 • Configuring SNMP Trap Destination Hosts, page 6-32 • Configuring SNMP Notification, page 6-33 Configuring SNMPv3 Users You can configure SNMP version 3 users for a virtual context or configuration building block after configuring basic SNMP information for a virtual context (see the “Configuring Basic SNMP Attributes” section on page 6-27). 6-30 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring SNMP for Virtual Contexts Assumption You have configured at least one SNMP contact (see the “Configuring Basic SNMP Attributes” section on page 6-27). Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > System > SNMP. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > System > SNMP. The SNMP configuration window appears. Step 2 In the SNMP configuration window, click the SNMPv3 Configuration tab. The SNMP v3 Configuration table appears. Step 3 In the SNMP v3 Configuration table, click Add to add users, or choose an existing entry in the SNMPv3 Configuration table, and click Edit to modify it. The SNMP v3 Configuration window appears. Step 4 In the SNMP v3 Configuration window, enter SNMP user attributes using the information in Table 6-8. Table 6-8 SNMP User Configuration Attributes Field Description User Name SNMP username. Valid entries are unquoted text strings with no spaces and a maximum of 24 characters. Authentication Algorithm Authentication algorithm to be used for this user: • N/A—No authentication algorithm is used. • Message Digest 5 (MD5)—Message Digest 5 is used as the authentication mechanism. • Secure Hash Algorithm (SHA)—Secure Hash Algorithm is used as the authentication mechanism. Authentication Password Field that appears if you choose an authentication algorithm. Enter the authentication password for this user. Valid entries are unquoted text strings with no spaces. This password can have a minimum of 8 characters. If use of a localized key is disabled or N/A, you can enter a maximum of 64 characters. If use of a localized key is enabled, you can enter a maximum of 130 characters. The ACE automatically updates the password for the CLI user with the SNMP authentication password. Confirm Field that appears if you choose an authentication algorithm. Reenter the authentication password. Localized Field that appears if you choose an authentication algorithm. Specify whether or not the password is in localized key format for security encryption: • N/A—This option is not configured. • False—The password is not in localized key format for encryption. • True—The password is in localized key format for encryption. 6-31 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring SNMP for Virtual Contexts Step 5 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click OK to save your entries. This option appears for configuration building blocks. • Click Cancel to exit this procedure without saving your entries and to return to the SNMP v3 Configuration table. • Click Next to deploy your entries and to add another entry to the SNMP v3 Configuration table. The window refreshes and you can enter another SNMP v3 user. Related Topics • Configuring Virtual Contexts, page 6-8 • Configuring Basic SNMP Attributes, page 6-27 • Configuring SNMPv2c Communities, page 6-28 • Configuring SNMP Trap Destination Hosts, page 6-32 • Configuring SNMP Notification, page 6-33 Privacy Field that appears if you choose an authentication algorithm. Specify whether or not encryption attributes are to be configured for this user: • N/A—This option is not configured. • False—Encryption parameters are not to be configured for this user. • True—Encryption parameters are to be configured for this user. AES 128 Field that appears if you set Privacy to True. Indicate whether the 128-byte Advanced Encryption standard (AES) algorithm is to be used for privacy. AES is a symmetric cipher algorithm and is one of the privacy protocols for SNMP message encryption. Choices are as follows: • N/A—This option is not configured. • False—AES 128 is not used for privacy. • True—AES 128 is used for privacy. Privacy Password Field that appears if you set Privacy to True. Enter the user encryption password. This password can have a minimum of 8 characters. If the passphrases are specified in clear text, you can enter a maximum of 64 characters. If use of a localized key is enabled, you can enter a maximum of 130 characters. Spaces are not allowed. Confirm Field that appears if you set Privacy to True. Reenter the privacy password. Table 6-8 SNMP User Configuration Attributes (continued) Field Description 6-32 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring SNMP for Virtual Contexts Configuring SNMP Trap Destination Hosts You can configure SNMP trap destination hosts for a virtual context after configuring basic SNMP information for a virtual context (see the “Configuring Basic SNMP Attributes” section on page 6-27). To receive SNMP notifications you must configure the following attributes: • At least one SNMP trap destination host. • At least one type of notification (see the “Configuring SNMP Notification” section on page 6-33). Assumption You have configured at least one SNMP contact (see the “Configuring Basic SNMP Attributes” section on page 6-27). Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > System > SNMP. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > System > SNMP. The SNMP configuration window appears. Step 2 In the SNMP configuration window, click the Trap Destination Host tab. The Trap Destination Host table appears. Step 3 In the Trap Destination Host table, click Add to add a host, or choose an existing entry in the table, and Edit to modify it. The Trap Destination Host configuration window appears. Step 4 In the IP Address field of the Trap Destination Host configuration window, enter the IP address of the server that is to receive SNMP notifications. Enter the address in dotted-decimal format, such as 192.168.11.1. Step 5 In the Port field, enter the port to use. The default port is 162. Step 6 In the Version field, choose the version of SNMP used to send traps: • V1—SNMPv1 is used to send traps. This option is not available for use with SNMP inform requests. • V2c—SNMPv2c is used to send traps. • V3—SNMPv3 is used to send traps. This version is the most secure model because it allows packet encryption. Step 7 In the Community field, enter the SNMP community string or username to be sent with the notification operation. Valid entries are unquoted text strings with no spaces and a maximum of 32 characters. Step 8 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click OK to save your entries. This option appears for configuration building blocks. 6-33 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring SNMP for Virtual Contexts • Click Cancel to exit this procedure without saving your entries and to return to the Trap Destination Host table. • Click Next to deploy your entries and to add another entry to the Trap Destination Host table. The window refreshes and you can add another trap destination host. Related Topics • Configuring Virtual Contexts, page 6-8 • Configuring Basic SNMP Attributes, page 6-27 • Configuring SNMPv2c Communities, page 6-28 • Configuring SNMPv3 Users, page 6-29 • Configuring SNMP Notification, page 6-33 Configuring SNMP Notification You can configure SNMP notification for a virtual context after configuring basic SNMP information for a virtual context (see the “Configuring Basic SNMP Attributes” section on page 6-27). To receive SNMP notifications you must configure the following attributes: • At least one SNMP trap destination host (see the “Configuring SNMP Trap Destination Hosts” section on page 6-32). • At least one type of notification. Assumptions • You have configured at least one SNMP contact (see the “Configuring Basic SNMP Attributes” section on page 6-27). • At least one SNMP server host has been configured (see the “Configuring SNMP Trap Destination Hosts” section on page 6-32). Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > System > SNMP. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > System > SNMP. The SNMP configuration window appears. Step 2 In the SNMP configuration window, click the SNMP Notification tab. The SNMP Notification table appears. Step 3 In the SNMP Notification table, click Add to add a new entry, or choose an existing entry in the table, and click Edit to modify it. The SNMP Notification configuration window appears. 6-34 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring SNMP for Virtual Contexts Step 4 In the Options field of the SNMP Notification configuration window, choose the type of notifications to be sent to the SNMP host. Some options are available only in the Admin context. Note When configuring SNMP notification for ACE appliances, we recommend that you choose the more specific options. For example, choose Slb real or Slb vserver instead of Slb to ensure that the correct commands are issued on the ACE appliance. Choices are as follows: • License—SNMP license notifications are to be sent. This option is available only in the Admin context. • SLB—Server load-balancing notifications are to be sent. • SLB Real Server—Notifications of real server state changes are to sent. • SLB Virtual Server—Notifications of virtual server state changes are to be sent. • SNMP—SNMP notifications are to be sent. • SNMP Authentication—Notifications of incorrect community strings in SNMP requests are to be sent. • SNMP Cold-Start—SNMP agent restart notifications are to be sent after a cold restart (full power cycle) of the ACE. This option is available only in the Admin context. • SNMP Link-Down—Notifications are to be sent when a VLAN interface is down. • SNMP Link-Up—Notifications are to be sent when a VLAN interface is up. • Syslog—Error message notifications (Cisco Syslog MIB) are to be sent. • Virtual Context—Virtual context notifications are to be sent. Step 5 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click OK to save your entries. This option appears for configuration building blocks. • Click Cancel to exit this procedure without saving your selection and to return to the SNMP Notification table. • Click Next to deploy your entries and to add another entry to the SNMP Notification table. The window refreshes and you can choose another SNMP notification option. Related Topics • Configuring Virtual Contexts, page 6-8 • Configuring Basic SNMP Attributes, page 6-27 • Configuring SNMPv2c Communities, page 6-28 • Configuring SNMPv3 Users, page 6-29 • Configuring SNMP Trap Destination Hosts, page 6-32 6-35 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Applying a Policy Map Globally to All VLAN Interfaces Applying a Policy Map Globally to All VLAN Interfaces You can apply a policy map globally to all VLAN interfaces in a selected context or configuration building block. To apply a policy map to a specific context VLAN interface only, see the Input Policies attribute in the “Configuring Virtual Context VLAN Interfaces” section on page 12-6. Note You cannot modify a policy map that is currently applied to an interface. To modify an applied policy map, you must first remove (delete) it from the interface, make the required modifications, and then apply it to the interface again. Assumption A Layer 3/Layer 4 or Management policy map has been configured for the selected context or building block. For more information, see the “Configuring Virtual Context Policy Maps” section on page 14-32. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > System > Global Policies. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > System > Global Policies. The Global Policies table appears. Step 2 In the Global Policies table, click Add to add a new global policy. The New Global Policy window appears. Step 3 In the Policy Map field of the New Global Policy window, choose an existing policy map that you want to apply to all VLANs in this context. Note The Direction field displays the value “input” and cannot be modified. Step 4 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click OK to save your entries. This option appears for configuration building blocks. • Click Cancel to exit the procedure without saving your entries and to return to the Global Policies table. • Click Next to deploy your entries and to configure another global policy. Related Topics • Information About Virtual Contexts, page 6-2 • Configuring Virtual Context Primary Attributes, page 6-14 • Configuring Virtual Context VLAN Interfaces, page 12-6 6-36 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing ACE Licenses • Configuring Virtual Context Syslog Settings, page 6-19 • Configuring Traffic Policies, page 14-1 Managing ACE Licenses Note This functionality is available for only Admin contexts. Cisco offers licenses for ACE modules and appliances that allow you to increase the number of default contexts, bandwidth, and SSL transactions per second (TPS). For more information about these licenses, see the Cisco Application Control Engine documentation on Cisco.com. If you install ACE licenses to increase the number of virtual contexts that you can create and manage on a device, you need to ensure that the installed ANM licenses support the increased number of virtual contexts. For example, if you install an upgrade ACE device license that allows you to create and manage 20 virtual contexts on the device, you must purchase and install the appropriate ANM license before you can manage the additional contexts using ANM. For more information about using and managing ANM licenses, see the “Using ANM License Manager to Manage ANM Server or Demo Licenses” section on page 18-54. You can view, install, remove, or update ACE device licenses using ANM. This section includes the following topics: • Viewing ACE Licenses, page 6-36 • Installing ACE Licenses, page 6-37 • Uninstalling ACE Licenses, page 6-39 • Updating ACE Licenses, page 6-40 • Displaying the File Contents of a License, page 6-42 Viewing ACE Licenses Note This functionality is available for only Admin contexts. You can view the licenses that are currently installed on an ACE. Procedure Step 1 Choose Config > Devices. The device tree appears. Step 2 In the device tree, choose the Admin context with the ACE licenses that you want to view, and click System > Licenses. The following license tables appear: • License Status Table—Provides a summary of the license status for the ACE, including: – SSL transactions per second 6-37 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing ACE Licenses – Number of supported virtual contexts – ACE bandwidth in gigabits per second For ACE appliances (all versions) and ACE module version A4(1.0) and later, it also displays the following: – Compression performance in megabits or gigabits per second – Web optimization in the number of connections per second • Installed License Files Table—Lists all installed licenses with their filenames, vendors, and expiration dates. Related Topics • Managing ACE Licenses, page 6-36 • Installing ACE Licenses, page 6-37 • Uninstalling ACE Licenses, page 6-39 • Updating ACE Licenses, page 6-40 • Displaying the File Contents of a License, page 6-42 Installing ACE Licenses Note This functionality is available for only Admin contexts. You can install an ACE license on the device after you copy the license from a remote network server to the disk0: file system in Flash memory on the ACE. You can use the ANM to perform both processes from a single dialog box. If you previously copied the license to disk0: on the ACE by using the copy disk0: CLI command, you can use this dialog box to install the new license or upgrade license on your ACE. Assumption This topic assumes the following: • You have received the proper software license key for the ACE. • ACE licenses are available on a remote server for importing to the ACE, or you have received the software license key and have copied the license file to the disk0: filesystem on the ACE using the copy disk0: CLI command. See either the Cisco Application Control Engine Module Administration Guide or Cisco 4700 Series Application Control Engine Appliance Administration Guide for details. Procedure Step 1 Choose Config > Devices. The device tree appears. Step 2 In the device tree, choose the Admin context that you want to import and install a license for, and click System > Licenses. The following license tables appear: 6-38 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing ACE Licenses • License Status Table—Provides a summary of the license status for the ACE, including: – SSL transactions per second – Number of supported virtual contexts – ACE bandwidth in gigabits per second For ACE appliances (all versions) and ACE module version A4(1.0) and later, it also displays the following: – Compression performance in megabits or gigabits per second – Web optimization in the number of connections per second • Installed License Files Table—Lists all installed licenses with their filenames, vendors, and expiration dates. Step 3 Click Install. The Install an ACE License dialog box appears. Step 4 (Optional) If the license currently exists on the ACE disk0: file system in Flash memory, do the following: a. In the Select an Option to Locate a License File section of the dialog box, click the Select a license file on the ACE option. b. In the Select a License File on the Device (disk0) section of the dialog box, from the drop-down list, choose the name of the license file. c. Go to Step 10. Step 5 (Optional) If the license must be copied to the disk0: file system in Flash memory, in the Select an Option to Locate a License File section of the dialog box, click the Import a license file from remote system option. Go to Step 6. Step 6 In the Protocol To Connect To Remote System field, choose the protocol to be used to import the license file from the remote server to the ACE as follows: • If you choose FTP, the User Name and Password fields appear. Go to Step 7. • If you choose SFTP, the User Name and Password fields appear. Go to Step 7. • If you choose TFTP, go to Step 8. Step 7 (Optional) If you choose FTP or SFTP, do the following: a. In the User Name field, enter the username of the account on the network server. b. In the Password field, enter the password for the user account. Step 8 In the Remote System IP Address field, enter the host IP address of the remote server. For example, your entry might be 192.168.11.2. Step 9 In the License Path In Remote System field, enter the host path and filename of the license file on the remote server in the format /path/filename where: • path represents the directory path of the license file on the remote server. • filename represents the filename of the license file on the remote server. For example, your entry might resemble /usr/bin/ACE-VIRT-020.lic. Step 10 Do one of the following: • Click Install to accept your entries and to install the license file. 6-39 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing ACE Licenses • Click Cancel to exit this procedure without installing the license file and to return to the Licenses table. Step 11 (Optional) After installing an ACE license, we recommend that you manually synchronize the ACE Admin context with the CLI to ensure that ANM accurately displays the monitored resource usage information (Monitor > Devices > ACE > Resource Usage > Connections). For information about synchronizing the Admin context, see the “Synchronizing Virtual Context Configurations” section on page 6-105. Related Topics • Managing ACE Licenses, page 6-36 • Viewing ACE Licenses, page 6-36 • Uninstalling ACE Licenses, page 6-39 • Updating ACE Licenses, page 6-40 • Displaying the File Contents of a License, page 6-42 Uninstalling ACE Licenses Note This functionality is available for Admin contexts only. You can remove ACE licenses. Caution Removing licenses can affect the ACE bandwidth or performance. For detailed information on the effect of license removal on the ACE, see the Cisco Application Control Engine documentation on Cisco.com. Procedure Step 1 Choose Config > Devices. The device tree appears. Step 2 In the device tree, choose the Admin context with the license that you want to remove, and click System > Licenses. Step 3 In the Installed License Files table, choose the license to be removed. Step 4 Click Uninstall. A dialog box appears, asking you to confirm the license removal process. Note Before continuing, confirm that you have selected the correct license to be removed. When you click OK in the confirmation window, you cannot stop the removal process. Note Removing licenses can affect the number of contexts, ACE bandwidth, or SSL TPS (transactions per second). Be sure you understand the effect on your environment before removing the license. 6-40 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing ACE Licenses Step 5 Click OK to confirm the removal or Cancel to stop the removal process. If you click OK, a status window appears with the status of license removal. When the license has been removed, the License table refreshes without the deleted license. Step 6 (Optional) After uninstalling an ACE license, we recommend that you manually synchronize the ACE Admin context with the CLI to ensure that ANM accurately displays the monitored resource usage information (Monitor > Devices > ACE > Resource Usage > Connections). For information about synchronizing the Admin context, see the “Synchronizing Virtual Context Configurations” section on page 6-105. Related Topics • Managing ACE Licenses, page 6-36 • Installing ACE Licenses, page 6-37 • Viewing ACE Licenses, page 6-36 • Updating ACE Licenses, page 6-40 • Displaying the File Contents of a License, page 6-42 Updating ACE Licenses Note This functionality is available for Admin contexts only. You can convert demonstration licenses to permanent licenses and to upgrade permanent licenses to increase the number of virtual contexts. Assumption This topic assumes the following: • You have received the updated software license key for the ACE. • ACE licenses are available on a remote server for importing to the ACE, or you have received the updated software license key and have copied the license file to the disk0: filesystem on the ACE using the copy disk0: CLI command. See either the Cisco Application Control Engine Module Administration Guide or Cisco 4700 Series Application Control Engine Appliance Administration Guide for details. Procedure Step 1 Choose Config > Devices. The device tree appears. Step 2 In the device tree, choose the Admin context with the license that you want to update, and click System > Licenses. The following license tables appear: • License Status Table—Provides a summary of the license status for the ACE, including: – SSL transactions per second 6-41 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing ACE Licenses – Number of supported virtual contexts – ACE bandwidth in gigabits per second For ACE appliances (all versions) and ACE module version A4(1.0) and later, it also displays the following: – Compression performance in megabits or gigabits per second – Web optimization in the number of connections per second • Installed License Files Table—Lists all installed licenses with their filenames, vendors, and expiration dates. Step 3 Choose the license to be updated, and click Update. The Update License dialog box appears. Step 4 (Optional) If the update license currently exists on the ACE disk0: file system in Flash memory, do the following: a. In the Select an Option to Locate a License File section of the dialog box, click the Select a license file on the ACE option. b. In the Select a License File on the Device (disk0) section of the dialog box, choose the name of the update license file from the drop-down list. c. Go to Step 10. Step 5 (Optional) If the update license must be copied to the disk0: file system in Flash memory, in the Select an Option to Locate a License File section of the dialog box, click the Import a license file from remote system option. Go to Step 6. Step 6 In the Protocol To Connect To Remote System field, choose the protocol to be used to import the update license file from the remote server to the ACE as follows: • If you choose FTP, the User Name and Password fields appear. Go to Step 7. • If you choose SFTP, the User Name and Password fields appear. Go to Step 7. • If you choose TFTP, go to Step 8. Step 7 (Optional) If you choose FTP or SFTP, do the following: a. In the User Name field, enter the username of the account on the network server. b. In the Password field, enter the password for the user account. Step 8 In the Remote System IP Address field, enter the host IP address of the remote server. For example, your entry might be 192.168.11.2. Step 9 In the Licence Path In Remote System field, enter the host path and filename of the license file on the remote server in the format /path/filename where: • path represents the directory path of the license file on the remote server. • filename represents the filename of the license file on the remote server. For example, your entry might be /usr/bin/ACE-VIRT-020.lic. Step 10 Do one of the following: • Click Update to update the license and to return to the License table. The License table displays the updated information. • Click Cancel to exit this procedure without updating the license and to return to the License table. 6-42 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing ACE Licenses Step 11 (Optional) After updating an ACE license, recommend that you manually synchronize the ACE Admin context with the CLI to ensure that ANM accurately displays the monitored resource usage information (Monitor > Devices > ACE > Resource Usage > Connections). For information about synchronizing the Admin context, see the “Synchronizing Virtual Context Configurations” section on page 6-105. Related Topics • Managing ACE Licenses, page 6-36 • Installing ACE Licenses, page 6-37 • Viewing ACE Licenses, page 6-36 • Uninstalling ACE Licenses, page 6-39 • Displaying the File Contents of a License, page 6-42 Displaying the File Contents of a License Note This functionality is available for only Admin contexts. You can display file content information about ACE licenses. Procedure Step 1 Choose Config > Devices. The device tree appears. Step 2 Choose the Admin context with the license information that you want to view, and choose System > Licenses. The following two license tables appear: • License Status Table—Provides a summary of the license status for the ACE, including the supported features and capabilities. • Installed License Files Table—Lists all installed licenses with their filenames, vendors, and expiration dates. Step 3 Choose the installed license file with the information that you want to display, and click View. ANM displays the output of the show license file CLI command. For example: SERVER this_host ANY VENDOR cisco INCREMENT ACE-AP-C-2000-LIC cisco 1.0 permanent 1 \ NOTICE="lic.conf0 \ dummyPak" SIGN=BBBDC344EAE8 Step 4 Click Close when you finish viewing the license file information. 6-43 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using Resource Classes Related Topics • Managing ACE Licenses, page 6-36 • Installing ACE Licenses, page 6-37 • Viewing ACE Licenses, page 6-36 • Uninstalling ACE Licenses, page 6-39 Using Resource Classes Resource classes are the means by which you manage virtual context access to ACE resources, such as concurrent connections or bandwidth rate. ACE devices are preconfigured with a default resource class that is applied to the Admin context and any user context upon creation. The default resource class is configured to allow a context to operate within a range that can vary from no resource access (0%) to complete resource access (100%). When you use the default resource class with multiple contexts, you run the risk of oversubscribing ACE resources. This means that the ACE permits all contexts to have full access to all resources on a first-come, first-served basis. When a resource is utilized to its maximum limit, the ACE denies additional requests made by any context for that resource. To avoid oversubscribing resources and to help guarantee access to a resource by any context, you can create customized resource classes that you associate with one or more contexts. A context becomes a member of the resource class when you make the association. Creating a resource class allows you to set limits on the minimum and maximum amounts of each ACE resource that a member context is entitled to use. You define the minimum and maximum values as a percentage of the whole. For example, you can create a resource class that allows its member contexts access to no less that 25% of the total number of SSL connections that the ACE supports. You can limit and manage the allocation of the following ACE resources: • ACL memory • Buffers for syslog messages and TCP out-of-order (OOO) segments • Concurrent connections (through-the-ACE traffic) • Management connections (to-the-ACE traffic) • Proxy connections • Set resource limit as a rate (number per second) • Regular expression (regexp) memory • SSL connections • Sticky entries • Static or dynamic network address translations (Xlates) When you discover ACE devices, the ANM detects the resource class information and imports it with other device information. If an ACE is not configured for a resource class, it inherits the resource class configuration of the virtual context it is associated with. If an ACE does have a resource class configuration but it differs from one configured in the ANM, the discrepancy is logged as an anomaly but otherwise has no impact on the import process or the ACE. Table 6-9 on page 6-45 identifies and defines the resources that you can establish for resource classes. Related Topics • Global and Local Resource Classes, page 6-44 6-44 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using Resource Classes • Resource Allocation Constraints, page 6-44 • Using Global Resource Classes, page 6-46 • Displaying Local Resource Class Use on Virtual Contexts, page 6-54 Global and Local Resource Classes ANM provides two levels of resource classes for ACE devices that operate independently of each other: • Local or device-specific resource classes • Global resource classes Local resource classes are initially imported from the ACE during the import process and appear in the ANM interface in the Admin virtual context where they can be managed, modified, or deleted by an Admin user. An Admin user can also create new, local resources classes by using ANM. Choose Config > Devices > Admin_context > System > Resource Classes to add, view, or modify local resource classes. Global resource classes are managed separately from local resource classes and require manual deployment to a specific ACE using the Admin virtual context before they take effect. If you deploy a global resource class to an ACE that does not have a resource class with the same name, ANM creates a new local resource class with the same name and properties as the global resource class. If you deploy a global resource class to an ACE that already has a resource class with the same name, ANM replaces the properties of the local resource class with the properties from the global resource class. Choose Config > Global > All Resource Classes to add, view, modify, audit, or delete global resource classes. Related Topics • Using Resource Classes, page 6-43 • Resource Allocation Constraints, page 6-44 • Using Global Resource Classes, page 6-46 • Using Local Resource Classes, page 6-51 • Auditing Resource Classes, page 6-49 Resource Allocation Constraints The following resources are critical for maintaining connectivity to the Admin context: • Rate Bandwidth • Rate Management Traffic • Rate SSL Connections • Rate Connections • Management Connections • Concurrent Connections Caution If you allocate 100 percent of these resources to a resource class and then apply the resource class to virtual contexts, connectivity to the Admin context can be lost. 6-45 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using Resource Classes We recommend that you create a resource class specifically for the Admin context and apply it to the context so that you can maintain IP connectivity. Table 6-9 Resource Class Attributes Resource Definition Default Default percentage used for any resource parameter not explicitly set. Acceleration Connections Option that is available ACE appliances only. Percentage of application acceleration connections. ACL Memory Percentage of memory allocated for ACLs. Concurrent Connections Percentage of simultaneous connections. Note If you consume all Concurrent Connections by allocating 100 percent to virtual contexts, IP connectivity to the Admin context can be lost. HTTP Compression Percentage of compression for HTTP data. Note This option appears for ACE appliances (all versions) and ACE module version A4(1.0) and later only. Management Connections Percentage of management connections. Note If you consume all Management Connections by allocating 100 percent to virtual contexts, IP connectivity to the Admin context can be lost. Proxy Connections Percentage of proxy connections. Regular Expression Percentage of regular expression memory. Sticky Percentage of entries in the sticky table. Note (Pre ACE version A4(1.0) module or appliance only) You must configure a minimum value for sticky to allocate resources for sticky entries; the sticky software receives no resources under the unlimited setting. Xlates Percentage of network and port address translations entries. Buffer Syslog Percentage of the syslog buffer. Rate Inspect Connection Percentage of application protocol inspection connections. Rate Bandwidth Percentage of context throughput. This attribute limits the total ACE throughput in bytes per second for one or more contexts. Note If you consume all Rate Bandwidth by allocating 100 percent to virtual contexts, IP connectivity to the Admin context can be lost. The maximum bandwidth rate per context is determined by your ACE bandwidth license. Rate Connections Percentage of connections of any kind. Note If you consume all Rate Connections by allocating 100 percent to virtual contexts, IP connectivity to the Admin context can be lost. Rate Management Traffic Percentage of management traffic connections. Note If you consume all Rate Management Traffic by allocating 100 percent to virtual contexts, IP connectivity to the Admin context can be lost. 6-46 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using Global Resource Classes Related Topics • Using Global Resource Classes, page 6-46 • Configuring Global Resource Classes, page 6-46 • Configuring Local Resource Classes, page 6-52 • Auditing Resource Classes, page 6-49 • Deploying Global Resource Classes, page 6-48 Using Global Resource Classes Resource classes are used when provisioning services, establishing virtual contexts, managing devices, and monitoring virtual context resource consumption. Defining a new global resource class does not automatically update all configurations. A global resource class is applied only when the resource class is deployed to a specific Admin virtual context on an ACE. This section includes the following topics: • Configuring Global Resource Classes, page 6-46 • Deploying Global Resource Classes, page 6-48 • Auditing Resource Classes, page 6-49 • Modifying Global Resource Classes, page 6-50 • Deleting Global Resource Classes, page 6-51 Configuring Global Resource Classes You can create a new global resource class and optionally deploy it on an ACE by using the Admin virtual context. Caution If you allocate 100 percent of these resources to a resource class and then apply the resource class to virtual contexts, connectivity to the Admin context can be lost. For more information, see the “Resource Allocation Constraints” section on page 6-44. Rate SSL Connections Percentage of SSL connections. Note If you consume all Rate SSL Connections by allocating 100percent to virtual contexts, IP connectivity to the Admin context can be lost. Rate Syslog Percentage of syslog messages per second. Rate MAC Miss Percentage of messages destined for the ACE that are sent to the control plane when the encapsulation is not correct in packets. Table 6-9 Resource Class Attributes (continued) Resource Definition 6-47 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using Global Resource Classes Procedure Step 1 Choose Config > Global > All Resource Classes. The Resource Classes table appears. Step 2 In the Resource Classes table, click Add to create a new resource class. The New Resource Class configuration window appears. Step 3 In the Name field of the New Resource Class configuration window, enter a unique name for this resource class. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. Step 4 In the Description field, enter a brief description for this resource class. Valid entries are unquoted text strings with a maximum of 240 alphanumeric characters. Step 5 To use the same values for each resource, in the All row, enter the following information (see Table 6-9 for a description of the resources): a. In the Min. field, enter the minimum percentage of each resource that you want to allocate to this resource class. Valid entries are numbers from 0 to 100 including those numbers with decimals. b. In the Max. field, choose the maximum percentage of each resource that you want to allocate to this resource class as follows: – Equal To Min—The maximum percentage allocated for each resource is equal to the minimum specified in the Min. field. – Unlimited—There is no upper limit on the percentage of each resource that can be allocated for this resource class. Step 6 To use different values for the resources, for each resource, choose the method for allocating resources: • Choose Default to use the values specified in Step 5. • Choose Min to enter a specific minimum value for the resource. Step 7 If you chose Min, do the following: a. In the Min. field, enter the minimum percentage of this resource you want to allocate to this resource class. For example, for ACL memory, enter 10 in the Min. field to indicate that you want to allocate a minimum of 10 percent of the available ACL memory to this resource class. b. In the Max. field, choose the maximum percentage of the resource that you want to allocate to this resource class: – Equal To Min—The maximum percentage allocated for this resource is equal to the minimum specified in the Min. field. – Unlimited—There is no upper limit on the percentage of the resource that can be allocated for this resource class. Step 8 To deploy the resource class to an Admin context, do the following: a. Click Admin VCs To Deploy To to expand the configuration subset. b. In the Available Items list, choose the desired Admin context, and click Add. The items appear in the Selected Items list. In the Selected Items list, choose a context to remove and click Remove. The items appear in the Available Items list. Step 9 Do one of the following: • Click OK to save your entries and to return to the Resource Classes table. 6-48 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using Global Resource Classes • Click Cancel to exit this procedure without saving your entries and to return to the Resource Classes table. Related Topics • Using Resource Classes, page 6-43 • Modifying Global Resource Classes, page 6-50 • Deleting Global Resource Classes, page 6-51 • Auditing Resource Classes, page 6-49 Deploying Global Resource Classes You can apply a global resource class to Admin contexts on selected ACE devices. If you deploy a global resource class to an ACE that already has a resource class with the same name, ANM replaces the properties of the local resource class with the properties from the global resource class. If you deploy a global resource class to an ACE that does not have a resource class with the same name, ANM creates a new local resource class with the same name and properties as the global resource class. Assumptions This topic assumes the following: • At least one global resource class exists. • At least one ACE has been imported into the ANM. Procedure Step 1 Choose Config > Global > All Resource Classes. The Resource Classes table appears. Step 2 In the Resource Classes table, choose the global resource class that you want to apply to an ACE, and click Edit. The Edit Resource Class configuration window appears. Step 3 In the Available Items list of the Edit Resource Class configuration window, choose the context that you want to apply this global resource class to, and click Add. The item appears in the Selected Items list. To remove contexts, choose them in the Selected Items list, and click Remove. The items appear in the Available Items list. Step 4 Do one of the following: • Click OK to save your entries and to return to the Resource Classes table. The context is updated with the resource class configuration. • Click Cancel to exit this procedure without saving your entries and to return to the Resource Classes table. 6-49 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using Global Resource Classes Related Topics • Using Resource Classes, page 6-43 • Modifying Global Resource Classes, page 6-50 • Using Local Resource Classes, page 6-51 • Configuring Local Resource Classes, page 6-52 Auditing Resource Classes You can display any discrepancies that exist between the global resource class and the local resource class on the context after you apply a global resource class to an Admin context. Discrepancies occur when either global or context resource class attributes are modified independently of one another after the global resource class has been applied. Procedure Step 1 Choose Config > Global > All Resource Classes. The Resource Classes table appears. Step 2 In the Resource Classes table, choose the resource class that you want to audit, and click Audit. ANM identifies the differences between the selected resource class and the Admin contexts being managed by ANM and displays the results in the Audit Differences table in a separate window. The table uses the following conventions: • If the selected resource class has not been applied to an Admin context, the Admin context is listed with the comment “Resource class not defined.” • If the selected resource class has been applied to an Admin context, but there are no differences between the global and local resource classes, the context does not appear in the table. • If the selected resource class has been applied to an Admin context and there are differences between the global and local resource classes, the context appears in the table with the following information: – The resource attribute that has different values in the global and local resource classes. – The settings for the resource attribute in the local resource class. – The settings for the resource attribute in the global resource class. The values displayed use the format min - max where min represents the minimum percentage configured for this attribute and max represents the maximum percentage configured for this attribute, such as 8% - 8% or 5% - 100%. Step 3 Do one of the following: • Click Close to close this window and return to the Resource Classes table. • Click Refresh to update the information in the Audit Differences table. Related Topics • Using Global Resource Classes, page 6-46 • Using Local Resource Classes, page 6-51 • Configuring Global Resource Classes, page 6-46 6-50 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using Global Resource Classes • Configuring Local Resource Classes, page 6-52 Modifying Global Resource Classes You can modify an existing global resource class. The changes are not applied to virtual contexts previously associated with the resource class. ANM only applies updated resource class properties to virtual contexts that are associated with the resource class going forward. Caution If you allocate 100 percent of these resources to a resource class and then apply the resource class to virtual contexts, connectivity to the Admin context can be lost. For more information, see the “Resource Allocation Constraints” section on page 6-44. Procedure Step 1 Choose Config > Global > All Resource Classes. The Resource Classes table appears. Step 2 Choose the resource class that you want to modify, and click Edit. The Edit Resource Class configuration window appears. Step 3 In the Edit Resource Class configuration window, modify the values as desired. For details on setting values, see the “Configuring Global Resource Classes” section on page 6-46. For descriptions of the resources, see Table 6-9. Step 4 To deploy the modified resource class to an Admin context, do the following: a. Click Admin VCs To Deploy To to expand the configuration subset. b. Choose the desired context in the Available Items list, and click Add. The item appears in the Selected Items list. Note ANM only applies the updated resource class to contexts that you choose and add to the Selected Items list. It does not apply the modified resource class to contexts previously associated with the resource class. Step 5 Do one of the following: • Click OK to save your entries, apply them to the selected contexts, and return to the Resource Classes table. • Click Cancel to exit this procedure without saving your entries and to return to the Resource Classes table. Related Topics • Using Resource Classes, page 6-43 • Using Global Resource Classes, page 6-46 • Modifying Global Resource Classes, page 6-50 • Auditing Resource Classes, page 6-49 6-51 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using Local Resource Classes • Deleting Global Resource Classes, page 6-51 Deleting Global Resource Classes You can remove global resource classes from the ANM database. Because global resource classes are managed separately from local resource classes, deleting a global resource class does not affect local resource classes deployed on individual contexts. Procedure Step 1 Choose Config > Global > All Resource Classes. The Resource Classes table appears. Step 2 In the Resource Classes table, choose the resource class that you want to remove, and click Delete. A confirmation popup window appears, asking you to confirm the deletion. Step 3 Click OK to delete the resource class or Cancel to retain the resource class. The Resource Classes table refreshes with the updated information. Related Topics • Using Resource Classes, page 6-43 • Using Global Resource Classes, page 6-46 • Modifying Global Resource Classes, page 6-50 • Auditing Resource Classes, page 6-49 Using Local Resource Classes You can create local resource classes in ANM as follows: • During the import process, from any ACE with a previously configured resource class. These resource classes appear in the ANM in the Admin virtual context associated with the imported ACE. • By an Admin user in ANM using the local Resource Class configuration option (Config > Devices > Admin_context > System > Resource Classes). • By creating a global resource class (Config > Global > All Resource Classes) and applying it to an Admin context. Note Local resource class configuration options are available in Admin contexts only. This section includes the following topics: • Configuring Local Resource Classes, page 6-52 • Deleting Local Resource Classes, page 6-53 • Displaying Local Resource Class Use on Virtual Contexts, page 6-54 6-52 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using Local Resource Classes Configuring Local Resource Classes Note This functionality is available in Admin contexts only. You can create or modify a local resource class for use within the selected Admin context. Procedure Step 1 Choose Config > Devices > Admin_context > System > Resource Classes. The Resource Classes table appears. Step 2 In the Resource Classes table, click Add to create a new local resource class or choose an existing resource class, and click Edit to modify it. The Resource Class configuration window appears. Step 3 In the Name field of the Resource Class configuration window, enter a unique name for this resource class. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. Step 4 To use the same values for each resource, in the All row, enter the following information (see Table 6-9 for a description of the resources): a. In the Min. field, enter the minimum percentage of each resource that you want to allocate to this resource class. Valid entries are numbers from 0 to 100 including those numbers with decimals. b. In the Max. field, choose the maximum percentage of each resource that you want to allocate to this resource class: – Equal To Min—The maximum percentage allocated for each resource is equal to the minimum specified in the Min. field. – Unlimited—There is no upper limit on the percentage of each resource that can be allocated for this resource class. Step 5 To use different values for the resources, for each resource, choose one of the following methods for allocating resources: • Choose Default to use the values specified in Step 5. • Choose Min to enter a specific minimum value for the resource. Step 6 (Optional) If you chose Min, do the following: a. In the Min. field, enter the minimum percentage of this resource you want to allocate to this resource class. For example, for ACL memory, enter 10 in the Min. field to indicate that you want to allocate a minimum of 10 percent of the available ACL memory to this resource class. b. In the Max. field, choose the maximum percentage of the resource that you want to allocate to this resource class: – Equal To Min—The maximum percentage allocated for this resource is equal to the minimum specified in the Min. field. – Unlimited—There is no upper limit on the percentage of the resource that can be allocated for this resource class. 6-53 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using Local Resource Classes Step 7 When you finish allocating resources for this resource class, do one of the following: • Click OK to save your entries and to return to the Resource Classes table. The resource class can now be applied to other virtual contexts on the same ACE. • Click Cancel to exit this procedure without saving your entries and to return to the Resource Classes table. Related Topics • Using Resource Classes, page 6-43 • Using Local Resource Classes, page 6-51 • Displaying Local Resource Class Use on Virtual Contexts, page 6-54 • Deleting Local Resource Classes, page 6-53 Deleting Local Resource Classes You can delete a local resource class. Because of the possible impact on virtual contexts of deleting a local resource class, you cannot delete a resource class that is associated with a virtual context. To display a resource class’s current deployment, see the “Displaying Local Resource Class Use on Virtual Contexts” section on page 6-54. Procedure Step 1 Choose Config > Devices > Admin_context > System > Resource Classes. The Resource Classes table lists all local resource classes and the number of virtual contexts using each resource class. Step 2 Confirm that the resource class that you want to delete is not deployed on any virtual contexts. You cannot delete a resource class that is deployed on a context. To identify the contexts using a specific resource class, see the “Displaying Local Resource Class Use on Virtual Contexts” section on page 6-54. Step 3 Choose the resource class that you want to remove, and click Delete. A confirmation popup window appears, asking you to confirm the deletion. Step 4 Click OK to delete the resource class or Cancel to retain the resource class. The Resource Classes table refreshes with the updated information. Related Topics • Using Resource Classes, page 6-43 • Configuring Local Resource Classes, page 6-52 • Displaying Local Resource Class Use on Virtual Contexts, page 6-54 6-54 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using the Configuration Checkpoint and Rollback Service Displaying Local Resource Class Use on Virtual Contexts You can display local resource class usage on all virtual contexts on an ACE. Procedure Step 1 Choose Config > Devices. The device tree appears. Step 2 In the device tree, choose the ACE with the resource class usage that you want to display. The Virtual Contexts table appears, listing all contexts on the selected ACE and the resource class in use for each context. Step 3 (Optional) In the Virtual Contexts table, click the Resource Class column heading to sort the table by resource class. Related Topics • Using Resource Classes, page 6-43 • Configuring Local Resource Classes, page 6-52 • Deleting Local Resource Classes, page 6-53 Using the Configuration Checkpoint and Rollback Service At some point, you may want to modify your ACE running configuration. If you run into a problem with the modified configuration, you may need to reboot your ACE. To prevent having to reboot your ACE after unsuccessfully modifying a running configuration, you can create a checkpoint (a snapshot in time) of a known stable running configuration before you begin to modify it. If you encounter a problem with the modifications to the running configuration, you can roll back the configuration to the previous stable configuration checkpoint. Note Before you upgrade your ACE software, we strongly recommend that you create a checkpoint in your running configuration. For ACE module A2(3.0) and later releases only, use the backup function to create a backup of the running configuration (see the “Performing Device Backup and Restore Functions” section on page 6-59). The ACE allows you to make a checkpoint configuration at the context level. The ACE stores the checkpoint for each context in a hidden directory in Flash memory. If, after you make configuration changes that modify the current running configuration, when you roll back the checkpoint, the ACE causes the running configuration to revert to the checkpointed configuration. This section includes the following topics: • Creating a Configuration Checkpoint, page 6-55 • Deleting a Configuration Checkpoint, page 6-56 • Rolling Back a Running Configuration, page 6-56 • Displaying Checkpoint Information, page 6-57 6-55 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using the Configuration Checkpoint and Rollback Service • Comparing a Checkpoint to the Running Configuration, page 6-58 Creating a Configuration Checkpoint You can create a configuration checkpoint for a specific context. The ACE supports a maximum of 10 checkpoints for each context. Assumption This topic assumes the following: • Make sure that the current running configuration is stable and is the configuration that you want to make as a checkpoint. If you change your mind after creating the checkpoint, you can delete it (see the “Deleting a Configuration Checkpoint” section on page 6-56). • The ACE-Admin, ANM-Admin, and Org-Admin predefined roles have access to the configuration checkpoint function. • A custom role defined with the task ANM Inventory > Virtual Context/Create or ANM Inventory > Virtual Context/Modify has the required privileges to create a configuration checkpoint. • A checkpoint will not include the SSL keys/certificates, probe scripts, and licenses. • Adding a checkpoint from an ACE context directly will not trigger an autosynchronzation on ANM for that context. Procedure Step 1 Choose Config > Devices > context > System > Checkpoints. The Checkpoints table appears. For descriptions of the checkpoints, see Table 6-10. Step 2 In the Checkpoints table, click the Create Checkpoint button. The Create Checkpoint dialog box appears. Step 3 In the Checkpoint Name field of the Create Checkpoint dialog box, specify a unique identifier for the checkpoint. Enter a text string with no spaces and a maximum of 25 alphanumeric characters. If the checkpoint already exists, you are prompted to use a different name. Step 4 Do one of the following: • Click OK to save your configuration checkpoint. You return to the Checkpoints table and the new checkpoint appears in the table. Table 6-10 Checkpoints Table Field Description Name Unique identifier of the checkpoint. Size (In Bytes) Size of the configuration checkpoint, shown in bytes. Date (Created On) Date that the configuration checkpoint was created. 6-56 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using the Configuration Checkpoint and Rollback Service • Click Cancel to exit the procedure without saving the configuration checkpoint and to return to the Checkpoints table. Related Topics • Using the Configuration Checkpoint and Rollback Service, page 6-54 • Deleting a Configuration Checkpoint, page 6-56 • Rolling Back a Running Configuration, page 6-56 • Displaying Checkpoint Information, page 6-57 • Comparing a Checkpoint to the Running Configuration, page 6-58 Deleting a Configuration Checkpoint You can delete a checkpoint. Deleting a checkpoint from an ACE context directly will not trigger an autosynchronzation to occur on ANM for that context. Prerequisite Before you perform this procedure, make sure that you want to delete the checkpoint. Once you click the Trash icon, the ACE removes the checkpoint from Flash memory. Procedure Step 1 To choose a virtual context that you want to create a configuration checkpoint, choose Config > Devices > context > System > Checkpoints. The Checkpoints table appears. Step 2 In the Checkpoints table, choose the radio button to the left of any table entry, and click the Trash icon to delete the checkpoint. Related Topics • Using the Configuration Checkpoint and Rollback Service, page 6-54 • Creating a Configuration Checkpoint, page 6-55 • Rolling Back a Running Configuration, page 6-56 • Displaying Checkpoint Information, page 6-57 • Comparing a Checkpoint to the Running Configuration, page 6-58 Rolling Back a Running Configuration You can roll back the current running configuration of a context to the previously checkpointed running configuration. 6-57 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using the Configuration Checkpoint and Rollback Service Procedure Step 1 Choose Config > Devices > context > System > Checkpoints. The Checkpoints table appears. Step 2 Choose the radio button to the left of the checkpoint that you wish to roll back, and click Rollback. ANM displays a confirmation popup window to warn you about this change and to instruct you that the rollback operation may take longer depending on the differences detected between the two configurations. Note ANM synchronizes the device after performing a rollback. This synchronzation may take some time. Related Topics • Using the Configuration Checkpoint and Rollback Service, page 6-54 • Creating a Configuration Checkpoint, page 6-55 • Deleting a Configuration Checkpoint, page 6-56 • Displaying Checkpoint Information, page 6-57 • Comparing a Checkpoint to the Running Configuration, page 6-58 Displaying Checkpoint Information You can display checkpoint configuration information. Procedure Step 1 Choose Config > Devices > context > System > Checkpoints. The Checkpoints table appears. Step 2 In the Checkpoints table, choose the radio button of the checkpoint that you want to display, and click Details. A popup window appears in which ANM uses the ACE s how checkpoint detail name CLI command to display the configuration of the specified checkpoint (see Figure 6-1). 6-58 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Using the Configuration Checkpoint and Rollback Service Figure 6-1 show checkpoint detail CLI Command Dialog Box Step 3 From the popup window, click Close to exit the window and return to the Checkpoints table. Related Topics • Using the Configuration Checkpoint and Rollback Service, page 6-54 • Creating a Configuration Checkpoint, page 6-55 • Deleting a Configuration Checkpoint, page 6-56 • Rolling Back a Running Configuration, page 6-56 • Comparing a Checkpoint to the Running Configuration, page 6-58 Comparing a Checkpoint to the Running Configuration Note This feature requires ACE module and ACE appliance software Version A4(1.0) or later. You can have ANM compare and display the differences between a specified checkpoint and the ACE’s current running configuration. Procedure Step 1 Choose Config > Devices > context > System > Checkpoints. The Checkpoints table appears. Step 2 In the Checkpoints table, choose the radio button of the checkpoint that you want to compare to the current running configuration, and click Compare. 6-59 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Device Backup and Restore Functions A popup window appears in which ANM uses the ACE compare name CLI command to display the differences between the running configuration and the specified checkpoint. The items that display in red are in the current running configuration and will be removed if you roll back to the checkpoint. The items that display in green are not in the current running configuration and will be added during the rollback. Step 3 From the popup window, click Close to the window and return to the Checkpoints table. Related Topics • Using the Configuration Checkpoint and Rollback Service, page 6-54 • Creating a Configuration Checkpoint, page 6-55 • Deleting a Configuration Checkpoint, page 6-56 • Rolling Back a Running Configuration, page 6-56 • Displaying Checkpoint Information, page 6-57 Performing Device Backup and Restore Functions Note The backup and restore functions are available only for the ACE module A2(3.0), ACE appliance 4(1.0), and later releases of either device type. The backup and restore functions allow you to back up or restore the configuration and dependencies of an entire ACE or of a particular virtual context. Configuration dependencies are those files that are required to exist on the ACE so that a configuration can be applied to it. Such files include health-monitoring scripts, SSL certificates, SSL keys, and so on.This feature allows you to back up and restore the following configuration files and dependencies: • Running-configuration files • Startup-configuration files • Checkpoints • SSL files (SSL certificates and keys) • Health-monitoring scripts • Licenses Note The backup feature does not back up the sample SSL certificate and key pair files. Typical uses for this feature are as follows: • Back up a configuration for later use • Recover a configuration that was lost because of a software failure or user error • Restore configuration files to a new ACE when a hardware failure resulted in a Return Merchandise Authorization (RMA) of the old ACE • Transfer the configuration files to a different ACE 6-60 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Device Backup and Restore Functions The backup and restore functions are supported in both the Admin and virtual contexts. If you perform these functions in the Admin context, you can back up or restore the configuration files for either the Admin context only or for all contexts in the ACE. If you perform these functions in a virtual context, you can back up or restore the configuration files only for that context. Both the backup and the restore functions run asynchronously (in the background). Note To perform the back up or copy functions on multiple ACEs simultaneously, see the “Performing Global Device Backup and Copy Functions” section on page 6-68 Archive Naming Conventions Context archive files have the following naming convention format: Hostname_ctxname_timestamp.tgz The filename fields are as follows: – Hostname—Name of the ACE. If the hostname contains special characters, the ACE uses the default hostname “switch” in the filename. For example, if the hostname is Active@~!#$%^, then the ACE assigns the following filename: switch_Admin_2009_08_30_15_45_17.tgz – ctxname—Name of the context. If the context name contains special characters, the ACE uses the default context name “context” in the filename. For example, if the context name is Test!123*, then the ACE assigns the following filename: switch_context_2009_08_30_15_45_17.tgz – timestamp—Date and time that the ACE created the file. The time stamp has the following 24 hour format: YYYY_MM_DD_hh_mm_ss An example is as follows: ACE-1_ctx1_2009_05_06_15_24_57.tgz If you back up the entire ACE, the archive filename does not include the ctxname field. So, the format is as follows: Hostname_timestamp.tgz An example is as follows: ACE-1_2009_05_06_15_24_57.tgz Archive Directory Structure and Filenames The ACE uses a flat directory structure for the backup archive. The ACE provides file extensions for the individual files that it backs up so that you can identify the types of files easily when restoring an archive. All files are stored in a single directory that is tarred and GZIPed as follows: ACE-1_Ctx1_2009_05_06_07_24_57.tgz ACE-1_Ctx1_2009_05_06_07_24_57\ context_name-running context_name-startup context_name-chkpt_name.chkpt context_name-cert_name.cert context_name-key_name.key context_name-script_name.tcl context_name-license_name.lic Guidelines and Limitations The backup and restore functions have the following configuration guidelines and limitations: 6-61 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Device Backup and Restore Functions • Store the backup archive on disk0: in the context of the ACE where you intend to restore the files. Use the Admin context for a full backup and the corresponding context for user contexts. • When you back up the running-configuration file, the ACE uses the output of the show running-configuration CLI command as the basis for the archive file. • The ACE backs up only exportable certificates and keys. • License files are backed up only when you back up the Admin context. • Use a pass phrase to back up SSL keys in encrypted form. Remember the pass phrase or write it down and store it in a safe location. When you restore the encrypted keys, the ACE prompts you for the pass phrase to decrypt the keys. If you do not use a pass phrase when you back up the SSL keys, the ACE restores the keys with AES-256 encryption using OpenSSL software. • Only probe scripts that reside in disk0: need to be backed up. The prepackaged probe scripts in the probe: directory are always available. When you perform a backup, the ACE automatically identifies and backs up the scripts in disk0: that are required by the configuration. • The ACE does not resolve any other dependencies required by the configuration during a backup except for scripts that reside in disk0:. For example, if you configured SSL certificates in an SSL proxy in the running-configuration file, but you later deleted the certificates, the backup proceeds anyway as if the certificates still existed. • To perform a restore operation, you must have the admin RBAC feature in your user role. ANM-admin and ORG-admin have access to this feature by default. Custom roles with the ANM Inventory and Virtual Context role tasks set to create or modify can also access this feature. • When you instruct the ACE to restore the archive for the entire ACE, it restores the Admin context completely first, and then it restores the other contexts. The ACE restores all dependencies before it restores the running configuration. The order in which the ACE restores dependencies is as follows: – License files – SSL certificates and key files – Health-monitoring scripts – Checkpoints – Startup-configuration file – Running-configuration file • When you restore the ACE, previously installed license files are uninstalled and the license files in the backup file are installed in their place. • In a redundant configuration, if the archive that you want to restore is different from the peer configurations in the FT group, redundancy may not operate properly after the restore. • You can restore a single context from a full backup archive provided that: – You execute the restore operation in the context that you want to restore – All files dependencies for the context exist in the full backup archive • To enable ANM to synchronize the CLI after a successful restore, do not navigate from the Backup / Restore page until the Latest Restore status changes from In Progress to Success. If you navigate to another page before the restore process is complete, the CLI will not synchronize until you return to the Backup / Restore page. Defaults Table 6-11 lists the default settings for the backup and restore function parameters. 6-62 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Device Backup and Restore Functions This section includes the following topics: • Backing Up Device Configuration and Dependencies, page 6-62 • Restoring Device Configuration and Dependencies, page 6-66 Backing Up Device Configuration and Dependencies You can create a backup of an ACE configuration and its dependencies. Note When you perform the backup process from the Admin context, you can either back up the Admin context files only or you can back up the Admin context and all user contexts. When you back up from a user context, you back up the current context files only and cannot back up the ACE licenses. Note If your web browser supports the Remember Passwords option and you enable this option, the web browser may fill in the Username and Password fields for user authentication. By default, these fields should be empty. You can change the username and password fields from whatever the web browser inserts into the two fields. Procedure Step 1 Choose Config > Devices > context > System > Backup / Restore. The Backup / Restore table appears and displays the latest backup and restore statistics. Note To refresh the table content at any time, click Poll Now. Table 6-11 Default Backup and Restore Parameters Parameter Default Backed up files By default the ACE backs up the following files in the current context: • Running-configuration file • Startup-configuration file • Checkpoints • SSL certificates • SSL keys • Health-monitoring scripts • Licenses SSL key restore encryption None 6-63 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Device Backup and Restore Functions Note When you choose the Backup / Restore operation, ANM must poll a context if that context has not been accessed previously for this operation. The polling operation, which is necessary to obtain the latest backup and restore information, can cause a delay in the display time of the Backup / Restore table. The Backup / Restore fields are described in Table 6-12. Step 2 Click Backup. The Backup window appears. Step 3 In the Backup window, click the radio button of the location where the ACE is to save the backup files: • Backup config on ACE (disk0:)—This is the default. Go to Step 9. • Backup config on ACE (disk0:) and then copy to remote system—The Remote System attributes step appears. Go to Step 4. Table 6-12 Backup / Restore Fields Field Description Latest Backup Backup Archive Name of the last *.tgz file created that contains the backup files. Type Type of backup: Context or Full (all contexts). Start-time Date and time that the last backup began. Finished-time Date and time that the last backup ended. Status Status of the last context to be backed up: Success, In Progress, or Failed. Click the status link to view status details. Current vc Name of the last context in the backup process. Completed Number of context backups completed compared to the total number of context backup requests. For example: • 2/2 = Two context backups completed/Two context backups requested • 0/1 = No context backup completed/One context backup requested Latest Restore Backup Archive Name of the *.tgz file used in during the restore process. Type Type of restore: Context or Full (all contexts). Start-time Date and time that the last restore began. Finished-time Date and time that the last restore ended. Status Status of the last restore: Success, In Progress, or Failed. Click the status to view status details. Current vc Name of the last context in the restore process. Completed Number of context restores completed compared to the total number of context restore requests. For example: • 2/2 = Two context restores completed/Two context restores requested • 0/1 = No context restore completed/One context restore requested 6-64 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Device Backup and Restore Functions Step 4 Click the radio button of the transfer protocol to use: • FTP—File Transfer Protocol • SFTP—Secure File Transfer Protocol • TFTP—Trivial File Transfer Protocol Step 5 In the Username field, enter the username that the remote server requires for user authentication. This field appears for FTP and SFTP only. Step 6 In the Password field, enter the password that the remote server requires for user authentication. This field appears for FTP and SFTP only. Step 7 In the IP Address field, enter the IP address of the remote server. Step 8 In the Backup File Path in Remote System field, enter the full path for the remote server. Step 9 Check the Backup All Contexts checkbox if you want the ACE to create a backup that contains the files of the Admin context and every user context or uncheck the check box to create a backup of the Admin context files only. This field appears for the Admin context only. Step 10 Indicate the components to exclude from the backup process: Checkpoints or SSL Files. To exclude a component, double-click on it in the Available box to move it to the Selected box. You can also use the right and left arrows to move selected items between the two boxes. Caution If you exclude the SSL Files component and then restore the ACE using this archived backup, these files are removed from the ACE. To save these files prior to performing a restore with this backup, use the crypto export CLI command to export the keys to a remote server and use the copy CLI command to copy the license files to disk0: as .tar files. Step 11 In the Pass Phrase field, enter the pass phrase that you specify to encrypt the backed up SSL keys. Enter the pass phrase as an unquoted text string with no spaces and a maximum of 40 alphanumeric characters. If you enter a pass phrase but exclude the SSL files from the archive, the ACE does not use the pass phrase. Step 12 Click OK to begin the backup process. The following actions occur depending on where ANM saves the files: • disk0: only—ANM permits continued GUI functionality during the backup process and polls the ACE for the backup status, which it displays on the Backup / Restore page. • disk0: and a remote server— ANM suspends GUI operation and displays a “Please Wait” message in the Backup dialog box until the process is complete. During this process, ANM instructs the ACE to create and save the backup file locally to disk0: and then place a copy of the file on the specified remote server. Step 13 In the Backup / Restore page, click Poll Now or click the browser refresh button to ensure that the latest backup statistics are displayed, and then click on the Status link (Success, In Progress, or Failed) located in the Latest Backup column to view details of the backup operation. If the backup status is either Success or In Progress, then the Show Backup Status Detail popup window appears and displays a list of the files successfully backed up. When the backup status is In Progress, ANM polls the ACE every 2 minutes to retrieve the latest status information and then it automatically 6-65 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Device Backup and Restore Functions updates the status information displayed. The polling continues until ANM receives a status of either Success or Failed. If the backup status is Failed, then the Show Backup Errors popup window appears, displaying the reason for the failed backup attempt. Related Topics • Performing Device Backup and Restore Functions, page 6-59 • Restoring Device Configuration and Dependencies, page 6-66 • Performing Global Device Backup and Copy Functions, page 6-68 6-66 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Device Backup and Restore Functions Restoring Device Configuration and Dependencies You can restore an ACE configuration and its dependencies using a backup file. Caution The restore operation clears any existing SSL certificate and key-pair files, license files, and checkpoints in a context before it restores the backup archive file. If your configuration includes SSL files or checkpoints and you excluded them when you created the backup archive, those files will no longer exist in the context after you restore the backup archive. To preserve any existing exportable SSL certificate and key files in the context, before you execute the restore operation, export the certificates and keys that you want to keep to an FTP, SFTP, or TFTP server by using the CLI and the crypto export command. After you restore the archive, import the SSL files into the context. For details on exporting and importing SSL certificate and key pair files using the CLI, see the Cisco Application Control Engine Module SSL Configuration Guide. You can also use the exclude option of the restore command to instruct the ACE not to clear the SSL files in disk0: and to ignore the SSL files in the backup archive when the ACE restores the backup. Note If your web browser supports the Remember Passwords option and you enable this option, the web browser may fill in the Username and Password fields for user authentication. By default, these fields should be empty. You can change the username and password fields from whatever the web browser inserts into the two fields. Prerequisites If you are going to restore the Admin context files plus all user context files, use a backup file that was created from the Admin context with the Backup All Contexts checkbox checked (see the “Backing Up Device Configuration and Dependencies” section on page 6-62). Procedure Step 1 Choose Config > Devices > context > System > Backup / Restore. The Backup / Restore table appears. Note To refresh the table content at any time, click Poll Now. Note When you perform the restore process from the Admin context, you can either restore the Admin context files only or you can restore the Admin context files plus all user context files. When you perform the restore process from a user context, you can restore the current context files only. The Backup / Restore fields are described in Table 6-12. Step 2 Click Restore. The Restore window appears. 6-67 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Device Backup and Restore Functions Step 3 In the Restore window, click the desired radio button to specify the location where the backup files are located saved: • Choose a backup file on the ACE (disk0:)—This is the default. Go to Step 9. • Choose a backup file from remote system—The Remote System attributes step appears. Go to Step 4. Step 4 Click the radio button of the transfer protocol to use: • FTP—File Transfer Protocol • SFTP—Secure File Transfer Protocol • TFTP—Trivial File Transfer Protocol Step 5 In the Username field, enter the username that the remote file system requires for user authentication. This field appears for FTP and SFTP only. Step 6 In the Password field, enter the password that the remote file system requires for user authentication. This field appears for FTP and SFTP only. Step 7 In the IP Address field, enter the IP address of the remote server. Step 8 In the Backup File Path in Remote System field, enter the full path of the backup file, including the backup filename, to be copied from the remote server. Step 9 Check the Restore All Contexts checkbox if you want the ACE to restore the files for every context or uncheck the checkbox to restore the Admin context files only. This field appears for the Admin context only. Step 10 Check the Exclude SSL Files checkbox if you want to preserver the SSL files currently loaded on the ACE and not use the backup file’s SSL files. Caution The restore function deletes all SSL files currently loaded on the ACE unless you check the Exclude SSL Files option. If you do not check this option, the restore functions loads the SSL files included in the backup file. If the backup files does not include SSL files, the ACE will not have any SSL files loaded on it when the restore process is complete. You will then need to import copies of the SSL files from a remote server. Step 11 In the Pass Phrase field, enter the pass phrase that is used to encrypt the backed up SSL keys in the archive. Enter the pass phrase as an unquoted text string with no spaces and a maximum of 40 alphanumeric characters. The Pass Phrase field does not appear when you check the Exclude SSL Files checkbox. Step 12 Click OK to begin the restore process. The following actions occur depending on where ANM retrieves the backup files: • disk0: only—ANM permits continued GUI functionality during the restore process and polls the ACE for the backup status, which it displays on the Backup / Restore page. Note To enable ANM to synchronize the CLI after a successful restore, do not navigate from the Backup / Restore window until the Latest Restore status changes from In Progress to Success. If you navigate to another window before the restore process is complete, the CLI will not synchronize until you return to the Backup / Restore window. 6-68 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Global Device Backup and Copy Functions • disk0: and a remote server— ANM suspends GUI operation and displays a “Please Wait” message in the Restore dialog box until the process is complete. During this process, ANM instructs the ACE to copy the backup file from the specified remote server to disk0: on the ACE and then apply the backup file to the context. Step 13 In the Backup / Restore page, click Poll Now or click the browser refresh button to ensure that the latest restore statistics are displayed, then click on the Status link (Success, In Progress, or Failed) located in the Latest Backup column to view details of the restore operation. If the restore status is either Success or In Progress, then the Show Restore Status Detail popup window appears and displays a list of the files successfully restored. When the restore status is In Progress, ANM polls the ACE every 2 minutes to retrieve the latest status information and then it automatically updates the status information displayed. The polling continues until ANM receives a status of either Success or Failed. If the restored status is Failed, then the Show Restored Errors popup window appears, displaying the reason for the failed restore attempt. Related Topics • Performing Device Backup and Restore Functions, page 6-59 • Backing Up Device Configuration and Dependencies, page 6-62 • Performing Global Device Backup and Copy Functions, page 6-68 Performing Global Device Backup and Copy Functions Note The global backup and copy functions are available for the ACE module A2(3.0), ACE appliance A4(1.0), and later releases of either device type. The global backup and copy functions allow you to either back up the configuration and dependencies of multiple ACEs simultaneously or copy existing backup configuration files from disk0: of multiple ACEs to a remote server. Configuration dependencies are those files that are required to exist on the ACE so that a configuration can be applied to it. Such files include health-monitoring scripts, SSL certificates, SSL keys, and so on. This feature allows you to back up and restore the following configuration files and dependencies: • License files • Running-configuration files • Startup-configuration files • Checkpoints • SSL files (SSL certificates and keys) • Health-monitoring scripts During the backup, each ACE saves its configuration files locally to disk0: in a single directory that is tarred and GZIPed. For more information about the backup function, including guidelines and restrictions, see the “Performing Device Backup and Restore Functions” section on page 6-59. This section includes the following topics: • Backing Up Multiple Device Configuration and SSL Files, page 6-69 • Associating a Global Backup Schedule with a Device, page 6-71 6-69 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Global Device Backup and Copy Functions • Managing Global Backup Schedules, page 6-73 • Copying Existing Tarred Backup Files to a Remote Server, page 6-77 Backing Up Multiple Device Configuration and SSL Files You can back up the configuration and SSL files for multiple ACEs simultaneously. Note If your web browser supports the Remember Passwords option and you enable this option, the web browser may fill in the Username and Password fields for user authentication. By default, these fields should be empty. You can change the username and password fields from whatever the web browser inserts into the two fields. Procedure Step 1 Choose Config > Global > All Backups. The Backups table appears and displays a list of the available ACEs. Note To refresh the table content at any time, click Poll Now. Note When you choose the All Backups operation, ANM must poll all Admin contexts that have not been accessed previously for this operation. The polling operation, which is necessary to obtain the latest backup and restore information, can cause a delay in the display time of the Backups table. The Backups fields are described in Table 6-13. Table 6-13 Backups Fields Field Description Name Name of the ACE. Management IPs Management interface IP addresses. When there are multiple IP addresses, they display as shown in the following example: 10.77.241.18/10.77.241.28/10.77.241.38 Latest Backup Time Date and time that the last backup occurred. Latest Backup Status Status of the last backup attempt: Success, In Progress, or Failed. Click the status link to view status details. Latest Restore Time Date and time that the last restore occurred. Latest Restore Status Status of the last restore attempt: Success, In Progress, or Failed. Click the status link to view status details. Last Poll Time Date and time that ANM last polled the device for backup statistics. Schedules Backup schedule associated with the ACE. 6-70 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Global Device Backup and Copy Functions Step 2 In the Backups table, check the checkbox of the ACE or ACEs to back up. Note To choose all of the ACEs, check the Name checkbox. Step 3 Click Backup. The Backup on devices dialog box appears. Step 4 In the Backup on devices dialog box, check the Backup All Contexts checkbox if you want each ACE to create a backup that contains the files of its Admin context and every user context or uncheck the check box to create a backup of the Admin context files only. Step 5 Indicate the components that you want to exclude from the backup process: Checkpoints or SSL Files. To exclude a component, click on it in the Available box and then click Add (right arrow) to move it to the Selected box. Use Remove (left arrow) to move items from the Selected box back to the Available box if needed. Caution If you exclude the SSL Files component and then restore the ACE using this archived backup, these files are removed from the ACE. To save these files prior to performing a restore with this backup, use the crypto export CLI command to export the keys to a remote server and use the copy CLI command to copy the license files to disk0: as .tar files. Step 6 In the Pass Phrase field, enter the pass phrase that you specify to encrypt the backed up SSL keys. Enter the pass phrase as an unquoted text string with no spaces and a maximum of 40 alphanumeric characters. If you enter a pass phrase but excluded the SSL files from the archive, the ACE does not use the pass phrase. Step 7 Click OK to begin the backup. Step 8 In the Backups page, click Poll Now or click the browser refresh button to ensure that the latest statistics are displayed, and then click on the Status link (Success, In Progress, or Failed) located in the Latest Backup Status column to view details of the backup. If the backup status is either Success or In Progress, then the Show Backup Status Detail popup window appears and displays a list of the files successfully backed up. When the backup status is In Progress, ANM polls each ACE every 2 minutes to retrieve the latest status information and then it automatically updates the status information displayed. The polling continues until ANM receives a status of either Success or Failed. If the backup status is Failed, then the Show Backup Errors popup window appears, displaying the reason for the failed backup attempt. Related Topics • Associating a Global Backup Schedule with a Device, page 6-71 • Managing Global Backup Schedules, page 6-73 • Copying Existing Tarred Backup Files to a Remote Server, page 6-77 • Performing Device Backup and Restore Functions, page 6-59 6-71 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Global Device Backup and Copy Functions Associating a Global Backup Schedule with a Device You can schedule ANM to perform a global backup either as a one-time operation at some future time or on a regular basis. You do this by creating a backup schedule and then associating the schedule with one or more ACE devices. Procedure Step 1 Choose Config > Global > All Backups. The Backups table appears and displays a list of the available ACEs (see Table 6-13). Step 2 In the Backups table, check the checkbox of the ACEs that you want to schedule for backups. When you choose multiple devices to schedule a backup, ANM checks to ensure that the following attributes match between the devices: • Schedules currently associated with the devices • Remote location details • Protocol used to connect to the remote location • Pass phrase used to encrypt the backed up SSL keys • Specified components to exclude If these attributes do not match between the selected devices, ANM displays an error message and does not allow you to continue scheduling a global backup. For example, if the attributes of the selected devices do not match, ANM displays an error message such as: One or more field values do not match in the selected devices. Select only devices that have matching field values. Step 3 Click Schedule Backup. The Scheduled Backup popup window appears, which includes a list of the devices that you selected and backup schedule parameters that you must configure. Step 4 From the Scheduled Backup popup window, configure the scheduled backup parameters as shown in Table 6-14. 6-72 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Global Device Backup and Copy Functions Step 5 From the Scheduled Backup popup window, do one of the following: Table 6-14 Scheduling a Backup Item Description Schedule Associate one or more backup schedule with the devices by performing one or both of the following: • To associate an existing schedule listed in the Available box, double-click the schedule to move it to the Selected box. You can also use the arrow buttons to move selected schedules between the Available and Selected boxes. • To create a backup schedule for the devices, click Create. The fields for creating a new schedule appear in the Schedule section. Assign a unique name to the schedule, define the schedule’s operating parameters, and click OK. The new schedule is added to the Selected box. For more information about creating a schedule, see the “Creating a Backup Schedule” section on page 6-73. To display the current settings of schedule in the Selected box, choose the schedule and click View. The schedule details display in the Schedules section. You cannot modify the settings. Click Cancel to close the details display. Backup a file on ACE (disk0:) and then copy to remote system Configure where the backup is to be saved remotely as follows: a. Specify the file transfer protocol to use by clicking one of the following radio buttons: • FTP • SFTP • TFTP b. In the Username text box, enter the username associated with the remote server. c. In the Password text box, enter the password associated with the username. d. In the IP Address text box, enter the remote server IP address. e. In the Backup File Path in Remote System text box, enter the full path for the backup file on the remote server. Backup on devices Define the items to back up as follows: a. Indicate the components that you want to exclude from the backup process: Checkpoints or SSL Files. Double-click an item to move it to the Selected box. You can also use the arrow buttons to move an item between the Available and Selected boxes. b. Enter the pass phrase that you specify to encrypt the backed up SSL keys. Enter the pass phrase as an unquoted text string with no spaces and a maximum of 40 alphanumeric characters. If you enter a pass phrase but excluded the SSL files from the archive, the ACE does not use the pass phrase. Note The Backup All Contexts checkbox is checked by default to create a backup that contains the files of the Admin context and every user context on the ACE. You cannot change this setting. 6-73 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Global Device Backup and Copy Functions • Click OK to save the scheduled backup configuration, close the popup window, and return to the Backups window, which now displays the associated backup schedule with the ACE. • Click Cancel to ignore the scheduled backup information, close the popup window, and return to the Backups window. Related Topics • Managing Global Backup Schedules, page 6-73 • Creating a Backup Schedule, page 6-73 • Updating an Existing Backup Schedule, page 6-76 • Backing Up Multiple Device Configuration and SSL Files, page 6-69 Managing Global Backup Schedules You can create multiple schedules that allow ANM to perform a global backup at the time specified in a particular schedule. You assign each schedule a name and then configure it with a set of parameters that specify when ANM is to perform the backup. For example, you can create a schedule that has ANM create a weekly backup every Tuesday at 1:00AM. After you create the schedule, you can apply it to one or more devices. If you change the schedule’s configuration, such as the day of the week when the backup is made, the change is applied the devices that use the schedule. This section includes the following topics: • Creating a Backup Schedule, page 6-73 • Updating an Existing Backup Schedule, page 6-76 • Deleting a Backup Schedule, page 6-76 Creating a Backup Schedule You can create a backup schedule that you can apply to one or more devices. Procedure Step 1 Choose Config > Global > All Schedules. The Schedules table appears and displays the information described in Table 6-15. Table 6-15 All Schedules Fields Item Description Name Schedule name. Type Schedule type: Once, Daily, Weekly, or Monthly. Date Date that ANM performs a backup. This column applies the schedule type of the type Once. Time Time of day when ANM performs the backup. 6-74 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Global Device Backup and Copy Functions Step 2 From the Schedules table window, click Create Schedule. The Create Schedule popup window appears. Step 3 From the Create Schedule popup window, create and configure the new backup schedule as described in Table 6-16. Daily Recurrence Indicates the following depending on schedule type: • Daily schedule—Number of days between backups. For example, a value of 4 in this field indicates that ANM performs one backup every 4 days. When N/A appears in this field for the type Daily, the schedule is configured to perform a daily backup everyday (Monday–Sunday). In this case, the days are listed in the Week Days column. • Monthly schedule—Day of the month when the backup is to occur. For example, a value of 3 indicates that the backup occurs on the third day of each month. When N/A appears in this field for the type Monthly, the schedule is configured to perform a monthly backup on the occurrence of a particular day of the week. For example, you can schedule the backup for the second Sunday of each month, in which case, Sun appears in the Week Days column. Weekly Recurrence Indicates the following depending on schedule type: • Weekly schedule—This value is always 1 for any configured weekly schedule and indicates that a backup will occur every week on the indicated days (see Week Days). • Monthly schedule—Week of the month when the backup is to occur. For example, a value of 3 indicates that the backup occurs on the third week of each month. Monthly Recurrence Number of times the monthly schedule occurs. Week Days Indicates the days of the week when ANM performs a backup depending on the schedule type: • Weekly schedule—Days of the week when the backup occurs. • Monthly schedule—Day of the week when the backup occurs. The Weekly Recurrence value indicates which monthly occurrence of the specified week day that the backup occurs. For example, if Weekly Recurrence value is 3 and the Week Days value is Sunday, then the monthly backup occurs every third Sunday of the month. Devices Name of the ACEs associated with the schedule. ANM adds devices to this field after you associate the schedule with an ACE backup (see the “Backing Up Multiple Device Configuration and SSL Files” section on page 6-69). Table 6-15 All Schedules Fields Item Description 6-75 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Global Device Backup and Copy Functions Step 4 Do one of the following: • Click OK to save the backup schedule, close the popup window, and return to the Schedules window. The Schedules window displays the new schedule. • Click Cancel to close the popup window without saving your information and return to the Schedules window. Related Topics • Managing Global Backup Schedules, page 6-73 • Updating an Existing Backup Schedule, page 6-76 • Deleting a Backup Schedule, page 6-76 • Associating a Global Backup Schedule with a Device, page 6-71 Table 6-16 Create Schedule Fields Item Description Name Unique schedule name. Schedule types Schedule types that you can create to specify when a backup is to occur. Choose one of the following: • Once: Specifies a one-time backup as follows: – Date: Date that ANM performs a backup. Use the calendar tool to select the date – Time: Time of day when ANM performs the backup. • Daily: Specifies a daily schedule as follows: – Time: Time of day when ANM performs the backup. – Repeat: Specifies how often the schedule is repeated as follows: - Every: Specifies the number of days between backups. - Everyday (Mon-Sun): Specifies that a backup is performed each day. • Weekly: Specifies a weekly schedule as follows: – Time: Time of day when ANM performs the backup. – Repeat Every week on: Specifies the days of the week that the backup is performed. • Monthly: Specifies a monthly schedule as follows: – Time: Time of day when ANM performs the backup. – Repeat: - Day (number) of every month: Specifies the day of the month when the backup is to occur. For example, you can schedule a backup for 15th day of the month. - Occurrence of the day (name) of every month: Specifies the occurrence of a weekday during the month when the backup is performed. For example, you can schedule a backup to occur every second Saturday of the month. 6-76 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Global Device Backup and Copy Functions Updating an Existing Backup Schedule You can update an existing backup schedule. When you update a schedule that is currently associated with devices, the changes that you make to the schedule affect the associated devices. Caution Modifying an existing schedule affects the backup schedule of any device currently associated with the schedule. Procedure Step 1 Choose Config > Global > All Schedules. The Schedules window appears and displays the information described in Table 6-15. Step 2 From the Schedules window, click the radio button of the backup schedule to update and click Update Schedule. The Update Schedule popup window appears. Step 3 From the Update Schedule popup window, update backup schedule as described in Table 6-16. Note You cannot modify the schedule name. Step 4 From the Update Schedule popup window, do one of the following: • Click OK to save your changes, close the popup window, and return to the Schedules window. • Click Cancel to close the po-up window without saving your changes and return to the Schedules window. Related Topics • Managing Global Backup Schedules, page 6-73 • Creating a Backup Schedule, page 6-73 • Deleting a Backup Schedule, page 6-76 • Associating a Global Backup Schedule with a Device, page 6-71 Deleting a Backup Schedule You can delete an existing global backup schedule. Caution Deleting a backup schedule removes the schedule from any device currently associated with it. Procedure Step 1 Choose Config > Global > All Schedules. The Schedules window appears and displays the information described in Table 6-15. 6-77 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Performing Global Device Backup and Copy Functions Step 2 From the Schedules window, click the radio button of the backup schedule to delete and click Delete. The Delete Confirmation popup window appears. Step 3 From the Delete Confirmation popup window, do one of the following: • Click OK to delete the schedule, close the popup window, and return to the Schedules window. The schedule is removed from the list of schedules. • Click Cancel to ignore the delete request, close the popup window, and return to the Schedules window. Related Topics • Managing Global Backup Schedules, page 6-73 • Creating a Backup Schedule, page 6-73 • Associating a Global Backup Schedule with a Device, page 6-71 Copying Existing Tarred Backup Files to a Remote Server You can copy an existing back up file from disk0: to a remote server. During the global backup process, each ACE creates a tarred file containing its backup files and saves it locally on disk0:. You can use ANM to simultaneously copy these tarred files from multiple ACEs to a remote server. Note If your web browser supports the Remember Passwords option and you enable this option, the web browser may fill in the Username and Password fields for user authentication. By default, these fields should be empty. You can change the username and password fields from whatever the web browser inserts into the two fields. Procedure Step 1 Choose Config > Global > All Backups. The Backups table appears and displays a list of the available ACEs. Note To refresh the table content at any time, click Poll Now. The Backups fields are described in Table 6-13. Step 2 In the Backups table, check the checkbox of the ACE or ACEs to perform the copy function. Note To choose all of the ACEs, check the Name checkbox. Step 3 Click Copy. The Copy backup files to a remote system dialog box appears. Step 4 In the Copy backup files to a remote system dialog box, choose the backup file to copy from the selected device. 6-78 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Security with ACLs This option appears only when you have selected a specific device for the copy operation in Step 2. If you selected multiple devices in Step 2, then each device copies its latest successful backup file to the remote server. Step 5 Click the radio button of the transfer protocol to use. • FTP—File Transfer Protocol • SFTP—Secure File Transfer Protocol • TFTP—Trivial File Transfer Protocol Step 6 In the Username field, enter the username that the remote server requires for user authentication. This field appears for FTP and SFTP only. Step 7 In the Password field, enter the password that the remote server requires for user authentication. This field appears for FTP and SFTP only. Step 8 In the IP Address field, enter the IP address of the remote server. Step 9 In the Backup File Path in Remote System field, enter the full path for the remote server. Step 10 Click OK to begin the copy process. ANM copies the backup files from each device to the remote server. A popup message displays to indicate whether a copy operation was successful or failed. Related Topics • Backing Up Multiple Device Configuration and SSL Files, page 6-69 • Performing Device Backup and Restore Functions, page 6-59 Configuring Security with ACLs An access control list (ACL) consists of a series of statements called ACL entries that collectively define the network traffic profile. Each entry permits or denies network traffic (inbound and outbound) to the parts of your network specified in the entry. In addition to an action element (permit or deny), each entry also contains a filter element based on criteria such as the source address, the destination address, the protocol, or the protocol-specific parameters. An implicit “deny all” entry exists at the end of every ACL, so you must configure an ACL on every interface where you want to permit connections; otherwise, the ACE denies all traffic on the interface. ACLs provide basic security for your network by allowing you to control network connection setups rather than processing each packet. Such ACLs are commonly referred to as security ACLs. You can configure ACLs as parts of other features; for example, security, network address translation (NAT), or server load balancing (SLB). The ACE merges these individual ACLs into one large ACL called a merged ACL. The ACL compiler then parses the merged ACL and generates the ACL lookup mechanisms. A match on this merged ACL can result in multiple actions. You can add, modify, or delete entries to an ACL already in the summary table, or add a new ACL to the list. When you use ACLs, you may want to permit all email traffic on a circuit, but block FTP traffic. You can also use ACLs to allow one client to access a part of the network and prevent another client from accessing that same area. When configuring ACLs, you must apply an ACL to an interface to control traffic on that interface. Applying an ACL on an interface assigns the ACL and its entries to that interface. 6-79 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Security with ACLs You can apply only one extended ACL to each direction (inbound or outbound) of an interface. You can also apply the same ACL on multiple interfaces.You can apply EtherType ACLs in only the inbound direction and on only Layer 2 interfaces. Note By default, all traffic is denied by the ACE unless explicitly allowed. Only traffic that is explicitly allowed in an ACL can pass. All other traffic is denied. This section includes the following topics: • Creating ACLs, page 6-79 • Setting Extended ACL Attributes, page 6-82 • Resequencing Extended ACLs, page 6-87 • Setting EtherType ACL Attributes, page 6-87 • Displaying ACL Information and Statistics, page 6-89 Creating ACLs You can create an ACL. Note By default, the ACE denies all traffic unless explicitly allowed. Only traffic that is explicitly allowed in an ACL can pass. All other traffic is denied. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Security > ACLs. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > Security > ACLs. The ACLs table appears listing the existing ACLs. The ACL fields are described in Table 6-17. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. 6-80 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Security with ACLs Step 2 In the ACLs table, do one of the following: • To view full details of an ACL inline, click the plus sign to the left of any table entry. • To create an ACL, click Add. • To modify an ACL, choose the radio button to the left of any table entry, and click Edit. • To delete an ACL, choose the radio button to the left of any table entry, and click Trash. If you choose create, the New Access List window appears. If you choose modify, the Edit ACL or Edit ACL entry window appears based on the selected radio button to the left of any table entry. Table 6-17 ACLs Table Field Description Name Unique identifier for the ACL. Valid entries are unquoted text strings with a maximum of 64 alphanumeric characters. Type Identifies the following ACL attributes: • ACL type: – Extended—Allows you to specify both the source and the destination IP addresses of traffic and the protocol and the action to be taken. For more information see the “Setting Extended ACL Attributes” section on page 6-82. – EtherType—This ACL controls network access for non-IP traffic based on its EtherType. An EtherType is a subprotocol identifier. For more information, see the “Setting EtherType ACL Attributes” section on page 6-87. • (ACE module and ACE appliance software Version A5(1.0) or later only) IP address type: – IPv4—This ACL controls network access for IPv4 traffic. – IPv6—This ACL controls network access for IPv6 traffic. # ACL line number for extended type ACL entries. Action Action to be taken (permit/deny). Protocol Protocol number or service object group to apply to this ACL entry. Source Source IPv6 or IPv4 address (and source netmask with port number if configured for extended type ACL) or source network object group (if configured) that is being applied to this ACL entry. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Destination Destination IPv6 or IPv4 address (and destination netmask with port number if configured for extended type ACL) or destination network object group (if configured) that is applied to this ACL entry. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. ICMP Whether or not this ACL uses ICMP (Internet Control Message Protocol). For more information, see Table 6-20. Interface VLAN interfaces associated with this ACL. For example in24,4033:24out where “in” denotes the input direction and “out” denotes the output direction. Remark Comments for this ACL. Valid entries are unquoted text strings with a maximum of 100 characters. You can enter leading spaces at the beginning of the text or special characters. Trailing spaces are ignored. 6-81 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Security with ACLs Step 3 Add or edit required fields as described in Table 6-18. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Table 6-18 ACL Configuration Attributes Field Description ACL Properties Name Unique identifier for the ACL. Valid entries are unquoted text strings with a maximum of 64 alphanumeric characters. Type Type of ACL: • Extended—Allows you to specify both the source and the destination IP addresses of traffic, the protocol, and the action to be taken. For more information see the “Setting Extended ACL Attributes” section on page 6-82. • EtherType—This ACL controls network access for non-IP traffic based on its EtherType. An EtherType is a subprotocol identifier. For more information see the “Setting EtherType ACL Attributes” section on page 6-87. IP Address Type Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. Type of IP address: IPv4 or IPv6. Remark Comments that you want to include for this ACL. Valid entries are unquoted text strings with a maximum of 100 characters. You can enter leading spaces at the beginning of the text or special characters. Trailing spaces are ignored. ACL Entries Entry Attributes Line number, action and protocol/service object group drop-down list. For information about setting these attributes, see the “Setting Extended ACL Attributes” section on page 6-82 or the “Setting EtherType ACL Attributes” section on page 6-87. Source This field contains the following information for Extended ACLs only: Source IPv6 address and prefix length, IPv4 address with port number (if configured) and netmask, or source network object group (if configured) that is being applied to this ACL entry. For information about setting this attribute, see the “Setting Extended ACL Attributes” section on page 6-82. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Destination This field contains the following information for Extended ACLs only: Destination IPv6 address and prefix length, IPv4 address with port number (if configured) and netmask, or destination network object group (if configured) that is being applied to this ACL entry. For information about setting this attribute, see the “Setting Extended ACL Attributes” section on page 6-82. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Add To Table button Button to add multiple ACL entries, one at a time before clicking Deploy. Remove From Table button Button to remove multiple ACL entries, one at a time before clicking Deploy. • Input/Output Direction • Currently Assigned (ACL:Direction) Field that allows you to associate the ACL with one or more interfaces allowing only one input and one output ACL for each interface. The top left checkbox under the Interfaces section allows you to choose and apply to all interfaces “access-group input.” 6-82 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Security with ACLs Note To add, modify, or delete Object Groups go to the “Configuring Object Groups” section on page 6-89. Step 4 Do one of the following: • Click Deploy to deploy this newly created ACL entries along with VLAN interface assignments that were configured. • Click Cancel to exit this procedure without saving your entries and to return to the ACLs table. Related Topics • Configuring Security with ACLs, page 6-78 • Setting EtherType ACL Attributes, page 6-87 • Setting Extended ACL Attributes, page 6-82 • Resequencing Extended ACLs, page 6-87 • Editing or Deleting ACLs, page 6-100 • Displaying ACL Information and Statistics, page 6-89 Setting Extended ACL Attributes You can configure extended ACL attributes that allows you to specify both the source and the destination IP addresses of traffic and the protocol and the action to be taken. For TCP, UDP, and ICMP connections, you do not need to also apply an ACL on the destination interface to allow returning traffic, because the ACE allows all returning traffic for established connections. Note By default, all traffic is denied by the ACE unless explicitly allowed. Only traffic that is explicitly allowed in an ACL can pass. All other traffic is denied. Note The ACE does not explicitly support standard ACLs. To configure a standard ACL, specify the destination address as any and do not specify the ports in an extended ACL. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Security > ACLs. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > Security > ACLs. The ACLs table appears, listing the existing ACLs. Step 2 In the ACLs table, click Add. The New Access List configuration window appears. Step 3 Click Add to add an entry to the table, or choose an existing entry and click Edit to modify it. 6-83 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Security with ACLs Step 4 In the ACL Properties pane, do the following: a. Enter the ACL name. b. For the ACL type, choose Extended. c. For the IP address type, choose either IPv4 or IPv6. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. d. (Optional) In the Remark text box, enter comments that you want to include for this ACL. Valid entries are unquoted text strings with a maximum of 100 characters. You can enter leading spaces at the beginning of the text or special characters. Trailing spaces are ignored. Step 5 Configure extended ACL entries using the information in Table 6-19. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Table 6-19 Extended ACL Configuration Options Field Description Entry Attributes Line Number Number that specifies the position of this entry in the ACL. The position of an entry affects the lookup order of the entries in an ACL. To change the sequence of existing extended ACLs, see the “Resequencing Extended ACLs” section on page 6-87. Action Action to be taken: Permit or Deny. Service Object Group Option that is not applicable to ACE modules running 3.0(0)A1(x) and ACE 4710 appliances running image A1(x). Choose a service object group to apply to this ACL. Protocol Protocol or protocol number to apply to this ACL entry. Table 6-20 lists common protocol names and numbers. ICMP Type This field appears only when the selected protocol type is ICMP. Choose the ICMP type. Table 6-23 lists common ICMP types and numbers. Table 6-24 lists common ICMPv6 types and numbers. ICMP Message Code Operator This field appears only when the selected protocol type is ICMP. Choose one of the following operands to use when comparing message codes for this service object: • Equal To—The message code must be the same as the number in the Message Code field. • Greater Than—The message code must be greater than the number in the Message Code field. • Less Than—The message code must be less than the number in the Message Code field. • Not Equal To—The message code must not equal the number in the Message Code field. • Range—The message code must be within the range of codes specified by the Min. Message Code field and the Max. Message Code field. ICMP Message Code This field appears only when the selected protocol type is ICMP and the ICMP Message Code Operator is set to one of the following: Equal To, Greater Than, Less Than, or Not Equal To. Enter the ICMP message code for this service object. 6-84 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Security with ACLs ICMP Min. Message Code These fields appear only when the selected protocol type is ICMP and the ICMP Message Code Operator is set to Range. Enter the beginning and ending value for a range of services for this service object. Valid entries are integers from 0 to 255. The minimum value must be less that the maximum value. ICMP Max. Message Code Source Source Network Network traffic being received from the source network to the ACE: • Any—Choose the Any radio button to indicate that network traffic from any source is allowed. • IP/Netmask—(IPv4 address type) Use this field to limit access to a specific source IP address. Enter the source IP address that is allowed for this ACL. Enter a specific source IP address and choose its subnet mask. • IP/Prefix-length—(IPv6 address type) Use this field to limit access to a specific source IP address. Enter the source IPv6 address that is allowed for this ACL and its prefix length. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. • Network Object Group—Choose a source network object group to apply to this ACL. Note This option is not applicable to ACE modules running release 3.0(0)A1(x) and ACE 4710 appliances running release A1(x). Source Port Operator Field that appears if you choose TCP or UPD in the Protocol field. Choose the operand to use to compare source port numbers: • Equal To—The source port must be the same as the number in the Source Port Number field. • Greater Than—The source port must be greater than the number in the Source Port Number field. • Less Than—The source port must be less than the number in the Source Port Number field. • Not Equal To—The source port must not equal the number in the Source Port Number field. • Range—The source port must be within the range of ports specified by the Lower Source Port Number field and the Upper Source Port Number field. Source Port Number Field that appears if you choose one of the following the Source Port Operator field: Equal To, Greater Than, Less Than, or Not Equal To. Enter the port name or number from which you want to permit or deny access. For a list of ports, see the “ANM Ports Reference” section on page A-1. Lower Source Port Number Field that appears if you choose Range in the Source Port Operator field. Enter the number of the lowest port from which you want to permit or deny access. Valid entries are from 0 to 65535. The number in this field must be less than the number entered in the Upper Source Port Number field. Upper Source Port Number Field that appears if you choose Range in the Source Port Operator field. Enter the port number of the upper port from which you want to permit or deny access. Valid entries are from 0 to 65535. The number in this field must be greater than the number entered in the Lower Source Port Number field. Table 6-19 Extended ACL Configuration Options (continued) Field Description 6-85 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Security with ACLs Destination Destination Network Network traffic being transmitted to the destination network from the ACE: • Any—Choose the Any radio button to indicate that network traffic to any destination is allowed. • IP/Netmask—(IPv4 address type) Use this field to limit access to a specific destination IP address. Enter the source IP address that is allowed for this ACL. Enter a specific destination IP address and choose its subnet mask. • IP/Prefix-length—(IPv6 address type) Use this field to limit access to a specific destination IP address. Enter the destination IPv6 address that is allowed for this ACL and its prefix length. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. • Network Object Group—Choose a destination network object group to apply to this ACL. Note This option is not applicable to ACE modules running release 3.0(0)A1(x) and ACE 4710 appliances running release A1(x). Destination Port Operator Field that appears if you choose TCP or UPD in the Protocol field. Choose the operand to use to compare destination port numbers: • Equal To—The destination port must be the same as the number in the Destination Port Number field. • Greater Than—The destination port must be greater than the number in the Destination Port Number field. • Less Than—The destination port must be less than the number in the Destination Port Number field. • Not Equal To—The destination port must not equal the number in the Destination Port Number field. • Range—The destination port must be within the range of ports specified by the Lower Destination Port Number field and the Upper Destination Port Number field. Destination Port Number Field that appears if you choose one of the following in the Destination Port Operator field: Equal To, Greater Than, Less Than, or Not Equal To. Enter the port name or number from which you want to permit or deny access. For a list of ports and keywords, see the “ANM Ports Reference” section on page A-1. Lower Destination Port Number Field that appears if you choose Range in the Destination Port Operator field. Enter the number of the lowest port to which you want to permit or deny access. Valid entries are from 0 to 65535. The number in this field must be less than the number entered in the Upper Destination Port Number field. Upper Destination Port Number Field that appears if you choose Range in the Destination Port Operator field. Enter the port number of the upper port to which you want to permit or deny access. Valid entries are from 0 to 65535. The number in this field must be greater than the number entered in the Lower Destination Port Number field. Table 6-19 Extended ACL Configuration Options (continued) Field Description 6-86 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Security with ACLs Step 6 In the Extended configuration pane, do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click OK to save your entries. This option appears for configuration building blocks. • Click Cancel to exit without saving your entries and to return to the Extended table. • Click Next to deploy your entries and to add another entry to the Extended table. Step 7 (Optional) Associate any VLAN interface to this ACL if required and do one of the following: • Click Deploy to immediately deploy this configuration. • Click Cancel to exit without saving your entries and to return to the ACL Summary table. Related Topics • Configuring Security with ACLs, page 6-78 • Creating ACLs, page 6-79 • Setting EtherType ACL Attributes, page 6-87 • Resequencing Extended ACLs, page 6-87 • Editing or Deleting ACLs, page 6-100 • Displaying ACL Information and Statistics, page 6-89 Table 6-20 Protocol Names and Numbers Protocol Name1 1. For a complete list of all protocols and their numbers, see the Internet Assigned Numbers Authority available at www.iana.org/numbers/ Protocol Number Description AH 51 Authentication Header EIGRP 88 Enhanced IGRP ESP 50 Encapsulated Security Payload GRE 47 Generic Routing Encapsulation ICMP 1 Internet Control Message Protocol ICMPv62 2. ICMPv6 is not available for an IPv4 service object group. 58 Internet Control Message Protocol version 6 IGMP 2 Internet Group Management Protocol IP 0 Internet Protocol IP-In-IP 4 IP-In-IP Layer 3 Tunneling Protocol OSPF 89 Open Shortest Path First PIM 103 Protocol Independent Multicast TCP 6 Transmission Control Protocol UDP 17 User Datagram Protocol 6-87 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Security with ACLs Resequencing Extended ACLs You can change the sequence of entries in an Extended ACL. Note EtherType ACL entries cannot be resequenced. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Security > ACLs. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > Security > ACLs. The ACLs table appears, listing the existing ACLs. Step 2 In the ACLs table, choose the Extended ACL that you want to renumber, and click the Resequence icon that appears to the left of the filter field. The ACL Line Number Resequence window appears. Step 3 In the Start field of the ACL Line Number Resequence window, enter the number that is to be assigned to the first entry in the ACL. Valid entries are from 1 to 2147483647. Step 4 In the Increment field, enter the number that is to be added to each entry in the ACL after the first entry. Valid entries are from 1 to 2147483647. Step 5 Do one of the following: • Click Resequence to save your entries and to return to the ACLs table. • Click Cancel to exit this procedure without saving your entries and to return to the ACLs table. Related Topics • Configuring Security with ACLs, page 6-78 • Creating ACLs, page 6-79 • Setting EtherType ACL Attributes, page 6-87 • Setting Extended ACL Attributes, page 6-82 • Editing or Deleting ACLs, page 6-100 • Displaying ACL Information and Statistics, page 6-89 Setting EtherType ACL Attributes You can configure an ACL that controls traffic based on its EtherType, which is a subprotocol identifier. EtherType ACLs support Ethernet V2 frames. EtherType ACLs do not support 802.3-formatted frames because they use a length field instead of a type field. The only exception is a bridge protocol data units (BPDU), which is SNAP encapsulated. The ACE is designed to handle BPDUs. 6-88 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Security with ACLs Note By default, all traffic is denied by the ACE unless explicitly allowed. Only traffic that is explicitly allowed in an ACL can pass. All other traffic is denied. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Security > ACLs. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > Security > ACLs. The ACLs table appears, listing the existing ACLs. Step 2 In the ACLs table, click Add. The New Access List configuration window appears. Step 3 In the ACL Properties pane, do the following: a. In the Name text box, enter the ACL name. b. For the Type, choose Ethertype. c. For the IP Address Type, choose IPv4. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. Note You cannot use IPv6 with an Ethertype ACL. Step 4 Choose one of the following radio buttons: • Deny to indicate that the ACE is to block connections. • Permit to indicate that the ACE is to allow connections. Step 5 In the Protocol field, choose one of the following the drop-down list for this ACL: • Any—Specifies any EtherType. • BPDU—Specifies bridge protocol data units. The ACE receives trunk port (Cisco proprietary) BPDUs because ACE ports are trunk ports. Trunk BPDUs have VLAN information inside the payload, so the ACE modifies the payload with the outgoing VLAN if you allow BPDUs. If you configure redundancy, you must allow BPDUs on both interfaces with an EtherType ACL to avoid bridging loops. For information about configuring redundancy, see the “Understanding ACE Redundancy” section on page 13-6. • IPv6—Specifies Internet Protocol version 6. • MPLS—Specifies Multi-Protocol Label Switching. The MPLS selection applies to both MPLS unicast and MPLS multicast traffic. If you allow MPLS, ensure that Label Distribution Protocol (LDP) and Tag Distribution Protocol (TDP) TCP connections are established through the ACE by configuring both MPLS routers connected to the ACE to use the IP address on the ACE interface as the router-id for LDP or TDP sessions. LDP and TDP allow MPLS routers to negotiate the labels (addresses) used to forward packets. Step 6 Click Add to Table and add one or more ACL entries if required repeating Steps 4 and 5 as needed. Step 7 (Optional) Associate any VLAN interface to this ACL if required and do one of the following: • Click Deploy to immediately deploy this configuration. This option appears for virtual contexts. 6-89 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Object Groups • Click Cancel to exit without saving your entries and to return to the ACL Summary table. Related Topics • Configuring Security with ACLs, page 6-78 • Creating ACLs, page 6-79 • Setting Extended ACL Attributes, page 6-82 • Resequencing Extended ACLs, page 6-87 • Editing or Deleting ACLs, page 6-100 • Displaying ACL Information and Statistics, page 6-89 Displaying ACL Information and Statistics You can display information and statistics for a particular ACL by using the Details button. Procedure Step 1 Choose Config > Devices > context > Security > ACLs. The ACLs table appears listing the existing ACLs. Step 2 In the ACLs table, choose an ACL, and click Details. The show access-list access-list detail CLI command output appears. For details about the displayed output fields, see either the Cisco ACE Module Security Configuration Guide or the Cisco ACE 4700 Series Appliance Security Configuration Guide, Chapter 1, “Configuring Security Access Control Lists.” Step 3 Click Update Details to refresh the output for the show access-list access-list detail CLI command. Step 4 Click Close to return to the ACLs table. Related Topics • Configuring Security with ACLs, page 6-78 • Creating ACLs, page 6-79 • Setting Extended ACL Attributes, page 6-82 • Resequencing Extended ACLs, page 6-87 • Editing or Deleting ACLs, page 6-100 Configuring Object Groups You can configure object groups that you can associate with ACLs. An object group is a logical grouping of objects such as hosts (servers and clients), services, and networks. When you create an object group, you choose a type, such as network or service, and then specify the objects that belong to the groups. In all, there are four types of object groups: Network, protocol, service, and ICMP-type. After you configure an object group, you can include it in ACLs, thereby including all objects within that group and reducing overall configuration size. 6-90 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Object Groups This section includes the following topics: • Creating or Editing an Object Group, page 6-90 • Configuring IP Addresses for Object Groups, page 6-91 • Configuring Subnet Objects for Object Groups, page 6-92 • Configuring Protocols for Object Groups, page 6-93 • Configuring TCP/UDP Service Parameters for Object Groups, page 6-94 • Configuring ICMP Service Parameters for an Object Group, page 6-97 Creating or Editing an Object Group You can create a object group or edit an existing one. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Security > Object Groups. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > Security > Object Groups. Note Object groups are available for only ACE modules and ACE module configuration building blocks. The Object Groups table appears, listing existing object groups. Step 2 In the Object Groups table, click Add to create a new object group, or choose an existing object group, and click Edit to modify it. The Object Groups configuration window appears. Note The object group definition attributes for Protocol Selection and Service Parameter cannot be edited once defined for an object group. To edit these values, delete the object group definition and then add it again with the desired settings. Step 3 In the Name field of the Object Groups configuration window, enter a unique name for this object group. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Step 4 In the Description field, enter a brief description for the object group. Step 5 In the Type field, choose the type of object group that you are creating: • Network—The object group is based on a group of hosts or subnet IP addresses. • Service—The object group is based on TCP or UDP protocols and ports, or ICMP types, such as echo or echo-reply. Step 6 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click OK to save your entries. This option appears for configuration building blocks. 6-91 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Object Groups • Click Cancel to exit without saving your entries and to return to the Object Groups table. • Click Next to deploy your entries and to add another entry to the Object Groups table. If you click Deploy Now or OK, the window refreshes with tables additional configuration options. Step 7 Configure objects for the object group as follows: • For network-type object groups, options include: – Configuring IP Addresses for Object Groups, page 6-91 – Configuring Subnet Objects for Object Groups, page 6-92 • For service-type object groups, options include: – Configuring Protocols for Object Groups, page 6-93 – Configuring TCP/UDP Service Parameters for Object Groups, page 6-94 – Configuring ICMP Service Parameters for an Object Group, page 6-97 Configuring IP Addresses for Object Groups You can specify host IP addresses for network-type object groups. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Security > Object Groups. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > Security > Object Groups. The Object Groups table appears, listing the existing object groups. Step 2 In the Object Groups table, choose the object group that you want to configure host IP addresses for, and click the Host Setting For Object Group tab. The Host Setting for Object Group table appears. Step 3 In the Host Setting for Object Group table, click Add to add an entry to this table. Step 4 Enter the host IP address as follows: • For ACE module sand ACE appliances using a software version earlier than A5(1.0), enter the IPv4 address of a host to include in this group. • For ACE module sand ACE appliances using software Version A5(1.0) or later, choose either of the following IP address types: – IPv4—A host with an IPv4 IP address. In the IPv4 Address field, enter the IP address of a host to include in this group. – IPv6—A host with an IPv6 IP address. In the IPv6 Address field, enter the IP address of a host to include in this group. 6-92 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Object Groups Step 5 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click OK to save your entries. This option appears for configuration building blocks. • Click Cancel to exit this procedure without saving your entries. • Click Next to deploy your entries and to add another entry to the Host Setting table. Related Topics • Configuring Object Groups, page 6-89 • Configuring Subnet Objects for Object Groups, page 6-92 • Configuring Protocols for Object Groups, page 6-93 • Configuring TCP/UDP Service Parameters for Object Groups, page 6-94 • Configuring ICMP Service Parameters for an Object Group, page 6-97 Configuring Subnet Objects for Object Groups You can specify subnet objects for a network-type object group. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Security > Object Groups. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > Security > Object Groups. The Object Groups table appears, listing the existing object groups. Step 2 In the Object Groups table, choose the object group that you want to configure subnet objects for, and click the Network Setting For Object Group tab. The Network Setting for Object Group table appears. Step 3 Click Add to add an entry to this table. Step 4 Enter the subnet object IP address as follows: • For ACE module sand ACE appliances using a software version earlier than A5(1.0), enter an IPv4 address that, with the subnet mask, defines the subnet object. • For ACE module sand ACE appliances using software Version A5(1.0) or later, in the IP Address Type field, choose one of the following: – IPv4—A subnet object with an IPv4 IP address. – IPv6—A object with an IPv6 IP address. In the IPv6 Address field, enter the IP address. Step 5 Depending on the IP address type that you chose, do one of the following: 6-93 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Object Groups • For IPv4, in the IPv4 Address field, enter the IP address. In the Netmask field, select the subnet mask for this subnet object. • For IPv6, in the IPv6 Address field, enter the IP address. In the Network Prefix Length field, enter the prefix length for this object. Step 6 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click OK to save your entries. This option appears for configuration building blocks. • Click Cancel to exit this procedure without saving your entries. • Click Next to deploy your entries and to add another entry to the Network Setting table. Related Topics • Configuring Object Groups, page 6-89 • Configuring IP Addresses for Object Groups, page 6-91 • Configuring Protocols for Object Groups, page 6-93 • Configuring TCP/UDP Service Parameters for Object Groups, page 6-94 • Configuring ICMP Service Parameters for an Object Group, page 6-97 Configuring Protocols for Object Groups You can specify protocols for a service-type object group. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Security > Object Groups. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > Security > Object Groups. The Object Groups table appears, listing the existing object groups. Step 2 In the Object Groups table, choose an existing service-type object group, and click the Protocol Selection tab. The Protocol Selection table appears. Step 3 In the Protocol Selection table, click Add to add an entry to this table. Step 4 In the Protocol Number field, choose the protocol or protocol number to add to this object group. See Table 6-20 for common protocols and their numbers. Step 5 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click OK to save your entries. This option appears for configuration building blocks. • Click Cancel to exit this procedure without saving your entries. 6-94 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Object Groups • Click Next to deploy your entries and to add another entry to the Protocol Selection table. Related Topics • Configuring Object Groups, page 6-89 • Configuring IP Addresses for Object Groups, page 6-91 • Configuring Subnet Objects for Object Groups, page 6-92 • Configuring TCP/UDP Service Parameters for Object Groups, page 6-94 • Configuring ICMP Service Parameters for an Object Group, page 6-97 Configuring TCP/UDP Service Parameters for Object Groups You can add TCP or UDP service objects to a service-type object group. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Security > Object Groups. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > Security > Object Groups. The Object Groups table appears, listing the existing object groups. Step 2 In the Object Groups table, choose an existing service-type object group, and click the TCP/UDP Service Parameters tab. The TCP/UDP Service Parameters table appears. Step 3 Click Add to add an entry to this table. Step 4 Configure TCP or UDP service objects using the information in Table 6-21. Table 6-21 TCP and UDP Service Parameters Field Description Protocol Protocol for this service object: • TCP—TCP is the protocol for this service object. • TCP And UDP—Both TCP and UDP are the protocols for this service object. • UDP—UDP is the protocol for this service object. Source Port Operator Operand to use when comparing source port numbers for this service object: • Equal To—The source port must be the same as the number in the Source Port field. • Greater Than—The source port must be greater than the number in the Source Port field. • Less Than—The source port must be less than the number in the Source Port field. • Not Equal To—The source port must not equal the number in the Source Port field. • Range—The source port must be within the range of ports specified by the Lower Source Port field and the Upper Source Port field. 6-95 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Object Groups Step 5 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click OK to save your entries. This option appears for configuration building blocks. • Click Cancel to exit this procedure without saving your entries. • Click Next to deploy your entries and to add another entry to the TCP/UDP Service Parameters table. Source Port Field that appears if you choose Equal To, Greater Than, Less Than, or Not Equal To in the Source Port Operator field. Enter the source port name or number for this service object. Lower Source Port Field that appears if you choose Range in the Source Port Operator field. Enter the number that is the beginning value for a range of services for this service object. Valid entries are from 0 to 65535. The number in this field must be less than the number entered in the Upper Source Port field. Upper Source Port Field that appears if you choose Range in the Source Port Operator field. Enter the number that is the ending value for a range of services for this service object. Valid entries are from 0 to 65535. The number in this field must be greater than the number entered in the Lower Source Port field. Destination Port Operator Operand to use when comparing destination port numbers: • Equal To—The destination port must be the same as the number in the Destination Port field. • Greater Than—The destination port must be greater than the number in the Destination Port field. • Less Than—The destination port must be less than the number in the Destination Port field. • Not Equal To—The destination port must not equal the number in the Destination Port field. • Range—The destination port must be within the range of ports specified by the Lower Destination Port field and the Upper Destination Port field. Destination Port Field that appears if you choose Equal To, Greater Than, Less Than, or Not Equal To in the Destination Port Operator field. Enter the destination port name or number for this service object. Lower Destination Port Field that appears if you choose Range in the Destination Port Operator field. Enter the number that is the beginning value for a range of services for this service object. Valid entries are from 0 to 65535. The number in this field must be less than the number entered in the Upper Destination Port field. Upper Destination Port Field that appears if you choose Range in the Destination Port Operator field. Enter the number that is the ending value for a range of services for this service object. Valid entries are from 0 to 65535. The number in this field must be greater than the number entered in the Lower Destination Port field. Table 6-21 TCP and UDP Service Parameters (continued) Field Description 6-96 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Object Groups Related Topics • Configuring Object Groups, page 6-89 • Configuring IP Addresses for Object Groups, page 6-91 • Configuring Subnet Objects for Object Groups, page 6-92 • Configuring Protocols for Object Groups, page 6-93 • Configuring ICMP Service Parameters for an Object Group, page 6-97 6-97 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Object Groups Configuring ICMP Service Parameters for an Object Group You can add ICMP service parameters to a service-type object group. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > Security > Object Groups. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > Security > Object Groups. The Object Groups table appears, listing the existing object groups. Step 2 In the Object Groups table, choose an existing service-type object group, and click the ICMP Service Parameters tab. The ICMP Service Parameters table appears. Step 3 Click Add to add an entry to this table. Step 4 Configure ICMP type objects using the information in Table 6-22. Table 6-22 ICMP Type Service Parameters Field Description ICMP Version Field that appears for ACE module and ACE appliance software Version A5(1.0) or later. Internet Control Message Protocol (ICMP) version. Choose one of the following radio buttons: • ICMP—ICMP for Internet Protocol version 4 (IPv4). • ICMPv6—ICMP version 6 (ICMPv6) for Internet Protocol version 6 (IPv6). ICMP Type ICMP type or number for this service object. Table 6-23 lists common ICMP types and numbers. Table 6-24 lists the ICMPv6 types and numbers. Message Code Operator Operand to use when comparing message codes for this service object: • Equal To—The message code must be the same as the number in the Message Code field. • Greater Than—The message code must be greater than the number in the Message Code field. • Less Than—The message code must be less than the number in the Message Code field. • Not Equal To—The message code must not equal the number in the Message Code field. • Range—The message code must be within the range of codes specified by the Min Message Code field and the Max. Message Code field. Message Code Field that appears if you choose one of the following in the Message Code Operator field: Equal To, Greater Than, Less Than, or Not Equal To. Enter the ICMP message code for this service object. 6-98 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Object Groups Min. Message Code Field that appears if you choose Range in the Message Code Operator field. Enter the number that is the beginning value for a range of services for this service object. Valid entries are from 0 to 255. The number in this field must be less than the number entered in the Max Message Code field. Max. Message Code Field that appears if you choose Range in the Message Code Operator field. Enter the number that is the ending value for a range of services for this service object. Valid entries are from 0 to 255. The number in this field must be greater than the number entered in the Min. Message Code field. Table 6-23 ICMP Type Numbers and Names Number ICMP Type Name 0 Echo-Reply 3 Unreachable 4 Source-Quench 5 Redirect 6 Alternate-Address 8 Echo 9 Router-Advertisement 10 Router-Solicitation 11 Time-Exceeded 12 Parameter-Problem 13 Timestamp-Request 14 Timestamp-Reply 15 Information-Request 16 Information-Reply 17 Address-Mask-Request 18 Address-Mask-Reply 31 Conversion-Error 32 Mobile-Redirect Table 6-24 ICMPv6 Type Numbers and Names Number ICMPv6 Type Name 128 Echo 129 Echo-Reply 140 Information-Reply 139 Information-Request Table 6-22 ICMP Type Service Parameters (continued) Field Description 6-99 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing ACLs Step 5 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click OK to save your entries. This option appears for configuration building blocks. • Click Cancel to exit this procedure without saving your entries. • Click Next to deploy your entries and to add another entry to the ICMP Service Parameters table. Related Topics • Configuring Object Groups, page 6-89 • Configuring IP Addresses for Object Groups, page 6-91 • Configuring Subnet Objects for Object Groups, page 6-92 • Configuring Protocols for Object Groups, page 6-93 • Configuring TCP/UDP Service Parameters for Object Groups, page 6-94 Managing ACLs This section describes how to manage ACLs. This section includes the following topics: • Viewing All ACLs by Context, page 6-99. • Editing or Deleting ACLs, page 6-100. Viewing All ACLs by Context You can display ACLs that have been configured. Procedure Step 1 Choose Config > Devices. The device tree appears. Step 2 In the device tree, choose the virtual context with the ACLs that you want to view, and choose Security > ACLs. 4 Parameter-Problem 137 Redirect 3 Time-Exceeded 30 Traceroute 1 Unreachable Table 6-24 ICMPv6 Type Numbers and Names (continued) Number ICMPv6 Type Name 6-100 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing ACLs The ACLs table appears, listing the existing ACLs in that context with their name, their type (Extended or EtherType), and all details (such as Action, Protocol, Interface information). Step 3 To display all of the ACLs for a given table entry, click the plus sign to the left of that entry. Step 4 To display all of the ACLs for all of the entries, click Expand All on the Add/Edit/Delete row. Step 5 To collapse all of the ACLs for all of the entries, click Collapse All on the Add/Edit/Delete row. Related Topics • Configuring Security with ACLs, page 6-78 • Creating ACLs, page 6-79 • Setting EtherType ACL Attributes, page 6-87 • Setting Extended ACL Attributes, page 6-82 • Editing or Deleting ACLs, page 6-100 Editing or Deleting ACLs You can delete or edit an ACL or any of its subentries. Considerations • You cannot mix IPv6 and IPv4 access-list entries in the same ACL. Note IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. • Before you change the IP address type (IPv4/IPv6) for an existing ACL, you must remove the entries that are not applicable to the new IP address type. • If you change the ACL protocol, the ACE removes all of the existing settings for the ACL. Procedure Step 1 Choose the item to edit or delete as follows: • Choose Config > Devices > context > Security > ACLs. • Choose Config > Global > All Building Blocks > building_block > Security > ACLs. The ACLs table appears, listing the existing ACLs. Step 2 In the ACLs table, choose the radio button to the left of the ACL that you want to Edit or Delete. Expand entries if necessary by clicking the plus sign to the left of any ACL entry until you see the subentry ACL for which you are looking, or click the Expand All icon to view all ACLs and subentries. Step 3 Do one of the following: • If you are editing an ACL or one of its entries, click Edit and go to Step 4. • If you are deleting an ACL or one of its entries, click Delete and go to Step 5. Step 4 Edit the entry using the summary information listed in Table 6-18 if needed, and click Deploy when done. 6-101 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Configuring Virtual Context Expert Options Step 5 Click Delete. A confirmation popup window appears asking you to confirm the deletion. If you click OK, the ACLs table refreshes without the deleted ACL. Related Topics • Creating ACLs, page 6-79 • Setting EtherType ACL Attributes, page 6-87 • Setting Extended ACL Attributes, page 6-82 • Resequencing Extended ACLs, page 6-87 Configuring Virtual Context Expert Options The ANM virtual context Expert configuration options allow you to do the following: • Establish traffic policies for virtual servers by classifying types of network traffic and then applying the appropriate rules and actions for handling the traffic. See the “Configuring Traffic Policies” section on page 14-1. • Compare a virtual context configuration with a tagged configuration building block that has been applied to the context. See the “Comparing Context and Building Block Configurations” section on page 6-101. • For ACE modules and ACE appliances, configure HTTP header modify action lists. See the “Configuring an HTTP Header Modify Action List” section on page 14-85. • For ACE appliances, configure optimization action lists. See the “Configuring an HTTP Optimization Action List” section on page 15-3. Comparing Context and Building Block Configurations ANM allows you to compare the current configuration of a virtual context that has had a tagged configuration building block applied to it with the settings of the applied building block. Discrepancies between these configurations can occur when you configure the virtual context after applying the building block instead of modifying and tagging the building block, then applying the updated building block to the virtual context. The ANM auditing process identifies the discrepancies by configuration category (such as policy maps or SNMP) and groups them accordingly. You can identify discrepancies between an ANM tagged building block and a virtual context that previously had the building block applied to it. Assumption The virtual context has had a tagged building block applied to it. Procedure Step 1 Choose Config > Devices > context > Expert > Building Block Audit. 6-102 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Comparing Context and Building Block Configurations The Building Block Audit window appears with the Comparison Results table, listing any discrepancies between the configurations. Step 2 In the Building Block Audit window, identify the discrepancies as follows: • Click All at the top of the results tree. The Comparison Results table displays all discrepancies. The values that follow the word All, such as 2c 5d 3a, indicate differences between the virtual context configuration and the building block configuration. These values use the format n where n represents the number of differences between the configurations and represents the type of difference. The possible results are as follows: – nc (changed) indicates the number of items with settings that have changed or differ from the settings in the building block. For example, 2c indicates that two configuration options in the context currently have different settings or values than those settings or values in the applied building block. – nd (deleted) indicates the number of items that were in the applied building block that do not exist in the current context configuration. For example, 5d indicates that five configuration options that were in the applied building block do not exist in the current context configuration. – na (added) indicates the number of items that are in the current context configuration that were not in the applied building block. For example, 3a indicates that three configuration options that were not in the applied building block have been added to the context configuration. • Click a folder in the results tree. The Comparison Results table displays the discrepancies for that configuration category, such as SNMP or class maps. • Click an item within a folder. The Comparison Results table displays the differences for that specific attribute. Step 3 In the Comparison Results table, when viewing results, you can do one of the following: • Filter the results by entering a complete or partial string in one or more of the input fields at the top of the columns, then clicking Go. • Sort the results in ascending or descending order by clicking a column heading. Related Topics • Configuring Virtual Contexts, page 6-8 • Managing Virtual Contexts, page 6-103 • Using Configuration Building Blocks, page 16-1 6-103 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing Virtual Contexts Managing Virtual Contexts You can perform the following administrative actions on virtual contexts. This section includes the following topics: • Displaying All Virtual Contexts, page 6-103 • Synchronizing Virtual Context Configurations, page 6-105 • Managing Syslog Settings for Autosynchronization, page 6-105 • Editing Virtual Contexts, page 6-106 • Deleting Virtual Contexts, page 6-107 • Upgrading Virtual Contexts, page 6-107 • Restarting Virtual Context Polling, page 6-108 • Comparing Context and Building Block Configurations, page 6-101 Displaying All Virtual Contexts You can display some or all virtual contexts being managed by ANM. Procedure Step 1 Choose Config > Devices > All VC. The All Virtual Contexts table appears with the information described in Table 6-25. Table 6-25 All Virtual Contexts Table Field Description Name Context name including chassis and slot. Resource Class Resource class applied to the context. Management IPs List of IP addresses used for remote management of the context. Building Block Configuration building block applied to the context. CLI Sync Status Administrative configuration status of the context as follows: • Import Failed—The context did not import successfully. This problem could have occurred when the device was added to ANM or when the context was synchronized. Synchronize the context so that you can manage it (Config > Devices > ACE > context > Sync). • OK—The context is synchronized with the ACE CLI. • Out of Sync—The context is managed by the ANM but the configuration for the context on the device differs from the configuration managed by the ANM. For information on synchronizing contexts, see the “Synchronizing Virtual Context Configurations” section on page 6-105. • Unprovisioned—The context has been removed from the ACE using the CLI but has not been removed from ANM. To remove unprovisioned contexts, synchronize the associated Admin context. Last CLI Sync Status Change Time stamp of the last CLI synchronization with ANM. 6-104 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing Virtual Contexts Step 2 Use the object selector to view all virtual contexts or only those contexts on a specific device. Related Topics • Restarting Virtual Context Polling, page 6-108 • Enabling Polling on All Devices, page 17-47 • Synchronizing Virtual Context Configurations, page 6-105 ACE HA State High availability state of the context. If the context is configured for high availability, the current state of the context with regard to high availability: • Active—The context is actively processing flows for the HA pair. • Standby Cold—Either the fault-tolerant VLAN is down, but the peer ACE is still alive, or the configuration or application state synchronization failed. • Standby Bulk—The context is waiting to receive information from its active peer context. • Standby Hot—The context has all the state information that it needs to statefully assume the active state if a switchover occurs. • Standby Warm—Allows the configuration and state synchronization process to continue on a best-effort basis when you upgrade or downgrade the ACE software. ACE HA Peer Identifier of the ACE high availability peer. ACE HA Peer State Current state of the context with regard to high availability on the ACE peer. See the states listed for the ACE HA State field. Polling Status Current polling status of the context: • Missing SNMP Credentials—SNMP credentials are not configured for this virtual context; statistics are not collected. Add SNMPv2c credentials to fix this error. • Not Polled—SNMP polling has not started. This problem might occur when the virtual context is first created from ANM and the SNMP credentials are not configured. Add SNMPv2c credentials to fix this error. • Not Supported—This status appears at the device level only and applies to Catalyst 6500 series chassis, Cisco 7600 series routers, and ACE appliances. • Polling Failed—SNMP polling failed due to some internal error. Try restarting polling to enable SNMP collection again. • Polling Started—No action is required. Everything is working properly. Polling states will display activity. • Polling Timed Out—SNMP polling has timed out. This problem might occur if the wrong credentials were configured or might be caused by an internal error (such as SNMP was configured incorrectly or the destination is not reachable). Verify that SNMP credentials are correct. If the problem persists, restart polling to enable SNMP collection again. • Unknown—SNMP polling is not working due to one of the above-mentioned conditions. Check the SNMPv2c credential configuration. Table 6-25 All Virtual Contexts Table (continued) Field Description 6-105 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing Virtual Contexts Synchronizing Virtual Context Configurations You can synchronize the configurations for a virtual context. ANM allows you to synchronize the configuration information residing on an ACE with the configuration information maintained by the ANM server for the same device. When ANM synchronizes a context, it uploads the configuration from the device to the ANM server. In accordance with your role-based permission level, the ANM Status bar displays the number of virtual contexts that are not synchronized with the ACE CLI against the total number of virtual contexts and the number of failed synchronization attempts. You should synchronize contexts for the following reasons: • You configure the ACE directly via the CLI instead of using the ANM interface. The CLI Sync Status is Out of Sync in the Virtual Contexts table (Config > Devices > ACE) if the configurations for a virtual context differ. • A context has been removed from the ACE using the CLI, reflected by the CLI Sync Status Unprovisioned in the Virtual Contexts table. In this situation, you need to synchronize the Admin context to remove the unprovisioned context. • A context has not successfully been imported into ANM during discovery or a Sync operation, reflected by the CLI Sync Status Import Failed in the Virtual Contexts table. In this situation, you need to synchronize the context before you can modify its configuration. • You recently installed or uninstalled a license on an ACE using either ANM or the CLI. Synchronize the Admin context of the ACE with the CLI. Procedure Step 1 Choose Config > Devices. The device tree appears. Step 2 In the device tree, choose either All VC or the ACE with the virtual context configuration that you want to synchronize. The Virtual Contexts table appears. Step 3 In the Virtual Contexts table, choose the virtual context with the configuration that you want to synchronize, and click CLI Sync. The verification popup window appears, asking you to verify the synchronization request. Step 4 In the verification popup window, click Yes. Synchronization begins and the Virtual Contexts table refreshes when synchronization is complete. Related Topics • Configuring Auto Sync Settings, page 18-61 • Editing Virtual Contexts, page 6-106 • Restarting Virtual Context Polling, page 6-108 • Comparing Context and Building Block Configurations, page 6-101 Managing Syslog Settings for Autosynchronization You can configure ANM to receive syslog messages for a virtual context. 6-106 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing Virtual Contexts Setting autosynchronization to occur upon receipt of a device syslog message allows a faster, more streamlined synchronization process between ANM and any out-of-band configuration changes. Instead of waiting the default polling period, ANM will synchronize when a syslog message is received if Setup Syslog for Autosync is enabled. Procedure Step 1 Choose Config > Devices > Virtual Context Management> Setup Syslog for Autosync. The Setup Syslog for Autosync window appears. Step 2 In the Setup Syslog for Autosync window, choose either All VC or the ACE with the virtual context configuration that you want to receive Autosync syslog messages Step 3 Click Setup Syslog. A progress bar window appears. A checkbox with a checkmark appears in the Setup Syslog for Autosync? column for each virtual context and ACE device you checked. Step 4 Click the Setup Syslog button. The following CLI commands are sent to the enabled devices: logging enable logging trap 2 logging device-id string /Admin logging host udp/514 logging message 111008 level 2 Related Topics • Synchronizing Virtual Context Configurations, page 6-105 • Restarting Virtual Context Polling, page 6-108 Editing Virtual Contexts You can modify the configuration of an existing virtual context. Procedure Step 1 Choose Config > Devices. The device tree appears. Step 2 In the device tree, choose the virtual context, then choose the configuration attributes that you want to modify. For information on configuration options, see the “Configuring Virtual Contexts” section on page 6-8. Step 3 Do one of the following: • Click OK to save your entries. • Click Cancel to exit the procedure without saving your entries. 6-107 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing Virtual Contexts Related Topics • Information About Virtual Contexts, page 6-2 • Configuring Virtual Contexts, page 6-8 Deleting Virtual Contexts You can remove an existing virtual context. Note If you remove a virtual context using the CLI, the CLI Sync Status for the virtual context appears as Unprovisioned in the Virtual Contexts table (Config > Devices > ACE). To remove the unprovisioned virtual context from the ANM, either synchronize the Admin virtual context (see the “Synchronizing Virtual Context Configurations” section on page 6-105) or delete the virtual context by selecting the virtual context, then clicking Delete. Procedure Step 1 Choose Config > Devices. The device tree appears. Step 2 In the device tree, choose the virtual context that you want to configure, and click Delete in either the device pane or the configuration pane. A confirmation popup window appears, asking you to confirm the deletion. Step 3 Do one of the following: • Click OK to delete the selected context. The device tree refreshes and the deleted context no longer appears. • Click Cancel to exit this procedure and to retain the selected context. Related Topics • Configuring Virtual Contexts, page 6-8 • Comparing Context and Building Block Configurations, page 6-101 Upgrading Virtual Contexts You can apply a different resource class, configuration building block, or VLAN to a virtual context. Procedure Step 1 Choose Config > Devices. The device tree appears. Step 2 In the device tree, choose the virtual context that you want to upgrade, and choose System > Primary Attributes. The Edit Virtual Context window appears. 6-108 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing Virtual Contexts Step 3 In the Resource Class field of the Edit Virtual Context window, choose the resource class that you want to apply to the context. Note If you attempt to apply a resource class that could consume the resources required to maintain IP connectivity to the Admin context, you will see an error message and the resource class will not be applied. We recommend that you first apply a resource class to the Admin context that will prevent its resources from being allocated to other contexts. For more information, see the “Resource Allocation Constraints” section on page 6-44. Step 4 In the Tagged Building Block To Apply field, choose the building block to apply to this virtual context. Step 5 In the Allocate-Interface VLANs field, enter the number of a VLAN or a range of VLANs so that the context can receive the associated traffic. You can specify VLANs as follows: • For a single VLAN, enter an integer from 2 to 4096. • For multiple, nonsequential VLANs, use comma-separated entries, such as 101,201,302. • For a range of VLANs, use the format -, such as 101-150. Note You cannot modify VLANs in an Admin context. Step 6 In the Description field, enter a brief description for this context. Step 7 Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The window refreshes with updated information. To exit this procedure without saving your entries, choose another item in the menu bar or device tree. A popup window appears, confirming that you have not saved your entries. Related Topics • Information About Virtual Contexts, page 6-2 • Configuring Virtual Contexts, page 6-8 Restarting Virtual Context Polling You can restart monitoring and enable SNMP collection on a single context that has stopped or failed to start. Note To restart polling and enable SNMP collection on all virtual contexts, choose Monitor > Settings > Global Polling Configuration, and configure global polling attributes using the information in the “Enabling Polling on All Devices” section on page 17-47. Procedure Step 1 Choose Config > Devices. 6-109 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing Virtual Contexts The device tree appears. Step 2 In the device tree, choose the ACE associated with the virtual context with stopped or failed polling. The Virtual Contexts table appears. Step 3 In the Virtual Contexts table, choose the context with the stopped or failed polling, and click Restart Polling. If the ANM cannot monitor the selected context, it displays an error message stating the reason. Related Topics • Information About Virtual Contexts, page 6-2 • Configuring Virtual Contexts, page 6-8 • Enabling Polling on All Devices, page 17-47 6-110 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 6 Configuring Virtual Contexts Managing Virtual Contexts CHAPTER 7-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 7 Configuring Virtual Servers Date: 3/28/12 This chapter describes how to configure virtual servers for load balancing on the Cisco Application Control Engine (ACE) using Cisco Application Networking Manager (ANM). Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • Information About Load Balancing, page 7-1 • Configuring Virtual Servers, page 7-2 • Managing Virtual Servers, page 7-66 • Deploying Virtual Servers, page 7-86 Information About Load Balancing Server load balancing (SLB) is the process of deciding to which server a load balancer should send a client request for service. For example, a client request can consist of an HTTP GET for a web page or an FTP GET to download a file. The load balancer selects the server that can successfully fulfill the client request and in the shortest amount of time without overloading either the server or the server farm as a whole. Depending on the load-balancing algorithm or predictor that you configure, the ACE performs a series of checks and calculations to determine the server that can best service each client request. The ACE bases server selection on several factors, including the server with the fewest connections with respect to load, source or destination address, cookies, URLs, or HTTP headers. ANM allows you to configure load balancing using: • Virtual servers—See Configuring Virtual Servers, page 7-2. 7-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers • Real servers—See Configuring Real Servers, page 8-5. • Server farms—See Configuring Server Farms, page 8-30. • Predictor methods—See Configuring the Predictor Method for Server Farms, page 8-39 • Health probes—See Configuring Health Monitoring for Real Servers, page 8-51 • Sticky groups—See Configuring Sticky Groups, page 9-7. • Parameter maps—See Configuring Parameter Maps, page 10-1. Configuring Virtual Servers In a load-balancing environment, a virtual server is a construct that allows multiple physical servers to appear as one for load-balancing purposes. A virtual server is bound to physical services running on real servers in a server farm and uses IP address and port information to distribute incoming client requests to the servers in the server farm according to a specified load-balancing algorithm. You use class maps to configure a virtual server address and definition. The load-balancing predictor algorithms (for example, round-robin, least connections, and so on) determine the servers to which the ACE sends connection requests. This section includes the following topics: • Virtual Server Configuration and ANM, page 7-2 • Information About Using ANM to Configure Virtual Servers, page 7-4 • Virtual Server Usage Guidelines, page 7-5 • Virtual Server Testing and Troubleshooting, page 7-6 • Virtual Server Configuration Procedure, page 7-7 Virtual Server Configuration and ANM This section identifies the constraints and framework used by ANM for virtual server configuration. In ANM, a virtual server has the following attributes: • A single Layer 3/Layer 4 match condition You can specify only a single IP address (or single IP address range if an IPv4 netmask or IPv6 prefix length is used), with only a single port (or port range). A single match condition greatly simplifies and aids virtual server configuration. Note IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. • A default Layer 7 action • A Layer 7 policy map • A Layer 3/Layer 4 class map • A single multimatch policy map, a class-map match, and an action Virtual server attributes also include the following: • The virtual server multimatch policy map is associated with an interface or is global. 7-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers • The name of the virtual server is derived from the name of the Layer 3/Layer 4 class map. Example 7-1 shows the minimum configuration statements required for a virtual server. Example 7-1 Minimum Configuration Required for a Virtual Server IPv4 Configuration class-map match-all Example_VIP 2 match virtual-address 10.10.10.10 tcp eq www policy-map type loadbalance first-match Example_VIP-l7slb class class-default forward policy-map multi-match int10 class Example_VIP loadbalance policy Example_VIP-l7slb interface vlan 10 ip address 192.168.65.37 255.255.255.0 service-policy input int10 no shutdown IPv6 Configuration (Requires ACE module and ACE appliance software Version A5(1.0) or later) class-map match-all Example2_VIP 2 match virtual-address 2001:DB8:10::5 tcp eq www policy-map type loadbalance first-match Example2_VIP-l7slb class class-default f orward policy-map multi-match int11 class Example2_VIP loadbalance policy Example2_VIP-l7slb interface vlan 10 ip address 2001:DB8:10::21/64 service-policy input int11 no shutdown Note the following items regarding the ANM and virtual servers: • Additional configuration options The Virtual Server configuration window allows you to configure additional items for a functional VIP. These items include server farms, sticky groups, real servers, probes, parameter maps, inspection, class maps, and inline match conditions. Because too many items on a window can be overwhelming, not all configuration options appear on the Virtual Server configuration window, such as sticky statics or backup real servers. These options are available elsewhere in the ANM interface instead of on the Virtual Server configuration window. • Configuration options and roles To support and maintain the separation of roles, some objects cannot be configured using the Virtual Server configuration window. These objects include SSL certificates, SSL keys, NAT pools, interface IP addresses, and ACLs. Providing these options as separate configuration options in the ANM interface ensures that a user who can view or modify virtual servers or aspects of virtual servers cannot create or delete virtual servers. • Changes to virtual servers using the CLI or Expert options can prevent further modifications in the Virtual Server configuration window 7-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers If you create a virtual server using the Virtual Server configuration window, modify it using the CLI or Expert options (Config > Devices > Expert), and then attempt to modify it again using the Virtual Server configuration window, error messages will be displayed and you will not be able to modify the virtual server. • Changes to virtual server IP address type is not allowed When creating a virtual server, you choose whether to use the IPv4 or IPv6 address type. You cannot change the IP address type of an existing virtual server. If you need to change the IP address type, you must create a new virtual server. Note IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Related Topics • Configuring Virtual Servers, page 7-2 • Information About Using ANM to Configure Virtual Servers, page 7-4 • Virtual Server Usage Guidelines, page 7-5 • Virtual Server Testing and Troubleshooting, page 7-6 • Virtual Server Configuration Procedure, page 7-7 Information About Using ANM to Configure Virtual Servers Follow these guidelines when using ANM to configure virtual servers: • Virtual server configuration windows The ANM Virtual Server configuration windows are designed to aid you in configuring virtual servers by presenting configuration options that are relevant to your choices. For example, the protocols that you select in the Properties configuration subset determine the other configuration subsets that appear. • Use the virtual server configuration method that suits you The ANM Virtual Server configuration windows simplify the process of creating, modifying, and deploying virtual servers by displaying those options that you are most likely to use. In addition, as you specify attributes for a virtual server, such as protocols, the interface refreshes with related configuration options, such as Protocol Inspection or Application Acceleration and Optimization, which speeds virtual server configuration and deployment. While Virtual Server configuration windows remove some configuration complexities, they have a few constraints that the Expert configuration options do not. If you are comfortable using the CLI, you can use the Expert options (such as Config > Devices > context > Expert > Class Maps or Policy or Config > Devices > context > Load Balancing > Parameter Maps to configure more complex attributes of virtual servers, traffic policies, and parameter maps. • Synchronizing virtual server configurations If you configure a virtual server using the CLI and then use the Sync option (Config > Devices > ACE > Sync) to synchronize configurations, the configuration that appears in ANM for the virtual server might not display all configuration options for that virtual server. The configuration that appears in ANM depends on a number of items, such as the protocols configured in class maps or the rules defined for policy maps. 7-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers For example, if you configure a virtual server on the CLI that includes a class map that can match any protocol, you will not see the virtual server Application Acceleration and Optimization configuration subset in ANM. • Modifying shared objects Modifying an object that is used by multiple virtual servers, such as a server farm, real server, or parameter map, could impact the other virtual servers. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying objects used by multiple virtual servers. Related Topics • Configuring Virtual Servers, page 7-2 • Virtual Server Configuration and ANM, page 7-2 • Virtual Server Usage Guidelines, page 7-5 • Virtual Server Testing and Troubleshooting, page 7-6 • Virtual Server Configuration Procedure, page 7-7 Virtual Server Usage Guidelines The Virtual Server configuration window provides you with numerous configuration options. However, instead of setting every option in one pass, configure your virtual server in stages. The first stage should always be to establish basic “pass through” connectivity with simple load balancing and include minimal additional features. This level of setup should verify that ports, VLANs, interfaces, SSL termination (if applicable), and real servers have been set up properly, enabling basic connectivity. After you establish this level of connectivity, additional virtual server features will be easier to configure and troubleshoot. Common features to add to a working basic virtual server include: • Health monitoring probes • Session persistence (sticky) • Additional real servers to a server farm • Application protocol inspection • Application acceleration and optimization (ACE appliance only) Table 7-1 identifies and describes virtual server configuration subsets with links to related topics for configuration information. Related Topics • Configuring Virtual Servers, page 7-2 • Virtual Server Configuration and ANM, page 7-2 • Virtual Server Testing and Troubleshooting, page 7-6 • Virtual Server Configuration Procedure, page 7-7 7-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Virtual Server Testing and Troubleshooting As outlined in the “Virtual Server Usage Guidelines” section on page 7-5, first set up a basic virtual server that only enables connectivity and simple load balancing, such as round-robin between two real servers. Next, use a client, such as a web browser, to send a request from the client network to the virtual server's VIP address. If the request is successful, you can now make changes or add virtual server features. If the request is not successful, begin virtual server troubleshooting as outlined in the following sequence: 1. Wait and retry your request after a minute or two, especially if the existing ACE configuration is large. It can take seconds or even minutes for configuration changes to affect how traffic is handled by ACE. 2. Click the Details button in the lower right of the Virtual Server page. The Details button displays the output of the show service-policy CLI command. 3. Verify that the VIP State in the show service-policy CLI command output is INSERVICE. If the VIP state is not INSERVICE, this may indicate the following: – The virtual server has been manually disabled in the configuration. – The real servers are all unreachable from ACE or manually disabled. If all of a virtual server's real servers are out of service due to one of those reasons, the virtual server itself will be marked Out Of Service. 4. Verify the Hit Count in the show service-policy CLI command output. Hit Count shows the number of requests received by ACE. This value should increase for each request attempted by your client. If the hit count does not increase with each request, this indicates that the request is not reaching your virtual server configuration. This could be a problem with: – A physical connection. – VLAN or VLAN interface configuration. – Missing or incorrect ACL applied to the client interface. – Incorrect IP address (that is, a VIP that is not valid on the selected VLANs for the virtual server, or a VIP that is not accessible to your client). If the Hit Count value increases but no response is received (Server Pkt Count does not increases), the problem is more likely to be in the connectivity between the ACE and the backend real servers. This issue is typically caused by one or more of the following problems: – You are working on a one-armed configuration (that is, do not plan to change routing for your real servers) and have not selected an appropriate NAT pool for your virtual server to use with source NAT. – A different routing problem (for example, server traffic does not know how to get back to the ACE). – Addressing problem (for example, you have an incorrect real server address, or the real server is not accessible to ACE due to network topology). Note Hit count can increase by more than one, even if you make only a single request from your web browser, because retrieving a typical web page makes many requests from the client to the server. 7-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Related Topics • Configuring Virtual Servers, page 7-2 • Virtual Server Configuration and ANM, page 7-2 • Virtual Server Usage Guidelines, page 7-5 • Virtual Server Configuration Procedure, page 7-7 Virtual Server Configuration Procedure You can add virtual servers to the ANM for load-balancing purposes. Assumptions This topic assumes the following: • Depending on the protocol to be used for the virtual server, parameter maps need to be defined. • For SSL service, SSL certificates, keys, and chain groups, parameter maps must be configured. Guidelines and Restrictions ANM does not support CSM DNS virtual servers. If you create this type of virtual server, ANM issues an error message if you attempt to use ANM to activate or suspend it. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Virtual Servers. The Virtual Servers table appears. For details about the information that displays, see “Displaying Virtual Servers by Context” section on page 7-65. Step 2 In the Virtual Servers table, click Poll Now to instruct ANM to poll the devices and display the current values. Step 3 Click OK when prompted if you want to poll the devices for data now. Step 4 Click Add to add a new virtual server, or choose an existing virtual server and click Edit to modify it. The Virtual Server configuration window appears with a number of configuration subsets. The subsets that you see depend on whether you use the Basic View or the Advanced View and entries that you make in the Properties subset. Change views by using the View object selector at the top of the configuration pane. Table 7-1 identifies and describes virtual server configuration subsets with links to related topics for configuration information. Note The protocols that are available depend on the ACE device that you are configuring. For a list of the protocols available for each ACE device type, see Table 7-2. 7-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Table 7-1 Virtual Server Configuration Subsets Configuration Subset Description Related Topics Properties Subset that allows you to specify basic virtual server characteristics, such as the virtual server name, IP address, protocol, port, and VLANs. Configuring Virtual Server Properties, page 7-11 SSL Termination Subset that appears when TCP is the selected protocol and Other or HTTPS is the application protocol. This subset allows you to configure the virtual server to act as an SSL proxy server and terminate SSL sessions between it and its clients. Configuring Virtual Server SSL Termination, page 7-17 Protocol Inspection Subset that appears in the Advanced View for: • TCP with FTP, HTTP, HTTPS, Real Time Streaming Protocol (RTSP), or Session Initiated Protocol (SIP) • UDP with Domain Name System (DNS) or SIP This subset appears in the Basic view for TCP with FTP. This subset allows you to configure the virtual server so that it can verify protocol behavior and identify unwanted or malicious traffic passing through the ACE on selected application protocols. Configuring Virtual Server Protocol Inspection, page 7-18 Application Acceleration And Optimization Subset that appears only for ACE appliances. It appears in the Advanced View when HTTP or HTTPS is the selected application protocol. This subset allows you to configure application acceleration and optimization options for HTTP or HTTPS traffic. Configuring Application Acceleration and Optimization, page 7-53 L7 Load-Balancing Subset that appears only in the Advanced View for these protocols: • TCP with Generic, HTTP, HTTPS, RTSP, or SIP • UDP with Generic, RADIUS, or SIP This subset allows you to configure Layer 7 load-balancing options, such as: • Server farms/real servers • Health monitoring probes • Stickiness • SSL initiation Configuring Virtual Server Layer 7 Load Balancing, page 7-30 Default L7 Load-Balancing Action Subset that allows you to establish the default Layer 7 load-balancing actions for all network traffic that does not meet previously specified match conditions including the SSL initiation configuration. Configuring Virtual Server Default Layer 7 Load Balancing, page 7-50 NAT Subset that allows you to set up Name Address Translation (NAT) for the virtual server. Configuring Virtual Server NAT, page 7-63 7-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 5 Do one of the following: • Click Deploy Now to deploy the configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Virtual Servers table. • Click Deploy Later to save your entries and apply them at a later time. Step 6 (Optional) To display statistics and status information for an existing virtual server, from the Virtual Servers table, choose a virtual server and click Details. A popup window appears that displays the detailed virtual server information (see the “Displaying Virtual Server Statistics and Status Information” section on page 7-65 for details). Note This feature requires ACE module software Version A2(1.2), ACE appliance software Version A3(2.1), or later versions of either software. An error displays with earlier software versions. Related Topics • Configuring Virtual Servers, page 7-2 • Virtual Server Configuration and ANM, page 7-2 • Virtual Server Usage Guidelines, page 7-5 • Information About Using ANM to Configure Virtual Servers, page 7-4 • Shared Objects and Virtual Servers, page 7-9 • Displaying Virtual Servers by Context, page 7-65 • Displaying Virtual Server Statistics and Status Information, page 7-65 • Managing Virtual Servers, page 7-66 • Deploying Virtual Servers, page 7-86 • Understanding Roles, page 18-6 Shared Objects and Virtual Servers A shared object is one that is used by multiple virtual servers. The following examples are shared objects: • Action lists • Class maps • Parameter maps • Real servers • Server farms • SSL services • Sticky groups 7-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Because these objects are shared, modifying an object’s configuration in one virtual server can impact other virtual servers that use the same object. Configuring Shared Objects ANM offers the following options for shared objects in virtual server configuration windows (Config > Devices > context > Load Balancing > Virtual Servers): • View—Displays the object’s configuration. The window refreshes with read-only fields and the following three buttons. • Cancel—Closes the read-only view and to return to the previous window. • Edit—Enables you to modify the selected object’s configuration. The window refreshes with fields that can be modified, except for the Name field which remains read-only. Note Before changing a shared object’s configuration, make sure that you understand the effect of the changes on other virtual servers using the same object. As an alternative, consider using the Duplicate option instead. • Duplicate—Enables you to create a new object with the same configuration as the selected object. The window refreshes with configurable fields. In the Name field, enter a unique name for the new object, and then modify the configuration as desired. This option allows you to create a new object without impacting other virtual servers using the same object. Deleting Virtual Servers with Shared Objects If you create a virtual server and include shared objects in its configuration, deleting the virtual server does not delete the associated shared objects. This action ensures that other virtual servers using the same shared objects are not impacted. Related Topics • Managing Virtual Servers, page 7-66 • Virtual Server Protocols by Device Type, page 7-11 • Configuring Virtual Server Properties, page 7-11 • Configuring Virtual Server SSL Termination, page 7-17 • Configuring Virtual Server Protocol Inspection, page 7-18 • Configuring Virtual Server Layer 7 Load Balancing, page 7-30 • Configuring Virtual Server Default Layer 7 Load Balancing, page 7-50 • Configuring Application Acceleration and Optimization, page 7-53 • Configuring Virtual Server NAT, page 7-63 7-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Virtual Server Protocols by Device Type The protocols that are available for a virtual server depend on the ACE device that you are configuring. Table 7-2 lists the protocols available for each device type. Related Topics • Configuring Virtual Servers, page 7-2 • Configuring Virtual Server Properties, page 7-11 • Managing Virtual Servers, page 7-66 Configuring Virtual Server Properties You can configure virtual server properties. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Virtual Servers. The Virtual Servers table appears. Step 2 In the Virtual Servers table, click Poll Now to instruct ANM to poll the devices and display the current values, and click OK when prompted if you want to poll the devices for data now. Step 3 Click Add to add a new virtual server, or choose an existing virtual server and click Edit to modify it. Table 7-2 Virtual Server Protocols for ACE Modules and Devices Protocol ACE Modules ACE Appliance Any X X TCP FTP X X Generic X X HTTP X X HTTPS X X Other X X RTSP X X RDP X X SIP X X UDP DNS X X Generic X X Other X X RADIUS X X SIP X X 7-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers The Virtual Server configuration window appears. The Properties configuration subset is open by default. The fields that you see in the Properties configuration subset depend on whether you are using Advanced View or Basic View: • To configure Advanced View properties, go to Step 4. • To configure Basic View properties, go to Step 5. Step 4 In the Advanced View, configure the virtual server properties by entering the information in Table 7-3. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Table 7-3 Virtual Server Properties – Advanced View Field Description Virtual Server Name Name for the virtual server. IP Address Type Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. Choose the address type of the virtual server: IPv4 or IPv6. Virtual IP Address IP address for the virtual server. Virtual IP Mask (IPv4 address type only) Subnet mask to apply to the virtual server IP address. Virtual IP Prefix Length (IPv6 address type only) Enter the prefix length to apply to the virtual server IP address. The default length for the prefix is 128. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Transport Protocol Protocol that the virtual server supports: • Any—The virtual server is to accept connections using any IP protocol. • TCP—The virtual server is to accept connections that use TCP. • UDP—The virtual server is to accept connections that use UDP. Application Protocol Field that appears if TCP or UDP is selected. The application protocols that are available depend on the type of ACE being configured. Choose the application protocol to be supported by the virtual server. Table 7-2 identifies the available protocols for each ACE device type. Note This field is read-only if you are editing an existing virtual server. ANM does not allow changes between protocols that require a change to the Layer 7 server load-balancing policy map. You need to delete the virtual server and create a new one with the desired application protocol. Port Field that appears for any TCP or UDP protocol. Enter the port to be used for the specified protocol. Valid entries are from 0 to 65535 or a range of integers, such as 10-20. Enter 0 (zero) to indicate all ports. For a complete list of protocols and ports, see the Internet Assigned Numbers Authority available at www.iana.org/numbers/ All VLANs Check box that enables support of incoming traffic from all VLANs. Uncheck the check box to support incoming traffic from specific VLANs only. 7-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers VLAN Field appears if the All VLANs check box is unchecked. In the Available Items list, choose the VLANs to use for incoming traffic, and click Add. The items appear in the Selected Items list. To remove VLANs, choose them in the Selected Items lists, and click Remove. The items appear in the Available Items list. Note You cannot change the VLAN for a virtual server once it is specified. Instead, delete the virtual server and create a new one with the desired VLAN. Connection Parameter Maps Field that appears if TCP is the selected protocol. Choose an existing connection parameter map or click *New* to create a new one as follows: • If you chose an existing parameter map, you can view, modify, or duplicate the existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. • If you click *New*, the Connection Parameter Maps configuration pane appears. Configure the connection parameter map as described in Table 10-2. Note Click More Settings to access the additional Connection Parameter Maps configuration attributes. By default, ANM hides the default Connection Parameter Maps configuration attributes and the attributes which are not commonly used. DNS Parameter Maps Field that appears if DNS is the selected protocol over UDP. Choose an existing DNS parameter map or click *New* to create a new one as follows: • If you chose an existing parameter map, you can view, modify, or duplicate the existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. • If you click *New*, the DNS Parameter Maps configuration pane appears. Configure the DNS parameter map as described in Table 10-11. Generic Parameter Maps Field that appears if Generic is the selected application protocol over TCP or UDP. Choose an existing Generic parameter map or click *New* to create a new one as follows: • If you chose an existing parameter map, you can view, modify, or duplicate the existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. • If you click *New*, the Generic Parameter Maps configuration pane appears. Configure the Generic parameter map as described in Table 10-4. HTTP Parameter Maps Field appears if HTTP or HTTPS is the selected application protocol. Choose an existing HTTP parameter map or click *New* to create a new one as follows: • If you chose an existing parameter map, you can view, modify, or duplicate the existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. • If you click *New*, the HTTP Parameter Maps configuration pane appears. Configure the HTTP parameter map as described in Table 10-5. Table 7-3 Virtual Server Properties – Advanced View (continued) Field Description 7-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers RTSP Parameter Maps Field that appears if RTSP is the selected application protocol over TCP. Choose an existing RTSP parameter map or click *New* to create a new one as follows: • If you chose an existing parameter map, you can view, modify, or duplicate the existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. • If you click *New*, the RTSP Parameter Maps configuration pane appears. Configure the RTSP parameter map as described in Table 10-8. KAL-AP-TAG Name Feature that is supported only for the ACE module software Version A2(2.0), ACE appliance software Version A4(1.0), and later versions for both device types. The KAL-AP-TAG feature allows the Cisco Global Site Selector (GSS) proprietary KAL-AP protocol to extract load and availability information from the ACE when a firewall is positioned between the GSS and the ACE. This feature allows you to configure a tag (name) per VIP for a maximum of 4096 tags on an ACE. This feature does not replace the tag per domain feature. For more information about this feature, see the Release Note for the Cisco Application Control Engine Module (Software Version A2(2.0)) or the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide (Software Version A2(3.0)), the Configuring Health Monitoring chapter. In the KAL-AP-TAG Name field, enter the name as an unquoted text string with no spaces and a maximum of 76 alphanumeric characters. The following scenarios are not supported and will result in an error: • You cannot configure a tag name for a VIP that already has a tag configuration as part of a different policy configuration. • You cannot associate the same tag name with more than one VIP. • You cannot associate the same tag name with a domain and a VIP. • You cannot assign two different tags to two different Layer 3 class maps that have the same VIP, but different port numbers. The KAL-AP protocol considers these class maps to have the same VIP and calculates the load for both Layer 3 rules together when the GSS queries the VIP. KAL-AP-Primary-Out-OfService Feature that is supported only for ACE module software Version A2(3.1), ACE appliance software Version A4(1.0), and later versions of either device type. Check the checkbox to enable the ACE to notify a Global Site Selector (GSS) that the primary server farm is down when the backup server farm is in use. Uncheck the checkbox to disable this feature. By default, when you configure a redirect server farm as a backup server farm on the ACE and the primary server farm fails, the backup server farm redirects client requests to another data center; however, the VIP remains in the INSERVICE state. When you configure the ACE to communicate with a GSS, it provides information for server availability. When a backup server is in use after the primary server farm is down, this feature enables the ACE to inform the GSS that the VIP for the primary server farm is out of service by returning a load value of 255. The GSS recognizes that the primary server farm is down and sends future DNS requests with the IP address of the other data center. Table 7-3 Virtual Server Properties – Advanced View (continued) Field Description 7-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 5 In the Basic View, configure virtual server properties by entering the information in Table 7-4. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. ICMP Reply Virtual server response to ICMP ECHO requests as follows: • None—The virtual server is not to send ICMP ECHO-REPLY responses to ICMP requests. • Active—The virtual server is to send ICMP ECHO-REPLY responses only if the configured VIP is active. • Always—The virtual server is always to send ICMP ECHO-REPLY responses to ICMP requests. • Primary Inservice—The virtual server is to reply to an ICMP ping only if the primary server farm state is UP, regardless of the state of the backup server farm. If this option is selected and the primary server farm state is DOWN, the ACE discards the ICMP request and the request times out. VIP Advertise Field that appears for ACE modules only. This option allows the ACE to advertise the IP address of the virtual server as the host route. Choose the desired VIP advertise option as follows: • None—The ACE does not advertise the IP address of the virtual server as the host route. • Active—The ACE advertises the IP address of the virtual server as the host route only if there is at least one active real server in the server farm. • Always—The ACE always advertises the IP address of the virtual server as the host route. • Active-Metric—The ACE advertises the IP address of the virtual server as the host route if the following occurs: • There is at least one active real server in the server farm. • A distance metric is specified for the route in the Distance field. • Always-Metric—The ACE advertises the IP address of the virtual server as the host route, using the distance metric in the Distance field. Distance Field that appears for ACE modules only. This field appears if you chose Active-Metric or Always-Metric in the VIP Advertise field. Enter the administrative distance to be included in the routing table. Valid entries are integers from 1 to 254. Status Operating state of the virtual server as follows: • In Service—Enables the virtual server for load-balancing operations. • Out Of Service—Disables the virtual server for load-balancing operations. Table 7-3 Virtual Server Properties – Advanced View (continued) Field Description 7-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 6 Do one of the following: • Click Deploy Now to deploy the configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries. • Click Deploy Later to save your entries and apply them at a later time. Related Topics • Configuring Virtual Servers, page 7-2 Table 7-4 Virtual Server Properties – Basic View Field Description Virtual Server Name Name for the virtual server. IP Address Type Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. Choose the address type of the virtual server: IPv4 or IPv6. Virtual IP Address IP address for the virtual server. Transport Protocol Protocol that the virtual server supports as follows: • Any—The virtual server accepts connections using any IP protocol. • TCP—The virtual server accepts connections that use TCP. • UDP—The virtual server accepts connections that use UDP. Application Protocol Field that appears if TCP or UDP is selected. The application protocols that are available depend on the type of ACE being configured. Choose the application protocol to be supported by the virtual server. Table 7-2 identifies the available protocols for each ACE device type. Note This field is read-only if you are editing an existing virtual server. ANM does not allow changes between protocols that require a change to the Layer 7 server load-balancing policy map. You need to delete the virtual server and create a new one with the desired application protocol. Port Field that appears for any specific TCP or UDP protocol. Enter the port to be used for the specified protocol. Valid entries are from 0 to 65535 or a range of integers, such as 10-20. Enter 0 (zero) to indicate all ports. For a complete list of all protocols and ports, see the Internet Assigned Numbers Authority available at www.iana.org/numbers/ All VLANs Check box that enables support of incoming traffic from all VLANs. Uncheck the check box to support incoming traffic from specific VLANs only. VLAN Field that appears if the All VLANs check box is unchecked. In the Available Items list, choose the VLANs to use for incoming traffic, and click Add. The items appear in the Selected Items list. To remove VLANs, choose them in the Selected Items lists, and click Remove. The items appear in the Available Items list. Note You cannot change the VLAN for a virtual server once it is specified. Instead, delete the virtual server and create a new one with the desired VLAN. 7-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers • Configuring Virtual Server SSL Termination, page 7-17 Configuring Virtual Server SSL Termination You can configure virtual server SSL termination service, which allows the virtual server to act as an SSL proxy server and terminate SSL sessions between it and its clients. Assumption Make sure that a virtual server has been configured for HTTPS over TCP or Other over TCP in the Properties configuration subset. For more information, see the “Configuring Virtual Server Properties” section on page 7-11. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Virtual Servers. The Virtual Servers table appears. Step 2 In the Virtual Servers table, choose the virtual server that you want to configure for SSL termination, and click Edit. The Virtual Server configuration window appears. Step 3 In the Virtual Server configuration window, click SSL Termination. The Proxy Service Name field appears. Step 4 In the Proxy Service Name field, choose an existing SSL termination service, or choose *New* to create a new SSL proxy service, and do one of the following: • If you chose an existing SSL service, the window refreshes and allows you to view, modify, or duplicate the existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. • If you chose *New*, the Proxy Service configuration subset appears. Step 5 Configure the SSL service using the information in Table 7-5. For more information about SSL, see the “Configuring SSL” section on page 11-1. Table 7-5 Virtual Server SSL Attributes Field Description Name Name for this SSL proxy service. Valid entries are alphanumeric strings with a maximum of 26 characters. Keys SSL key pair to use during the SSL handshake for data encryption. Certificates SSL certificate to use during the SSL handshake. Chain Groups Chain group to use during the SSL handshake. Auth Groups SSL authentication group to associate with this proxy server service. CRL Best-Effort Option that appears if you chose an authentication group in the Auth Groups field. Check the check box to allow the ANM to search client certificates for the service to determine if it contains a CRL in the extension and retrieve the value, if it exists. Uncheck the check box to disable this feature. 7-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries. • Click Deploy Later to save your entries and apply them at a later time. Related Topics • Configuring Virtual Servers, page 7-2 • Configuring Virtual Server Properties, page 7-11 Configuring Virtual Server Protocol Inspection You can configure protocol inspection on a virtual server, which allows the virtual server to verify protocol behavior and identify unwanted or malicious traffic passing through the ACE. In the Advanced View, protocol inspection configuration is available for the following virtual server protocol configurations: • TCP with FTP, HTTP, HTTPS, RTSP, or SIP • UDP with DNS or SIP In the Basic View, protocol inspection configuration is available for TCP with FTP. See Table 7-2 for a list of protocols by ACE device type. Assumption Make sure that a virtual server has been configured to use one of the protocols that supports protocol inspection in the Properties configuration subset. See the “Configuring Virtual Server Properties” section on page 7-11 for information on configuring these protocols. Procedure Step 1 Choose the item to configure: • To configure a virtual server, choose Config > Devices > context > Load Balancing > Virtual Servers. • To configure a configuration building block, choose Config > Global > All Building Blocks > building_block > Load Balancing > Virtual Servers. The Virtual Servers table appears. CRL Name Option that appears if the CRL Best-Effort check box is clear. Choose the Certificate Revocation List the ANM is to use for this proxy service. Parameter Maps SSL parameter map to associate with this proxy server service. Table 7-5 Virtual Server SSL Attributes (continued) Field Description 7-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 2 In the Virtual Servers table, choose the virtual server that you want to configure for protocol inspection, and click Edit. The Virtual Server configuration window appears. Step 3 Click Protocol Inspection. The Enable Inspect check box appears. Step 4 Check the Enable Inspect check box to enable inspection on the specified traffic or uncheck it to disable inspection on this traffic. By default, the ACE allows all request methods. Step 5 (Optional) If you checked the Enable Inspect check box, configure additional inspection options using the information in Table 7-6. Table 7-6 Protocol Inspection Configuration Options Protocol Action DNS In the length field, enter the maximum length of the DNS packet in bytes as defined in the Length field. If you do not enter a value in this field, the DNS packet size is not checked. FTP a. Check the Use Strict check box to specify that the virtual server is to perform enhanced inspection of FTP traffic and enforce compliance with RFC standards. Uncheck the check box to specify that the virtual server is not to perform enhanced FTP inspection. b. (Optional) If you checked the Use Strict check box, in the Blocked FTP Commands field, identify the commands that are to be denied by the virtual server. See Table 14-8 for more information about the FTP commands. • Choose the commands that are to be blocked by the virtual server in the Available Items list, and click Add. The commands appear in the Selected Items list. • To remove commands that you do not want to be blocked, choose them in the Selected Items list, and click Remove. The commands appear in the Available Items list. 7-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers HTTP or HTTPS a. Check the Logging Enabled check box to enable monitoring of Layer 3 and Layer 4 traffic. When enabled, this feature logs every URL request that is sent in the specified class of traffic, including the source or destination IP address and the URL that is accessed. Uncheck the check box to disable monitoring of Layer 3 and Layer 4 traffic. b. In the Policy subset, click Add to add a new match condition and action, or choose an existing match condition and action and click Edit to modify it. The Policy configuration pane appears. c. In the Matches field, choose an existing class map or *New* or *Inline Match* to configure new match criteria for protocol inspection. If you chose an existing class map, the window refreshes and allows you to view, modify, or duplicate the selected class map. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. d. Configure match criteria and related actions using the information in Table 7-7. e. Do one of the following: • Click OK to save your entries. The Conditions table refreshes with the new entry. • Click Cancel to exit the Policy subset without saving your entries. f. In the Default Action field, choose the default action that the virtual server is to take when specified match conditions for protocol inspection are not met: • Permit—The specified HTTP traffic is to be received by the virtual server. • Reset—The specified HTTP traffic is to be denied by the virtual server. Table 7-6 Protocol Inspection Configuration Options (continued) Protocol Action 7-21 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers RTSP There are no protocol-specific inspection options for RTSP. SIP a. In the Actions subset, click Add to add a new match condition and action, or choose an existing match condition and action, and click Edit to modify it. The Actions configuration pane appears. b. In the Matches field, choose an existing class map or *New* or *Inline Match* to configure new match criteria for protocol inspection. If you chose an existing class map, the window refreshes and allows you to view, modify, or duplicate the selected class map. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. c. Configure match criteria and related actions using the information in Table 7-9. d. In the Action field, choose the action that the virtual server is to take when the specified match conditions are met: – Drop—The specified SIP traffic is discarded by the virtual server. – Permit—The specified SIP traffic is received by the virtual server. – Reset—The specified SIP traffic is denied by the virtual server. e. Do one of the following: – Click OK to save your entries. The Conditions table refreshes with the new entry. – Click Cancel to exit the Conditions subset without saving your entries and to return to the Conditions table. f. In the SIP Parameter Map field, choose an existing parameter map or choose *New* to configure a new one. If you chose an existing parameter map, the window refreshes and allows you to view, modify, or delete the selected parameter map. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. g. Configure SIP parameter map options using the information in Table 10-9. h. In the Secondary Connection Parameter Map field, choose an existing parameter map or choose *New* to configure a new one. If you chose an existing parameter map, the window refreshes and allows you to view, modify, or delete the selected parameter map. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. i. Configure secondary connection parameter map options using the information in Table 10-2. j. In the Default Action field, choose the default action that the virtual server is to take when specified match conditions for SIP protocol inspection are not met: – Drop—The specified SIP traffic is discarded by the virtual server. – Permit—The specified SIP traffic is received by the virtual server. – Reset—The specified SIP traffic is denied by the virtual server. k. Check the Logging Enabled check box to enable monitoring of Layer 3 and Layer 4 traffic. When enabled, this feature logs every URL request that is sent in the specified class of traffic, including the source or destination IP address and the URL that is accessed. Uncheck the check box to disable monitoring of Layer 3 and Layer 4 traffic. Table 7-6 Protocol Inspection Configuration Options (continued) Protocol Action 7-22 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Table 7-7 HTTP and HTTPS Protocol Inspection Match Criteria Configuration Selection Action Existing class map a. Click View to review the match condition information for the selected class map. b. Do one of the following: – Click Cancel to continue without making changes and to return to the previous window. – Click Edit to modify the existing configuration. – Click Duplicate to create a new class map with the same attributes without affecting other virtual servers using the same class map. See the “Shared Objects and Virtual Servers” section on page 7-9 for information about modifying shared objects. c. In the Action field, choose the action that the virtual server is to perform on the traffic if it matches the specified match criteria: – Permit—The specified traffic is received by the virtual server if it meets the specified deep inspection match criteria. – Reset—The specified traffic is denied by the virtual server, which then sends a TCP reset message to the client or server to close the connection. *New* a. In the Name field, specify a unique name for this class map. b. In the Match field, choose the method to be used to evaluate multiple match statements when multiple match conditions exist: – Any—A match exists if at least one of the match conditions is satisfied. – All—A match exists only if all match conditions are satisfied. c. In the Conditions table, click Add to add a new set of conditions, or choose an existing entry, and click Edit to modify it. The Type field appears. d. In the Type field, choose the type of condition that is to be met for protocol inspection. e. Provide condition-specific criteria using the information in Table 7-8. f. In the Action field, choose the action that the virtual server is to perform on the traffic if it matches the specified match criteria: – Permit—The specified traffic is received by the virtual server if it meets the specified deep inspection match criteria. – Reset—The specified traffic is denied by the virtual server, which then sends a TCP reset message to the client or server to close the connection. *Inline Match* a. In the Conditions Type field, choose the type of inline match condition that is to be met for protocol inspection. b. Provide condition-specific criteria using the information in Table 7-8. c. In the Action field, choose the action that the virtual server is to perform on the traffic if it matches the specified match criteria: – Permit—The specified traffic is received by the virtual server if it meets the specified deep inspection match criteria. – Reset—The specified traffic is denied by the virtual server, which then sends a TCP reset message to the client or server to close the connection. 7-23 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Table 7-8 HTTP and HTTPS Protocol Inspection Conditions and Options Condition Description Content Specific content contained within the HTTP entity-body to be used for application inspection decisions. a. In the Content Expression field, enter the content that is to be matched. Valid entries are alphanumeric strings from 1 to 255 characters. b. In the Content Offset field, enter the number of bytes to be ignored starting with the first byte of the Message body, after the empty line (CR,LF,CR,LF) between the headers and the body of the message. Valid entries are from 1 to 255 bytes. Content Length Content parse length is used for application inspection decisions. a. In the Content Length Operator field, choose the operand to use to compare content length: – Equal To—The content length must equal the number in the Content Length Value field. – Greater Than—The content length must be greater than the number in the Content Length Value field. – Less Than—The content length must be less than the number in the Content Length Value field. – Range—The content length must be within the range specified in the Content Length Lower Value field and the Content Length Higher Value field. b. Enter values to apply for content length comparison: – If you chose Equal To, Greater Than, or Less Than in the Content Length Operator field, the Content Length Value field appears. In the Content Length Value field, enter the number of bytes for comparison. Valid entries are from 0 to 4294967295. – If you chose Range in the Content Length Operator field, the Content Length Lower Value and the Content Length Higher Value fields appear: 1. In the Content Length Lower Value field, enter the lowest number of bytes to be used for this match condition. Valid entries are from 0 to 4294967295. The number in this field must be less than the number entered in the Content Length Higher Value field. 2. In the Content Length Higher Value field, enter the highest number of bytes to be used for this match condition. Valid entries are from 0 to 4294967295. The number in this field must be greater than the number entered in the Content Length Lower Value field. Content Type Verification Verification of MIME-type messages with the header MIME-type is to be used for application inspection decisions. This option verifies that the header MIME-type value is in the internal list of supported MIME-types and that the header MIME-type matches the content in the data or body portion of the message. 7-24 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Header Name and value in an HTTP header are used for application inspection decisions. a. In the Header field, choose one of the predefined HTTP headers to match, or choose HTTP Header to specify a different HTTP header. b. If you chose HTTP Header, in the Header Name field, enter the name of the HTTP header to match. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. c. In the Header Value field, enter the header-value expression string to compare against the value in the specified field in the HTTP header. Valid entries are text strings with a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching. Header expressions allow spaces, provided that the spaces are escaped or quoted. All headers in the header map must be matched. See Table 14-33 for a list of the supported characters that you can use in regular expressions. Header Length Length of the header in the HTTP message used for application inspection decisions. a. In the Header Length Type field, specify whether HTTP header request or response messages are to be used for application inspection decisions: – Request—HTTP header request messages are to be checked for header length. – Response—HTTP header response messages are to be checked for header length. b. In the Header Length Operator field, choose the operand to be used to compare header length: – Equal To—The header length must equal the number in the Header Length Value field. – Greater Than—The header length must be greater than the number in the Header Length Value field. – Less Than—The header length must be less than the number in the Header Length Value field. – Range—The header length must be within the range specified in the Header Length Lower Value field and the Header Length Higher Value field. c. Enter values to apply for header length comparison: – If you chose Equal To, Greater Than, or Less Than in the Header Length Operator field, the Header Length Value field appears. In the Header Length Value field, enter the number of bytes for comparison. Valid entries are from 0 to 255. – If you chose Range in the Header Length Operator field, the Header Length Lower Value and the Header Length Higher Value fields appear: 1. In the Header Length Lower Value field, enter the lowest number of bytes to be used for this match condition. Valid entries are from 0 to 255. The number in this field must be less than the number entered in the Header Length Higher Value field. 2. In the Header Length Higher Value field, enter the highest number of bytes to be used for this match condition. Valid entries are from 1 to 255. The number in this field must be greater than the number entered in the Header Length Lower Value field. Header MIME Type Multipurpose Internet Mail Extension (MIME) message types are used for application inspection decisions. In the Header MIME Type field, choose the MIME message type to use for this match condition. Table 7-8 HTTP and HTTPS Protocol Inspection Conditions and Options (continued) Condition Description 7-25 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Port Misuse Misuse of port 80 (or any other port running HTTP) to be used for application inspection decisions. Choose the application category to use for this match condition as follows: • IM—Instant messaging applications are to be checked. • P2P—Peer-to-peer applications are to be checked. • Tunneling—Tunneling applications are to be checked. Request Method A request method is to be used for protocol inspection decisions. By default, ACEs allow all request and extension methods. This option allows you to configure protocol inspection decisions based on compliance to request methods defined in RFC 2616 and by HTTP extension methods. a. Choose the type of request method to use for this match condition: – Ext—An HTTP extension method is to be used. Note The list of available HTTP extension methods from which to choose varies depending on the version of software installed in the ACE. – RFC—The request method defined in RFC 2616 is to be used. b. In the Request Method field, choose the request method that is to be inspected. Strict HTTP Compliance with HTTP RFC 2616 to be used for application inspection decisions. Transfer Encoding An HTTP transfer-encoding type to be used for application inspection decisions. The transfer-encoding general-header field indicates the type of transformation, if any, that has been applied to the HTTP message body to safely transfer it between the sender and the recipient. In the Transfer Encoding field, choose the type of encoding that is to be checked: • Chunked—The message body is transferred as a series of chunks. • Compress—The encoding format that is produced by the UNIX file compression program compress. • Deflate—The .zlib format that is defined in RFC 1950 in combination with the DEFLATE compression mechanism described in RFC 1951. • Gzip—The encoding format that is produced by the file compression program GZIP (GNU zip) as described in RFC 1952. • Identity—The default (identity) encoding which does not require the use of transformation. Table 7-8 HTTP and HTTPS Protocol Inspection Conditions and Options (continued) Condition Description 7-26 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers URL URL names to be used for application inspection decisions. In the URL field, enter a URL or a portion of a URL to match. Valid entries are URL strings from 1 to 255 alphanumeric characters and include only the portion of the URL following www.hostname.domain. For example, in the URL www.anydomain.com/latest/whatsnew.html, include only /latest/whatsnew.html. URL Length URL length to be used for application inspection decisions. a. In the URL Length Operator field, choose the operand to use to compare URL length: – Equal To—The URL length must equal the number in the URL Length Value field. – Greater Than—The URL length must be greater than the number in the URL Length Value field. – Less Than—The URL length must be less than the number in the URL Length Value field. – Range—The URL length must be within the range specified in the URL Length Lower Value field and the URL Length Higher Value field. b. Enter values to apply for URL length comparison: – If you chose Equal To, Greater Than, or Less Than in the URL Length Operator field, the URL Length Value field appears. In the URL Length Value field, enter the value for comparison. Valid entries are from 1 to 65535 bytes. – If you chose Range in the URL Length Operator field, the URL Length Lower Value and the URL Length Higher Value fields appear: 1. In the URL Length Lower Value field, enter the lowest number of bytes to be used for this match condition. Valid entries are from 1 to 65535. The number in this field must be less than the number entered in the URL Length Higher Value field. 2. In the URL Length Higher Value field, enter the highest number of bytes to be used for this match condition. Valid entries are from 1 to 65535. The number in this field must be greater than the number entered in the URL Length Lower Value field. Table 7-8 HTTP and HTTPS Protocol Inspection Conditions and Options (continued) Condition Description 7-27 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Table 7-9 SIP Protocol Inspection Match Criteria Configuration Selection Action Existing class map a. Click View to review the match condition information for the selected class map. b. Do one of the following: – Click Cancel to continue without making changes and to return to the previous window. – Click Edit to modify the existing configuration. – Click Duplicate to create a new class map with the same attributes without affecting other virtual servers using the same class map. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. c. In the Action field, choose the action that the virtual server is to perform on the traffic if it matches the specified match criteria: – Drop—The specified traffic is to be dropped by the virtual server. – Permit—The specified traffic is to be received by the virtual server. – Reset—The specified traffic is to be denied by the virtual server, which then sends a TCP reset message to the client or server to close the connection. *New* a. In the Name field, specify a unique name for this class map. b. In the Conditions table, click Add to add a new set of conditions, or choose an existing entry, and click Edit to modify it. The Type field appears. c. In the Type field, choose the type of condition that is to be met for protocol inspection. d. Provide condition-specific criteria using the information in Table 7-10. e. In the Action field, choose the action that the virtual server is to perform on the traffic if it matches the specified match criteria: – Drop—The specified traffic is to be dropped by the virtual server. – Permit—The specified traffic is to be received by the virtual server. – Reset—The specified traffic is to be denied by the virtual server, which then sends a TCP reset message to the client or server to close the connection. *Inline Match* a. In the Conditions Type field, choose the type of inline match condition that is to be met for protocol inspection. Table 7-10 describes the types of conditions and their related configuration options. b. Provide condition-specific criteria using the information in Table 7-10. c. In the Action field, choose the action that the virtual server is to perform on the traffic if it matches the specified match criteria: – Drop—The specified traffic is to be dropped by the virtual server. – Permit—The specified traffic is to be received by the virtual server. – Reset—The specified traffic is to be denied by the virtual server, which then sends a TCP reset message to the client or server to close the connection. 7-28 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Table 7-10 SIP Protocol Inspection Conditions and Options Condition Description Called Party Destination or called party specified in the URI of the SIP To header used for SIP protocol inspection decisions. In the Called Party field, enter a regular expression that identifies the called party in the URI of the SIP To header for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. Calling Party Source or caller specified in the URI of the SIP From header used for SIP protocol inspection decisions. In the Calling Party field, enter a regular expression that identifies the calling party in the URI of the SIP From header for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. IM Subscriber IM (instant messaging) subscriber used for application inspection decisions. In the IP Subscriber field, enter a regular expression that identifies the IM subscriber for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. Message Path SIP inspection that allows you to filter messages coming from or transiting through certain SIP proxy servers. The ACE maintains a list of the unauthorized SIP proxy IP addresses or URLs in the form of regular expressions and checks this list against the VIA header field in each SIP packet. In the Message Path field, enter a regular expression that identifies the SIP proxy server for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. SIP Content Length SIP message body content length used for SIP protocol inspection decisions. To specify SIP traffic based on SIP message body length: a. In the Content Operator field, confirm that Greater Than is selected. b. In the Content Length field, enter the maximum size of a SIP message body in bytes that the ACE is to allow without performing SIP protocol inspection. If a SIP message exceeds the specified value, the ACE performs SIP protocol inspection as defined in an associated policy map. Valid entries are from 0 to 65534 bytes. SIP Content Type Content type in the SIP message body used for SIP protocol inspection decisions. In the Content Type field, enter a regular expression that identifies the content type in the SIP message body to use for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. SIP Request Method SIP request method used for application inspection decisions. In the Request Method field, choose the request method that is to be inspected. 7-29 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries. • Click Deploy Later to save your entries and deploy the configuration at a later time. Related Topics • Configuring Virtual Server Properties, page 7-11 • Configuring Virtual Server SSL Termination, page 7-17 • Configuring Virtual Server Layer 7 Load Balancing, page 7-30 • Managing Virtual Servers, page 7-66 Third Party Condition that indicates that the SIP is to allow users to register other users on their behalf by sending REGISTER messages with different values in the From and To header fields. This process can pose a security threat if the REGISTER message is actually a DEREGISTER message. A malicious user could cause a DoS (denial-of-service) attack by deregistering all users on their behalf. To prevent this security threat, you can specify a list of privileged users who can register or unregister someone else on their behalf. The ACE maintains the list as a regex table. If you configure this policy, the ACE drops REGISTER messages with mismatched From and To headers and a From header value that does not match any of the privileged user IDs. In the Third Party Registration Entities field, enter a regular expression that identifies a privileged user who is authorized for third-party registrations. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. URI Length Condition that indicates that the ACE is to validate the length of SIP URIs or Tel URIs. A SIP URI is a user identifier that a calling party (source) uses to contact the called party (destination). A Tel URI is a telephone number that identifies the endpoint of a SIP connection. For more information about SIP URIs and Tel URIs, see RFC 2534 and RFC 3966, respectively. To filter SIP traffic based on URIs, do the following: a. In the URI Type field, choose the type of URI to be used: – SIP URI—The calling party URI is to be used for this match condition. – Tel URI—A telephone number is to be used for this match condition. b. In the URI Operator field, confirm that Greater Than is selected. c. In the URI Length field, enter the maximum length of the SIP URI or Tel URI in bytes. Valid entries are from 0 to 254 bytes. Table 7-10 SIP Protocol Inspection Conditions and Options (continued) Condition Description 7-30 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Configuring Virtual Server Layer 7 Load Balancing You can configure Layer 7 load balancing on a virtual server. In the Advanced View, Layer 7 load balancing is available for virtual servers configured with one of the following protocol combinations: • TCP with Generic, FTP, HTTP, HTTPS, RDP, RTSP, or SIP • UDP with Generic, DNS, RADIUS, or SIP See the “Configuring Virtual Server Properties” section on page 7-11 for information about configuring these protocols. Table 7-2 identifies the protocols that are available for each type of ACE device. Assumption Make sure that a virtual server has been configured with one of the following protocol combinations: • TCP with Generic, FTP, HTTP, HTTPS, RDP, RTSP, or SIP • UDP with Generic, DNS, RADIUS, or SIP For more information, see the “Configuring Virtual Server Properties” section on page 7-11. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Virtual Servers. The Virtual Servers table appears. Step 2 In the Virtual Servers table, choose the virtual server that you want to configure for Layer 7 load balancing, and click Edit. The Virtual Server configuration window appears. Step 3 In the Virtual Server configuration window, click L7 Load-Balancing. The Layer 7 Load-Balancing Rule Match table appears. Step 4 In the Rule Match table, click Add to add a new match condition and action, or choose an existing match condition and action, and click Edit to modify it. The Rule Match configuration pane appears. Step 5 In the Rule Match field of the Rule Match configuration pane, choose an existing class map or *New* or *Inline Match* to configure new match criteria for Layer 7 load balancing, and do one of the following: • If you chose an existing class map, click View to review, modify, or duplicate the existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. • If you click *New* or *Inline Match*, the Rule Match configuration pane appears. 7-31 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 6 Configure match criteria using the information in Table 7-11. Table 7-11 Layer 7 Load-Balancing Match Criteria Configuration Selection Action Existing class map a. Click View to review the match condition information for the selected class map. b. Do one of the following: – Click Cancel to continue without making changes and to return to the previous window. – Click Edit to modify the existing configuration. – Click Duplicate to create a new class map with the same attributes without affecting other virtual servers using the same class map. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. *New* a. In the Name field, enter a unique name for this class map. b. In the Match field, choose the method to be used to evaluate multiple match statements when multiple match conditions exist: – match-any—A match exists if at least one of the match conditions is satisfied. – match-all—A match exists only if all match conditions are satisfied. c. In the Conditions table, click Add to add a new set of conditions, or choose an existing entry and click Edit to modify it. d. In the Type field, choose the match condition and configure any of these protocol-specific options: – For Generic protocol options, see Table 14-9. – For HTTP and HTTPS protocol options, see Table 7-12. – For RADIUS protocol options, see Table 14-10. – For RTSP protocol options, see Table 14-11. – For SIP protocol options, see Table 14-12. e. Do one of the following: – Click OK to accept your entries and to return to the Conditions table. – Click Cancel to exit this procedure without saving your entries and to return to the Conditions table. *Inline Match* In the Conditions Type field, choose the type of inline match condition and configure any protocol-specific options: • For Generic protocol options, see Table 14-9. • For HTTP and HTTPS protocol options, see Table 7-12. • For RADIUS protocol options, see Table 14-10. • For RTSP protocol options, see Table 14-11. • For SIP protocol options, see Table 14-12. 7-32 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Table 7-12 Layer 7 HTTP/HTTPS Load-Balancing Conditions and Options Match Condition Action Class Map Existing class map used for the match condition. In the Class Map field, choose the class map to be used. HTTP Content Specific content contained within the HTTP entity-body used to establish a match condition. a. In the Content Expression field, enter the content that is to be matched. Valid entries are alphanumeric strings from 1 to 255 characters. b. In the Content Offset field, enter the number of bytes to be ignored starting with the first byte of the Message body, after the empty line (CR,LF,CR,LF) between the headers and the body of the message. Valid entries are from 1 to 255. HTTP Cookie HTTP cookies used for the match condition. a. In the Cookie Name field, enter a unique cookie name. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. b. In the Cookie Value field, enter a unique cookie value expression. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. c. Check the Secondary Cookie Matching check box to indicate that the ACE is to use both the cookie name and the cookie value to satisfy this match condition. Clear this check box to indicate that the ACE is to use either the cookie name or the cookie value to satisfy this match condition. HTTP Header HTTP header and corresponding value used to establish match conditions. a. In the Header Name field, specify the header in one of the following ways: – To specify an HTTP header that is not one of the standard HTTP headers, click the first radio button and enter the HTTP header name in the Header Name field. Enter an unquoted text string with no spaces and a maximum of 64 characters. – To specify one of the standard HTTP headers, click the second radio button and choose the desired HTTP header from the list. b. In the Header Value field, enter the header-value expression string to compare against the value in the specified field in the HTTP header. Valid entries are text strings with a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching. Header expressions allow spaces, provided that the spaces are escaped or quoted. All headers in the header map must be matched. Table 14-33 lists the supported characters that you can use in regular expressions. 7-33 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 7 In the Primary Action field, choose the action that the virtual server is to perform on the traffic if it matches the specified match criteria: • Drop—Client requests for content are to be discarded when match conditions are met. Continue with Step 12. • Forward—Client requests for content are to be forwarded without performing load balancing on the requests when match conditions are met. Continue with Step 12. • Load Balance—Client requests for content are to be directed to a server farm when match conditions are met. Continue with Step 9. • Sticky—Client requests for content are to be handled by a sticky group when match conditions are met. Continue with Step 10. Step 8 (Optional) From the HTTP Header Modify Action List drop-down list, choose an existing Action List or choose New to display the Action List configuration table and create a new one. For more information, see the “Configuring an HTTP Header Modify Action List” section on page 14-85. Step 9 (Optional) If you chose Load Balance as the primary action, do the following: a. In the Server Farm field, choose the primary server farm to use for load balancing, or choose *New* to configure a new server farm (see Table 7-13). If you chose an existing object in this field, you can view, modify, or duplicate the selected object’s existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects in virtual servers. HTTP URL Condition that indicates that the ACE is to perform regular expression matching against the received packet data from a particular connection based on the HTTP URL string. a. In the URL Expression field, enter a URL, or portion of a URL, to match. Valid entries are URL strings from 1 to 255 alphanumeric characters. Include only the portion of the URL following www.hostname.domain in the match statement. For example, in the URL www.anydomain.com/latest/whatsnew.html, include only /latest/whatsnew.html. To match the www.anydomain.com portion, the URL string can take the form of a URL regular expression. The ACE supports regular expressions for matching URL strings. Table 14-33 lists the supported characters that you can use in regular expressions. b. In the Method Expression field, enter the HTTP method to match. Valid entries are unquoted text strings with no spaces and a maximum of 15 alphanumeric characters. The method can either be one of the standard HTTP 1.1 method names (OPTIONS, GET, HEAD, POST, PUT, DELETE, TRACE, or CONNECT) or a text string that must be matched exactly (for example, CORVETTE). Source Address Client source IP address used for the match condition. a. In the Source Address field, enter the source IP address of the client. Enter the IP address in dotted-decimal notation (for example, 192.168.11.2). b. In the Source Netmask field, choose the subnet mask to apply to the source IP address. Table 7-12 Layer 7 HTTP/HTTPS Load-Balancing Conditions and Options (continued) Match Condition Action 7-34 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Note To display statistics and status information for an existing server farm, choose a server farm in the list, and click Details. ANM accesses the show serverfarm name detail CLI command to display detailed server farm information. See the “Displaying Server Farm Statistics and Status Information” section on page 8-48. b. In the Backup Server Farm field, choose the server farm to act as the backup server farm for load balancing if the primary server farm is unavailable, or choose *New* to configure a new backup server farm (see Table 7-13). Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. If you chose an existing object in this field, you can view, modify, or duplicate the selected object’s existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects in virtual servers. Table 7-13 New Server Farm Attributes Field Description Name Unique name for the server farm. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. Type Type of server farm: • Host—A typical server farm that consists of real servers that provide content and services to clients. By default, if you configure a backup server farm and all real servers in the primary server farm go down, the primary server farm fails over to the backup server farm. Use the following options to specify thresholds for failover and returning to service. 1. In the Partial-Threshold Percentage field, enter the minimum percentage of real servers in the primary server farm that must remain active for the server farm to stay up. If the percentage of active real servers falls below this threshold, the ACE takes the server farm out of service. Valid entries are from 0 to 99. 2. In the Back Inservice field, enter the percentage of real servers in the primary server farm that must be active again for the ACE to place the server farm back into service. Valid entries are from 0 to 99. The value in this field should be larger than the value in the Partial Threshold Percentage field. • Redirect—A server farm that consists only of real servers that redirect client requests to alternate locations specified in the real server configuration. Fail Action Action that the ACE takes if any real server in the server farm fails: • N/A—Indicates that the ACE is to take no action if any server in the server farm fails. • Purge—Indicates that the ACE is to remove connections to a real server if that real server in the server farm fails. The ACE sends a reset command to both the client and the server that failed. • Reassign—Indicates that the ACE reassign the existing server connections to the backup real server (if configured) if the real server fails after you enter this command. If a backup real server has not been configured for the failing server, this selection leaves the existing connections untouched in the failing real server. 7-35 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Failaction Reassign Across Vlans Option that is available only for the ACE module A2(3.0), ACE appliance A4(1.0), and later releases of either device type. This field appears only when the L7 Load-Balancing Action parameters are set as follows: Primary Action: LoadBalance; ServerFarm: New; Fail Action: Reassign. Check the check box to specify that the ACE reassigns the existing server connections to the backup real server on a different VLAN interface (commonly referred to as a bypass VLAN) if the real server fails. If a backup real server has not been configured for the failing server, this option has no effect and leaves the existing connections untouched in the failing real server. Note the following configuration requirements and restrictions when you enable this option: • Enable the Transparent option (see the next Field) to instruct the ACE not to use NAT to translate the ACE VIP address to the server IP address. The Failaction Reassign Across Vlans option is intended for use in stateful firewall load balancing (FWLB) on your ACE, where the destination IP address for the connection coming in to the ACE is for the end-point real server, and the ACE reassigns the connection so that it is transmitted through a different next hop. • Enable the MAC Sticky option on all server-side interfaces to ensure that packets that are going to and coming from the same server in a flow will traverse the same firewalls or stateful devices (see the “Configuring Virtual Context VLAN Interfaces” section on page 12-6). • Configure the Predictor Hash Address option. See Table 7-14 for the supported predictor methods and configurable attributes for each predictor method. • You must configure identical policies on the primary interface and the backup-server interface. The backup interface must have the same feature configurations as the primary interface. • If you configure a policy on the backup-server interface that is different from the policies on the primary-server interface, that policy will be effective only for new connections. The reassigned connection will always have only the primary-server interface policies. • Interface-specific features (for example, NAT, application protocol inspection, outbound ACLs, or SYN cookie) are not supported. • You cannot reassign connections to the failed real server after it comes back up. This restriction also applies to same-VLAN backup servers. • Real servers must be directly connected to the ACE. This requirement also applies to same-VLAN backup server. • You must disable sequence number randomization on the firewall (see the “Configuring Connection Parameter Maps” section on page 10-3). • Probe configurations should be similar on both ACEs and the interval values should be low. For example, if you configure a high interval value on ACE-1 and a low interval value on ACE-2, the reassigned connections may become stuck because of the probe configuration mismatch. ACE-2 with the low interval value will detect the primary server failure first and will reassign all its incoming connections to the backup-server interface VLAN. ACE-1 with the high interval value may not detect the failure before the primary server comes back up and will still point to the primary server. To minimize packet loss, we recommend the following probe parameter values on both ACEs: Interval: 2, Faildetect: 2, Passdetect interval: 2, and Passdetect count: 5. Table 7-13 New Server Farm Attributes (continued) Field Description 7-36 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Transparent Field that appears only for real servers identified as host servers. Specify whether network address translation from the VIP address to the server IP is to occur. Check the check box to specify that network address translation from the VIP address to the server IP address is to occur. Uncheck the check box to specify that network address translation from the VIP address to the server IP address is not to occur. Dynamic Workload Scaling Option that is available only with ACE software Version A4(2.0) or later release on either device type (appliance or module). Field that appears only for host server farms. Allows the ACE to burst traffic to remote VMs when the average CPU usage, memory usage, or both of the local VMs has reached it’s specified maximum threshold value. The ACE stops bursting traffic to the remote VMs when the average CPU and/or memory usage of the local VMs has dropped to it’s specified minimum threshold value. This option requires that you have the ACE configured for Dynamic Workload Scaling using a Nexus 7000, VM Controller, and VM probe (see the “Configuring Dynamic Workload Scaling” section on page 8-26). Click one of the following radio button options: • N/A—Not applicable (default). • Local—The ACE can use the VM Controller local VMs only for load balancing (bursting is not allowed). • Burst—Enables the ACE to burst traffic to a remote VMs when needed. When you choose Burst, the VM Probe Name field displays along with a list of available VM probes. Choose an available VM probe or click Add to display the Health Monitoring popup window and create a new VM probe or edit an existing one (see the “Configuring Health Monitoring” section on page 8-49). Fail-On-All Field that appears for host server farms only. By default, real servers that you configure in a server farm inherit the probes that you configure directly on that server farm. When you configure multiple probes on a server farm, the real servers in the server farm use an OR logic with respect to the probes, which means that if one of the probes configured on the server farm fails, all the real servers in that server farm fail and enter the PROBE-FAILED state. With AND logic, if one server farm probe fails, the real servers in the server farm remain in the OPERATIONAL state. If all the probes associated with the server farm fail, then all the real servers in that server farm fail and enter the PROBE-FAILED state. You can also configure AND logic for probes that you configure directly on real servers in a server farm. For more information, see the command in server farm host real server configuration mode. Check this check box to configure the real servers in a server farm to use AND logic with respect to multiple server farm probes. The Fail On All function is applicable to all probe types. Table 7-13 New Server Farm Attributes (continued) Field Description 7-37 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Inband-Health Check Option that is available only for the ACE module A4(1.0), ACE appliance A4(1.0), and later releases of either device type. Field that appears only for host server farms. By default, the ACE monitors the health of all real servers in a configuration through the use of ARPs and health probes. However, there is latency period between when the real server goes down and when the ACE becomes aware of the state. The inband health monitoring feature allows the ACE to monitor the health of the real servers in the server farm through the following connection failures: • For TCP, resets (RSTs) from the server or SYN timeouts. • For UDP, ICMP Host, Network, Port, Protocol, and Source Route unreachable messages. When you configure the failure-count threshold and the number of these failures exceeds the threshold within the reset-time interval, the ACE immediately marks the server as failed, takes it out of service, and removes it from load balancing. The server is not considered for load balancing until the optional resume-service interval expires. The Inband-Health Check attributes are as follows: • Count—Tracks the total number of TCP or UDP failures, and increments the counters. • Log—Logs a syslog error message when the number of events reaches the threshold value that you set for the Connection Failure Threshold Count attribute. • Remove—Logs a syslog error message when the number of events reaches the configured threshold and removes the real server from service. Connection Failure Threshold Count This field appears only when the Inband-Health Check is set to Log or Remove. Enter the maximum number of connection failures that a real server can exhibit in the reset-time interval before ACE marks the real server as failed. Valid entries are as follows: • ACE appliance—Integers from 1 to 4294967295 • ACE module—Integers from 4 to 4294967295 Reset Timeout (Milliseconds) This field appears only when the Inband-Health Check is set to Log or Remove. Enter the number of milliseconds for the reset-time interval. Valid entries are integers from 100 to 300000. The default interval is 100. This interval starts when the ACE detects a connection failure. If the connection failure threshold is reached during this interval, the ACE generates a syslog message. If you configure the Remove attribute, the ACE also removes the real server from service. Changing the setting of this option affects the behavior of the real server, as follows: • When the real server is in the OPERATIONAL state, even if several connection failures have occurred, the new reset-time interval takes effect the next time that a connection error occurs. • When the real server in the INBAND-HM-FAILED state, the new reset-time interval takes effect the next time that a connection error occurs after the server transitions to the OPERATIONAL state. Table 7-13 New Server Farm Attributes (continued) Field Description 7-38 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Resume Service (Seconds) Field that appears only when the Inband-Health Check is set to Remove. Enter the number of seconds after a server has been marked as failed to reconsider it for sending live connections. Valid entries are integers from 30 to 3600. The default setting is 0. The setting of this option affects the behavior of the real server in the inband failed state, as follows: • When this field is not configured and has the default setting of 0, the real server remains in the failed state until you manually suspend and then reactivate it. • When this field is not configured and has the default setting of 0 and then you configure this option with an integer between 30 and 3,600, the failed real server immediately transitions to the Operational state. • When you configure this field and then increase the value, the real server remains in the failed state for the duration of the previously-configured value. The new value takes effect the next time the real server transitions to the failed state. • When you configure this field and then decrease the value, the failed real server immediately transitions to the Operational state. • When you configure this field with an integer between 30 and 3,600 and then reset it to the default of 0, the real server remains in the failed state for the duration of the previously-configured value. The default setting takes effect the next time the real server transitions to the failed state. Then the real server remains in the failed state until you manually suspend and then reactivate it. • When you change this field within the reset-time interval the real server in the OPERATIONAL with several connection failures, the new threshold interval takes effect the next time that a connection error occurs, even if it occurs within the current reset-time interval. Predictor Method for selecting the next server in the server farm to respond to client requests. Round Robin is the default predictor method for a server farm. See Table 7-14 for the supported predictor methods and configurable attributes for each predictor method. Table 7-13 New Server Farm Attributes (continued) Field Description 7-39 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Probes Health monitoring probes to use: • To include a probe that you want to use for health monitoring, choose it in the Available list, and click Add. The probe appears in the Selected list. The redirect real server probe list contains only configured probes of the type Is Routed, which means that the ACE routes the probe address according to the ACE internal routing table (see the “Configuring Health Monitoring” section on page 8-49. Note You can associate both IPv6 and IPv4 probes to a server farm. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Note The list of available probes does not include VM health monitoring probes. To choose a VM probe for monitoring local VM usage, see the Dynamic Workload Scaling field. • To remove a probe that you do not want to use for health monitoring, choose it in the Selected list, and click Remove. The probe appears in the Available list. • To specify a sequence for probe use, choose probes in the Selected list, and click Up or Down until you have the desired sequence. • To view the configuration for an existing probe, choose a probe in the list on the right, and click View to review its configuration. • To display statistics and status information for an existing probe, choose a probe in the list on the right, and click Details. ANM accesses the show probe name detail CLI command to display detailed probe information. See the “Displaying Health Monitoring Statistics and Status Information” section on page 8-77. To add a new probe, click Create. See the “Configuring Health Monitoring for Real Servers” section on page 8-51 for details on adding a new health monitoring probe and defining attributes for the specific probe type. In addition to the probe attributes that you set as described in the “Configuring Health Monitoring for Real Servers” section on page 8-51, set the following probe configuration parameters in the Probes section under Server Farm as described as follows: • Expect Addresses—To configure expect addresses for a DNS probe, in the IPv4/IPv6 Address field, enter the IP address that the ACE is to expect as a server response to a DNS request. You can enter multiple addresses in this field; however, you cannot mix IPv4 and IPv6 addresses. Note IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. • Probe Headers—To configure probe headers for either an HTTP or HTTPS probe, in the Probe Headers field enter the name of the HTTP header and the value to be matched using the format header_name=header_value where: • header_name represents the HTTP header name the probe is to use. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. You can specify predefined header or any custom header name provided that it does not exceed the maximum length limit. • header_value represents the string to assign to the header field. Valid entries are text strings with a maximum of 255 characters. If the string includes spaces, enclose the string with quotes. Table 7-13 New Server Farm Attributes (continued) Field Description 7-40 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Probes (continued) • Probe Expect Status—To configure probe expect status for an FTP, HTTP, HTTPS, RTSP, SIP-TCP, SIP-UDP, or SMTP probe, in the Probe Expect Status field enter the following information: • To configure a single expect status code, enter the minimum expect status code for this probe followed by the same expect status code that you entered as the minimum. Valid entries are from 0 to 999. • To configure a range of expect status codes, enter the lower limit of the range of status codes followed by the upper limit of the range of status codes. The maximum expect status code must be greater than or equal to the value specified for the minimum expect status code. Valid entries are from 0 to 999. • SNMP OID Table—To configure the SNMP OID for an SNMP probe, see the “Configuring an OID for SNMP Probes” section on page 8-76. After you add a probe, you can modify the attributes for a health probe from the Health Monitoring table (Config > Virtual Contexts > context > Load Balancing > Health Monitoring) as described in the “Configuring Health Monitoring for Real Servers” section on page 8-51. You can also delete an existing health probe from the Health Monitoring table. Table 7-13 New Server Farm Attributes (continued) Field Description 7-41 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Real Servers Table that allows you to add, modify, remove, or change the order of real servers. a. Choose an existing server, or click Add to add a server to the server farm and do one of the following: – If you chose an existing server, you can view, modify, or duplicate the server’s existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. – If you click Add, the window refreshes so you can enter server information. b. In the Name field, specify the name of the real server in one of the following ways: – To identify a new real server, click the first radio button, and then enter the name of the real server in the adjoining field. – To specify an existing real server, click the second radio button, and then choose one of the real servers listed. c. In the IP Address Type field, choose IPv4 or IPv6. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. d. In the IP Address field, enter the IP address of the real server. e. In the Port field, enter the port number to be used for server port address translation (PAT). Valid entries are from 1 to 65535. f. In the Weight field, enter the weight to assign to this server in the server farm. Valid entries are from 1 to 100, and the default is 8. g. In the Redirection Code field, choose the appropriate redirection code. This field appears only for real servers identified as redirect servers. – N/A—Indicates that the webhost redirection code is not defined. – 301—Indicates that the requested resource has been moved permanently. For future references to this resource, the client should use one of the returned URIs. – 302—Indicates that the requested resource has been found, but has been moved temporarily to another location. For future references to this resource, the client should use the request URI because the resource may be moved to other locations from time to time. h. In the Web Host Redirection field, enter the URL string used to redirect requests to another server. This field appears only for real servers identified as redirect servers. Enter the URL and port used to redirect requests to another server. Valid entries are in the form http://host.com:port where host is the name of the server and port is the port to be used. Valid host entries are unquoted text strings with no spaces and a maximum of 255 characters. Valid port numbers are from 1 to 65535. The relocation string supports the following special characters: – %h—Inserts the hostname from the request Host header – %p—Inserts the URL path string from the request i. In the Rate Bandwidth field, enter the real server bandwidth limit in bytes per second. Valid entries are from 1 to 300000000 bytes. j. In the Rate Connection field, enter the limit for connections per second (valid entries are from 1 to 350000) and do one of the following: – Click OK to accept your entries and add this real server to the server farm. The table refreshes with updated information. – Click Cancel to exit this procedure without saving your entries and to return to the Real Servers table. Table 7-13 New Server Farm Attributes (continued) Field Description 7-42 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers k. In the State field, choose the administrative state of this server as follows: – In Service—The server is to be placed in use as a destination for server load balancing. – In Service Standby—The server is a backup server and remains inactive unless the primary server fails. If the primary server fails, the backup server becomes active and starts accepting connections. – Out Of Service—The server is not to be placed in use by a server load balancer as a destination for client connections. l. In the Fail-On-All field, check this check box to configure a real server to remain in the OPERATIONAL state unless all probes associated with it fail (AND logic). The Fail-On-All function is applicable to all probe types. Fail-On-All is applicable only for host real servers. m. Do one of the following: – Click OK to accept your entries and add this real server to the server farm. The table refreshes with updated information. – Click Cancel to exit this procedure without saving your entries and to return to the Real Servers table. To display statistics and status information for an existing real server, choose a real server in the list, and then click Details. ANM accesses the show rserver name detail CLI command to display detailed real server information. See the “Displaying Real Server Statistics and Status Information” section on page 8-9. Table 7-14 Predictor Methods and Attributes Predictor Method Description / Action Hash Address Method that indicates that the ACE is to select the server using a hash value based on the source or destination IP address. To configure the hash address predictor method, do the following: a. In the Mask Type field, indicate whether server selection is based on the source IP address or the destination IP address: – N/A—Indicates that this option is not defined. – Destination—Indicates that the server is selected based on the destination IP address. – Source—Indicates that the server is selected based on the source IP address. b. In the IP Netmask field, choose the subnet mask to apply to the address. If none is specified, the default is 255.255.255.255. Table 7-13 New Server Farm Attributes (continued) Field Description 7-43 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Hash Content Method that indicates that the ACE is to select the server by using a hash value based on the specified content string of the HTTP packet body. a. In the Begin Pattern field, enter the beginning pattern of the content string and the pattern string to match before hashing. If you do not specify a beginning pattern, the ACE starts parsing the HTTP body immediate following the offset byte. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. b. In the End Pattern field, enter the pattern that marks the end of hashing. If you do not specify either a length or an end pattern, the ACE continues to parse the data until it reaches the end of the field or the end of the packet, or until it reaches the maximum body parse length. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. c. In the Length (Bytes) field, enter the length in bytes of the portion of the content (starting with the byte after the offset value) that the ACE uses for sticking the client to the server. Valid entries are from 1 to 1000 bytes. The offset and length can vary from 0 to 1000 bytes. If the payload is longer than the offset but shorter than the offset plus the length of the payload, the ACE sticks the connection based on that portion of the payload starting with the byte after the offset value and ending with the byte specified by the offset plus the length. The total of the offset and the length cannot exceed 1000. Note You cannot specify both the length and the end-pattern options for a Hash Content predictor. d. In the HTTP Content Offset (Bytes) field, enter the portion of the content that the ACE uses to stick the client on a particular server by indicating the bytes to ignore starting with the first byte of the payload. Valid entries are from 0 to 999 bytes. The default is 0, which indicates that the ACE does not exclude any portion of the content. Hash Cookie Method that indicates that the ACE is to select the server by using a hash value based on the cookie name. In the Cookie Name field, enter a cookie name in the form of an unquoted text string with no spaces and a maximum of 64 characters. Hash Header Method that indicates that the ACE is to select the server by using a hash value based on the header name. In the Header Name field, choose the HTTP header to be used for server selection as follows: • To specify an HTTP header that is not one of the standard HTTP headers, click the first radio button and enter the HTTP header name in the Header Name field. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. • To specify one of the standard HTTP headers, click the second radio button, and then choose one of the HTTP headers from the list. Table 7-14 Predictor Methods and Attributes (continued) 7-44 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Hash Layer 4 Method that indicates that the ACE is to select the server by using a Layer 4 generic protocol load-balancing method. Use this predictor to load balance packets from protocols that are not explicitly supported by the ACE. a. In the Begin Pattern field, enter the beginning pattern of the Layer 4 payload and the pattern string to match before hashing. If you do not specify a beginning pattern, the ACE starts parsing the HTTP body immediate following the offset byte. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. b. In the End Pattern field, enter the pattern that marks the end of hashing. If you do not specify either a length or an end pattern, the ACE continues to parse the data until it reaches the end of the field or the end of the packet, or until it reaches the maximum body parse length. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. c. In the Length (Bytes) field, enter the length in bytes of the portion of the payload (starting with the byte after the offset value) that the ACE uses for sticking the client to the server. Valid entries are from 1 to 1000 bytes. The offset and length can vary from 0 to 1000 bytes. If the payload is longer than the offset but shorter than the offset plus the length of the payload, the ACE sticks the connection based on that portion of the payload starting with the byte after the offset value and ending with the byte specified by the offset plus the length. The total of the offset and the length cannot exceed 1000. Note You cannot specify both the length and end-pattern options for a Hash Layer 4 predictor. d. In the HTTP Content Offset (Bytes) field, enter the portion of the content that the ACE uses to stick the client on a particular server by indicating the bytes to ignore starting with the first byte of the payload. Valid entries are from 0 to 999 bytes. The default is 0, which indicates that the ACE does not exclude any portion of the content. Hash URL Method that indicates that the ACE is to select the server using a hash value based on the URL. Use this method to load balance firewalls. Enter values in one or both of the pattern fields: • In the URL Begin Pattern field, enter the beginning pattern of the URL and the pattern string to parse. • In the URL End Pattern field, enter the ending pattern of the URL and the pattern string to parse. Valid entries for these fields are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters for each pattern you configure. Table 7-14 Predictor Methods and Attributes (continued) 7-45 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Least Bandwidth Method that indicates that the ACE is to select the server with the least amount of network traffic over a specified sampling period. a. In the Assess Time field, enter the number of seconds for which the ACE is to collect traffic information. Valid entries are from 1 to 10 seconds. b. In the Least Bandwidth Samples field, enter the number of samples over which you want to weight and average the results of the probe query to calculate the final load value. Valid entries are 1, 2, 4, 8, and 16 (values from 1 to 16 that are also a power of 2). Least Connections Method that indicates that the ACE is to select the server with the fewest number of connections. In the Slowstart Duration field, enter the slow-start value to be applied to this predictor method. Valid entries are from 1 to 65535, where 1 is the slowest ramp-up value. The slow-start mechanism is used to avoid sending a high rate of new connections to servers that you have just put into service. Least Loaded Method that indicates that the ACE is to select the server with the lowest load based on information from SNMP probes. a. In the SNMP Probe Name field, choose the name of the SNMP probe to use. b. In the Auto Adjust field, configure the autoadjust feature to assign a maximum load value of 16000 to that server to prevent it from being flooded with new incoming connections. The ACE periodically adjusts this load value based on feedback from the server's SNMP probe and other configured options. Options include: – Average—Instructs the ACE to apply the average load of the server farm to a real server whose load reaches zero. The average load is the running average of the load values across all real servers in the server farm. This is the default setting. – Maxload—Instructs the ACE to apply the maximum load of the server farm to a real server whose load reaches zero. The maxload option requires the following ACE software versions: - ACE appliance—A3(2.7) or A4(1.0) or later - ACE module—A2(2.4), A2(3.2), or A4(1.0) or later If you choose the maxload option and the ACE does not support the option, ANM issues a command parse error message. – Off—Instructs the ACE to send all new connections to the server that has a load of zero until the next load update arrives from the SNMP probe for this server. There may be times when you want the ACE to send all new connections to a real server whose load is zero. c. In the Weight Connection field, check the check box to instruct the ACE to use the current connection count in the final load calculation for a real server. When you configure this option, the ACE includes the current connection count in the total load calculation for each real server in a server farm. Uncheck the check box to reset the behavior of the ACE to the default of excluding the current connection count from the load calculation. Table 7-14 Predictor Methods and Attributes (continued) 7-46 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 10 (Optional) If you chose Sticky as the primary action, in the Sticky Group field, choose an existing sticky group or click *New* to add a new sticky group (Table 7-15). Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Note If you chose an existing sticky group, you can view, modify, or duplicate the selected object’s existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects in virtual servers. Response Method that indicates that the ACE is to select the server with the lowest response time for a requested response-time measurement. a. In the Response Type field, choose the type of measurement to use: – App-Req-To-Resp—The response time from when the ACE sends an HTTP request to a server to the time that the ACE receives a response from the server for that request. – Syn-To-Close—The response time from when the ACE sends a TCP SYN to a server to the time that the ACE receives a CLOSE from the server. – Syn-To-Synack—The response time from when the ACE sends a TCP SYN to a server to the time that the ACE receives a SYN-ACK from the server. b. In the Response Samples field, enter the number of samples over which you want to average the results of the response-time measurement. Valid entries are 1, 2, 4, 8, and 16 (values from 1 to 16 that are also a power of 2). c. In the Weight Connection field, check the check box to instruct the ACE to use the current connection count in the final load calculation for a real server. When you configure this option, the ACE includes the current connection count in the total load calculation for each real server in a server farm. Uncheck the check box to reset the behavior of the ACE to the default of excluding the current connection count from the load calculation. Round Robin Method that indicates that the ACE is to select the next server in the list of servers based on server weight. This is the default predictor method. Table 7-14 Predictor Methods and Attributes (continued) 7-47 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Table 7-15 Sticky Group Attributes Field Description Group Name Unique identifier for the sticky group. You can either accept the automatically incremented entry that was provided or you can enter your own. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Type Method to be used when establishing sticky connections and configure any type-specific attributes: Note The available selections listed in the Type drop-down list will vary depending on your selection for Application Protocol in the Properties configuration subset (see Table 7-2). For example, if you chose HTTP or HTTPS as the application protocol, only IP Netmask, HTTP Cookie, HTTP Header, and HTTP Content appear as selections in the Type drop-down list. • HTTP Content—The virtual server is to stick client connections to the same real server based on a string in the data portion of the HTTP packet. See Table 9-2 for additional configuration options. • HTTP Cookie—The virtual server is either to learn a cookie from the HTTP header of a client request or to insert a cookie in the Set-Cookie header of the response from the server to the client, and then use the learned cookie to provide stickiness between the client and server for the duration of the transaction. See Table 9-3 for additional configuration options. • HTTP Header—The virtual server is to stick client connections to the same real server based on HTTP headers. See Table 9-4 for additional configuration options. • IP Netmask—The virtual server is to stick a client to the same server for multiple subsequent connections as needed to complete a transaction using the client source IPv4 address, the destination IPv4 address, or both. See Table 9-5 for additional configuration options. Note If an organization uses a megaproxy to load balance client requests across multiple proxy servers when a client connects to the Internet, the source IP address is no longer a reliable indicator of the true source of the request. In this situation, you can use cookies or another sticky method to ensure session persistence. • V6 Prefix—(Requires ACE module and ACE appliance software Version A5(1.0) or later) Indicates that the virtual server is to stick a client to the same server for multiple subsequent connections as needed to complete a transaction using the client source IPv6 address, the destination IPv6 address, or both. See Table 9-6 for additional configuration options. • Layer 4 Payload—The virtual server is to stick client connections to the same real server based on a string in the payload portion of the Layer 4 protocol packet. See Table 9-7 for additional configuration options. • RADIUS—The virtual server is to stick client connections to the same real server based on a RADIUS attribute. • RTSP Header—The virtual server is to stick client connections to the same real server based on the RTSP Session header field. Table 9-9 for additional configuration options. • SIP Header—The virtual server is to stick client connections to the same real server based on the SIP Call-ID header field. Sticky Server Farm Existing server farm that is to act as the primary server farm for this sticky group. You can choose *New* to create a new server farm. If you chose *New*, configure the server farm using the information in Table 7-13. Backup Server Farm Existing server farm that is to act as the backup server farm this sticky group. You can choose *New* to create a new server farm. If you chose *New*, configure the server farm using the information in Table 7-13. 7-48 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 11 (Optional) If you are using the ACE appliance (all versions) or ACE module version A4(1.0) and later, in the Compression Method field, choose the HTTP compression method to indicate how the ACE appliance is to compress packets when a client request indicates that the client browser is capable of packet compression. By default, HTTP compression is disabled in the ACE. When you configure HTTP compression using the ACE, the appliance compresses data in the HTTP GET responses from the real servers. The ACE does not compress HTTP requests from clients or the HTTP headers in the server responses. Note By default, the ACE appliance supports HTTP compression at rates of 100 megabits per second (Mbps). Installing an optional HTTP compression license allows you to increase this value to a maximum of 2 Gbps. See the Cisco 4700 Series Application Control Engine Appliance Administration Guide for information on ACE licensing options. Options are as follows: • Gzip—Specifies the gzip compression format as the method to use when the client browser supports both the deflate and gzip compression methods. Gzip is the file format for compression described in RFC1952. • Deflate—Specifies the deflate compression format as the method to use when the client browser supports both the deflate and gzip compression methods. Deflate is the data format for compression described in RFC1951. • N/A—HTTP compression is disabled. Aggregate State Check box to indicate that the state of the primary server farm is to be tied to the state of all real servers in the server farm and in the backup server farm, if configured. The ACE declares the primary server farm down if all real servers in the primary server farm and all real servers in the backup server farm are down. Uncheck the check box if the state of the primary server farm is not to be tied to all real servers in the server farm and in the backup server farm. Sticky Enabled On Backup Server Farm Check box to indicate that the backup server farm is sticky. Uncheck the check box if the backup server farm is not sticky. Replicate On HA Peer Check box to indicate that the virtual server is to replicate sticky table entries on the backup server farm. If a failover occurs and this option is selected, the new active server farm can maintain the existing sticky connections. Uncheck the check box to indicate that the virtual server is not to replicate sticky table entries on the backup server farm. Timeout (Minutes) Number of minutes that the virtual server keeps the sticky information for a client connection in the sticky table after the latest client connection terminates. Valid entries are from 1 to 65535; the default is 1440 minutes (24 hours). Timeout Active Connections Check box to specify that the virtual server is to time out sticky table entries even if active connections exist after the sticky timer expires. Uncheck the check box to specify that the virtual is not to time out sticky table entries even if active connections exist after the sticky timer expires. This behavior is the default. Table 7-15 Sticky Group Attributes (continued) Field Description 7-49 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers When configuring HTTP compression, we recommend that you exclude the following MIME types from HTTP compression: “.*gif”, “.*css”, “.*js”, “.*class”, “.*jar”, “.*cab”, “.*txt”, “.*ps”, “.*vbs”, “.*xsl”, “.*xml”, “.*pdf”, “.*swf”, “.*jpg”, “.*jpeg”, “.*jpe”, or “.*png”. When you enable HTTP compression, the ACE compresses the packets using the following default compression parameter values: • Mime type—All text formats (text/*). • Minimum size—512 bytes. • User agent—None. Step 12 In the SSL Initiation field, choose an existing service or choose *New* to create a new service, and do one of the following: • If you chose an existing SSL service, you can view, modify, or duplicate the existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. • If you chose *New*, configure the service using the information in Table 7-5. For more information about SSL, see the “Configuring SSL” section on page 11-1. Step 13 In the Insert HTTP Headers field, enter the name of the HTTP header and the value to be matched using the header_name=header_value format where: • header_name represents the name of the HTTP header to insert in the client HTTP request. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. You can specify predefined header or any custom header name provided that it does not exceed the maximum length limit. • header_value represents the expression string to compare against the value in the specified field in the HTTP header. Valid entries are text strings with a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching. Header expressions allow spaces, provided that the spaces are escaped or quoted. All headers in the header map must be matched. Table 14-33 lists the supported characters that you can use in regular expressions. For example, you might enter Host=www.cisco.com. Step 14 Do one of the following: • Click OK to save your entries and to return to the Rule Match table. • Click Cancel to exit this procedure without saving your entries and to return to the Rule Match table. Step 15 If you are adding Rule Match entries for a new virtual server and you want to modify the sequence of rules in the L7 Load Balancing section of the Virtual Server configuration page, click Up or Down to change the order of the entries in the Rule Match table. Note The Up and Down buttons are not available for an existing virtual server, only for a new virtual server. To reorder the entries in the Rule Match table for an existing virtual server, go to Config > Expert > Policy Maps and choose the Layer 7 load balancing policy map, delete the rule entry that you want to reorder, and then add it again by using the Insert Before option to put it in the correct order. See the “Configuring Rules and Actions for Policy Maps” section on page 14-34 for details. Step 16 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries. 7-50 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers • Click Deploy Later to save your entries and apply them at a later time. Related Topics • Configuring Virtual Servers, page 7-2 • Configuring Virtual Server Properties, page 7-11 • Configuring Virtual Server SSL Termination, page 7-17 • Configuring Virtual Server Protocol Inspection, page 7-18 Configuring Virtual Server Default Layer 7 Load Balancing You can configure default Layer 7 load-balancing actions for all network traffic that does not meet previously specified match conditions. Assumption Make sure that a virtual server has been configured in the Properties configuration subset. For more information, see the “Configuring Virtual Server Properties” section on page 7-11. See the “Configuring Virtual Servers” section on page 7-2 for information on configuring a virtual server. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Virtual Servers. The Virtual Servers table appears. Step 2 In the Virtual Servers table, choose the virtual server that you want to configure for default Layer 7 load balancing, and click Edit. The Virtual Server configuration window appears. Step 3 In the Virtual Server configuration window, click Default L7 Load-Balancing Action. The Default L7 Load-Balancing Action configuration pane appears. Step 4 In the Primary Action field of the Default L7 Load-Balancing Action configuration pane, choose the default action that the virtual server is to take in response to client requests for content when specified match conditions are not met: • Drop—Client requests that do not meet specified match conditions are to be discarded. Continue with Step 9. • Forward—Client requests that do not meet specified match conditions are to be forwarded without performing load balancing on the requests. Continue with Step 9. • Load Balance—Client requests for content are to be directed to a server farm. Continue with Step 6. • Sticky—Client requests for content are to be handled by a sticky group when match conditions are met. Continue with Step 7. Step 5 (Optional) From the HTTP Header Modify Action List drop-down list, choose an existing Action List or choose New to display the Action List configuration table and create a new one. For more information, see the “Configuring an HTTP Header Modify Action List” section on page 14-85. 7-51 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 6 (Optional) If you chose Load Balance as the primary action, do the following: a. In the Server Farm field, choose the primary server farm to use for load balancing, or choose *New* to configure a new server farm (see Table 7-13). Note To display statistics and status information for an existing server farm, choose a server farm in the list, and then click Details. ANM accesses the show serverfarm name detail CLI command to display detailed server farm information. See the “Displaying Server Farm Statistics and Status Information” section on page 8-48. b. In the Backup Server Farm field, choose the server farm to act as the backup server farm for load balancing if the primary server farm is unavailable, or choose *New* to configure a new backup server farm (see Table 7-13). Note If you chose an existing object in either field, you can view, modify, or duplicate the selected object’s existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects in virtual servers. Step 7 (Optional) If you chose Sticky as the primary action, in the Sticky Group field, choose an existing sticky group or click *New* to add a new sticky group (see Table 7-15). Note If you chose an existing sticky group, you can view, modify, or duplicate the selected object’s existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects in virtual servers. Step 8 (Optional) If you are using the ACE appliance (all versions) or ACE module version A4(1.0) and later, in the Compression Method field, choose the HTTP compression method to indicate how the ACE appliance is to compress packets when a client request indicates that the client browser is capable of packet compression. By default, HTTP compression is disabled in the ACE. When you configure HTTP compression using the ACE, the appliance compresses data in the HTTP GET responses from the real servers. The ACE does not compress HTTP requests from clients or the HTTP headers in the server responses. Note By default, the ACE appliance supports HTTP compression at rates of 100 megabits per second (Mbps). Installing an optional HTTP compression license allows you to increase this value to a maximum of 2 Gbps. See the Cisco 4700 Series Application Control Engine Appliance Administration Guide for information on ACE licensing options. Options are as follows: • Deflate—Specifies the deflate compression format as the method to use when the client browser supports both the deflate and gzip compression methods. deflate, the data format for compression described in RFC1951. • Gzip—Specifies the gzip compression format as the method to use when the client browser supports both the deflate and gzip compression methods. Gzip is the file format for compression described in RFC1952. • N/A—HTTP compression is disabled. 7-52 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Note If you enable the Gzip or Deflate compression format, ANM automatically inserts a L7 Load Balance Primary Action to exclude the MIME types listed above. However, if you disable HTTP compression later on, you will need to remove the auto-inserted Load Balance Primary Action. When you enable HTTP compression, the ACE compresses the packets using the following default compression parameter values: • Mime type—All text formats (text/*). • Minimum size—512 bytes. • User agent—None. Step 9 In the SSL Initiation field, choose an existing service or choose *New* to create a new service: • If you chose an existing SSL service, you can view, modify, or duplicate the existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. • If you chose *New*, configure the service using the information in Table 7-5. For more information about SSL, see the “Configuring SSL” section on page 11-1. Step 10 In the Insert HTTP Headers field, enter the name of the HTTP header and the value to be matched using the header_name=header_value format where: • header_name represents the name of the HTTP header to insert in the client HTTP request. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. You can specify predefined header or any custom header name provided that it does not exceed the maximum length limit. • header_value represents the expression string to compare against the value in the specified field in the HTTP header. Valid entries are text strings with a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching. Header expressions allow spaces, provided that the spaces are escaped or quoted. All headers in the header map must be matched. Table 14-33 lists the supported characters that you can use in regular expressions. For example, you might enter Host=www.cisco.com. Step 11 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Virtual Servers table. • Click Deploy Later to save your entries and apply the configuration at a later time. Related Topics • Configuring Virtual Server Properties, page 7-11 • Configuring Virtual Server SSL Termination, page 7-17 • Configuring Virtual Server Protocol Inspection, page 7-18 • Configuring Virtual Server Layer 7 Load Balancing, page 7-30 7-53 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Configuring Application Acceleration and Optimization Note This option is available only for ACE appliances and only in the Advanced View. You can configure acceleration and optimization on virtual servers that are configured on ACE appliances. The ACE appliance includes configuration options that allow you to accelerate enterprise applications, resulting in increased employee productivity, enhanced customer retention, and increased online revenues. The application acceleration functions of the ACE appliance apply several optimization technologies to accelerate Web application performance. This application acceleration functionality enables enterprises to optimize network performance and improve access to critical business information. It also accelerates the performance of Web applications, including customer relationship management (CRM), portals, and online collaboration by up to 10 times. See the “Configuring Application Acceleration and Optimization” section on page 15-1 or the Cisco 4700 Series Application Control Engine Appliance Application Acceleration and Optimization Configuration Guide for more information about application acceleration and optimization. Assumption Make sure that a virtual server has been configured on an ACE appliance with HTTP or HTTPS as the application protocol. See the “Configuring Virtual Servers” section on page 7-2 for information about configuring a virtual server. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Virtual Servers. The Virtual Servers table appears. Step 2 In the Virtual Servers table, choose the virtual server that you want to configure for optimization, and click Edit. The Virtual Server configuration window appears. Step 3 In the Virtual Server configuration window, click Application Acceleration And Optimization. The Application Acceleration And Optimization configuration pane appears. Step 4 In the Configuration field of the Application Acceleration And Optimization configuration pane, choose the method that you want to use to configure application acceleration and optimization: • EZ—Use standard acceleration and optimization options. Continue with Step 5. • Custom—Associate specific match criteria, actions, and parameter maps for application acceleration and optimization for the virtual server. If you choose this option, continue with Step 6 through Step 14. Step 5 (Optional) If you chose EZ, the Latency Optimization (FlashForward) and Bandwidth Optimization (Delta) fields appear. Do the following: a. Check the Latency Optimization (FlashForward) check box to specify that the ACE appliance is to use bandwidth reduction and download acceleration techniques to objects embedded within HTML pages. Uncheck the check box to specify that the ACE appliance is not to employ these techniques to objects embedded within HTML pages. Latency optimization corresponds to FlashForward functionality. For more information about FlashForward functionality, see the “Optimization Overview” section on page 15-2. 7-54 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers b. Check the Bandwidth Optimization (Delta) check box to specify that the ACE appliance is to dynamically update client browser caches with content differences, or deltas. Uncheck the check box to specify that the ACE appliance is not to dynamically update client browser caches. Bandwidth optimization corresponds to action list Delta optimization. For more information about configuring Delta optimization, see the “Optimization Overview” section on page 15-2 and the “Configuring an HTTP Optimization Action List” section on page 15-3. c. Continue with Step 14. Step 6 (Optional) If you chose Custom, the Actions configuration pane appears with a table listing match criteria and actions. Click Add to add an entry to this table or choose an existing entry, and click Edit to modify it. The configuration pane refreshes with the available configuration options. Step 7 In the Apply Building Block field, choose one of these configuration building blocks for the type of optimization that you want to configure, or leave the field blank to configure optimization without a building block: • Bandwidth Optimization—Maximizes bandwidth for Web-based traffic. • Latency Optimization for Embedded Objects—Reduces the latency associated with embedded objects in Web-based traffic. • Latency Optimization for Embedded Images—Reduces the latency associated with embedded images in Web-based traffic. • Latency Optimization for Containers—Reduces the latency associated with Web containers. If you chose one of the building blocks, the Rule Match configuration subset displays the configuration options with selections based on the building block chosen. You can accept the entries as they are or modify them. If you do not choose a building block, additional configuration options appear depending on the features you enable. Step 8 In the Rule Match field, choose an existing class map or click *New* to specify new match criteria, and do one of the following: • If you chose an existing class map, you can view, modify, or duplicate the existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. • If you click *New*, the window refreshes so that you can enter new match criteria. Step 9 Configure match criteria using the information in Table 7-16. Table 7-16 Optimization Match Criteria Configuration Field Description/Action Name Unique name for this match criteria rule. 7-55 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 10 In the Actions field, choose an existing action list to use for optimization or click *New* to create a new action list, and do one of the following: • If you chose an existing action list, you can view, modify, or duplicate the existing configuration. See the “Shared Objects and Virtual Servers” section on page 7-9 for more information about modifying shared objects. • If you click *New*, the window refreshes so you can configure an action list. Step 11 Configure the action list using the information in Table 7-17. Match Method to be used to evaluate multiple match statements when multiple match conditions exist: • match-any—A match exists if at least one of the match conditions is satisfied. • match-all—A match exists only if all match conditions are satisfied. Conditions Field that allows you to add a new set of conditions or choose an existing entry. Click Add to add a new set of conditions, or choose an existing entry and click Edit to modify it: a. In the Type field, choose the match condition to be used, then configure any condition-specific options using the information in Table 7-12. b. Click OK to save your entries, or Cancel to exit this procedure without saving your entries. Table 7-16 Optimization Match Criteria Configuration (continued) Field Description/Action Table 7-17 Optimization Action List Configuration Options Field Description Action List Name Unique name for the action list. Valid entries are unquoted text strings with a maximum of 64 alphanumeric characters. Enable Delta Check box that enables delta optimization for the specified URLs. Delta optimization that dynamically updates client browser caches directly with content differences, or deltas, resulting in faster page downloads. Uncheck the check box to disable this feature. If you are configuring optimization without a building block, additional options appear. Configure these options using the information in Table 7-18. Enable AppScope Check box that enables AppScope performance monitoring for use with the ACE appliance. AppScope runs on the Management Console of the optional Cisco AVS 3180A Management Station and measures end-to-end application performance. Uncheck the check box to disable this feature. If you are configuring optimization without a building block, additional options appear. Configure these options using the information in Table 7-18. 7-56 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Flash Forward Feature that reduces bandwidth usage and accelerates embedded object downloading by combining local object storage with dynamic renaming of embedded objects, which enforces object freshness within the parent HTML page. Choose how the ACE appliance is to implement FlashForward: • N/A—This feature is not enabled. • Flash Forward—FlashForward is to be enabled for the specified URLs and embedded objects are to be transformed. • Flash Forward Object—FlashForward static caching is to be enabled for the objects that the corresponding URLs refer to, such as Cascading Style Sheets (CSS), JPEG, and GIF files. If you are configuring without a building block and chose either FlashForward or FlashForward Object, an addition option appears. Configure this option using the information in Table 7-18. Cache Dynamic Check box that enables Adaptive Dynamic Caching for the specified URLs even if the expiration settings in the response indicate that the content is dynamic. The expiration of cache objects is controlled by the cache expiration settings based on time or server load. Uncheck the check box to disable this feature. Cache Forward Field that specifies how the ACE appliance is to implement cache forwarding: • N/A—This feature is not enabled. • With Wait—Cache forwarding is enabled with the wait option for the specified URLs. If the object has expired but the maximum cache TTL time period has not yet expired, the ACE appliance sends a request to the origin server for the object. Users requesting this page continue to receive content from the cache during this time but must wait for the object to be updated before their request is satisfied. When the fresh object is returned, it is sent to the requesting user and the cache is updated. • Without Wait—Cache forwarding is enabled without the wait option. Dynamic Entity Tag Check box that specifies that the ACE appliance is to implement just-in-time object acceleration for embedded objects not able to be cached. This feature enables the acceleration of embedded objects not able to be cached, which results in improved application response time. When enabled, this feature eliminates the need for users to download objects not able to be cached on each request. Uncheck the check box to disable this feature. Table 7-17 Optimization Action List Configuration Options (continued) Field Description 7-57 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 12 (Optional) If you are configuring optimization without a building block, additional options appear when you enable specific features. Configure the additional options using the information in Table 7-18. Table 7-18 Application Acceleration and Optimization Additional Configuration Options Field Description Response Codes To Ignore (Comma Separated) Comma-separated list of HTTP response codes for which the response body must not be read. For example, an entry of 302 indicates that the ACE is to ignore the response body of a 302 (redirect) response from the origin server. Valid entries are unquoted text strings with a maximum of 64 alphanumeric characters. Set Browse Freshness Period Method that the ACE is to use to determine the freshness of objects in the client’s browser: • N/A—This option is not configured. • Disable Browser Object Freshness Control—Browser freshness control is not to be used. • Set Freshness Similar To Flash Forward Objects—The ACE is to set freshness similar to that used for FlashForwarded objects, and to use the values specified in the Maximum Time for Cache Time-To-Live and Minimum Time For Cache Time-To-Live fields. Duration For Browser Freshness (Seconds) Field that appears if the Set Browser Freshness Period option is not configured. Enter the number of seconds that objects in the client’s browser are considered fresh. Valid entries are 0 to 2147483647 seconds. Enable Delta Options Max. For Post Data To Scan For Logging (kBytes) Maximum number of kilobytes of POST data the ACE is to scan for parameters for the purpose of logging transaction parameters in the statistics log. Valid entries are 0 to 1000 KB. Base File Anonymous Level Feature that enables the ACE to create and deliver condensed base files that contain only information that is common to a large set of users. No information unique to a particular user, or across a very small subset of users, is included in anonymous base files. Information that is common to a large set of users is generally not confidential or user-specific. Conversely, information that is unique to a specific user or a small set of users is generally confidential or user-specific. Enter the value for base file anonymity for the all-user condensation method. Valid entries are from 0 to 50; the default value of 0 disables the base file anonymity feature. Cache-Key Modifier Expression Unique identifier that is used to identify a cached object to be served to a client, replacing a trip to the origin server. The cache key modifier feature allows you to modify the canonical form of a URL; that is, the portion before “?” in a URL. For example, the canonical URL of http://www.xyz.com/somepage.asp?action=browse&level=2 is http://www.xyz.com/somepage.asp. Enter a regular expression containing embedded variables as described in Table 7-19. The ACE transforms URLs specified in class maps for this virtual server with the expression and variable entered here. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. If the string includes spaces, enclose the string with quotation marks (“). 7-58 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Min. Time For Cache Time-To-Live (Seconds) Minimum number of seconds that an object without an explicit expiration time should be considered fresh in the ACE cache. This value specifies the minimum time that content can be cached. If the ACE is configured for FlashForward optimization, this value should normally be 0. If the ACE is configured for dynamic caching, this value should indicate how long the ACE should cache the page. (See Table 7-17 for information about these configuration options.) Valid entries are 0 to 2147483647 seconds. Max. Time For Cache Time-To-Live (Seconds) Maximum number of seconds that an object without an explicit expiration time should be considered fresh in the ACE cache. Valid entries are 0 to 2147483647 seconds. Cache Time-To-Live Duration (%) Percent of an object’s age at which an embedded object without an explicit expiration time is considered fresh. Valid entries are 0 to 100 percent. Expression To Modify Cache Key Query Parameter Feature that allows you to modify the query parameter of a URL; that is, the portion after “?” in a URL. For example, the query parameter portion of http://www.xyz.com/somepage.asp?action=browse&level=2 is action=browse&level=2. Enter a regular expression containing embedded variables as described in Table 7-19. The ACE transforms URLs specified in class maps for this virtual server with the expression and variable entered here. If no string is specified, the query parameter portion of the URL is used as the default value for this portion of the cache key. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. Canonical URL Expressions Canonical URL feature to eliminate the “?” and any characters that follow to identify the general part of the URL. This general URL is then used to create the base file. In this way, the ACE maps multiple URLs to a single canonical URL. Enter a comma-separated list of parameter expander functions as defined in Table 7-19 to identify the URLs to associate with this parameter map. Valid entries are unquoted text strings with a maximum of 255 alphanumeric characters. Enable Cacheable Content Optimization Check box that enables delta optimization of content that can be cached. This feature allows the ACE to detect content that can be cached and perform delta optimization on it. Uncheck the check box to disable this feature. Enable Delta Optimization On First Visit To Web Page Check box that enables condensation on the first visit to a Web page. Uncheck the check box to disable this feature. Min. Page Size For Delta Optimization (Bytes) Minimum page size, in bytes, that can be condensed. Valid entries are from 1 to 250000 bytes. Max. Page Size For Delta Optimization (Bytes) Maximum page size, in bytes, that can be condensed. Valid entries are from 1 to 250000 bytes. Table 7-18 Application Acceleration and Optimization Additional Configuration Options (continued) Field Description 7-59 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Set Default Client Script Scripting language that the ACE is to recognize on condensed content pages: • N/A—Indicates that this option is not configured. • Javascript—Indicates that the default scripting language is JavaScript. • Visual Basic Script—Indicates that the default scripting language is Visual Basic. Exclude Iframes From Delta Optimization Check box to specify that delta optimization is not to be applied to IFrames (inline frames). Uncheck the check box to indicate that delta optimization is to be applied to IFrames. Exclude Non-ASCII Data From Delta Optimization Check box to specify that delta optimization is not to be applied to non-ASCII data. Uncheck the check box to indicate that delta optimization is to be applied to non-ASCII data. Exclude JavaScripts From Delta Optimization Check box to specify that delta optimization is not to be applied to JavaScript. Uncheck the check box to indicate that delta optimization is to be applied to JavaScript. MIME Types To Exclude From Delta Optimization a. In the first field, enter a comma-separated list of the MIME (Multipurpose Internet Mail Extension) type messages that are not to have delta optimization applied, such as image/Jpeg, text/html, application/msword, or audio/mpeg. See the “Supported MIME Types” section on page 10-26 for a list of supported MIME types. b. Click Add to add the entry to the list box on the right. You can position the entries in the list box by using the Up and Down buttons. Remove HTML META Elements From Documents Check box to specify that HTML META elements are to be removed from documents to prevent them from being condensed. Uncheck the check box to indicate that HTML META elements are not to be removed from documents. Rebase Delta Optimization Threshold (%) Delta threshold, expressed as a percent, when rebasing is to be triggered. This entry represents the size of a page delta relative to total page size, expressed as a percent. This entry triggers rebasing when the delta response size exceeds the threshold as a percentage of base file size. Valid entries are 0 to 10000 percent. Rebase Flash Forward Threshold (%) Threshold, expressed as a percent, when rebasing is to be triggered based on the percent of FlashForwarded URLs in the response. This entry triggers rebasing when the difference between the percentages of FlashForwarded URLs in the delta response and the base file exceeds the threshold. Valid entries are 0 to 10000 percent. Rebase History Size (Pages) Number of pages to be stored before the ACE resets all rebase control parameters to zero and starts over. This option prevents the base file from becoming too rigid. Valid entries are 10 to 2147483647. Rebase Modify Cool-Off Period (Seconds) Number of seconds after the last modification before performing a rebase. Valid entries are 1 to 14400 seconds (4 hours). Rebase Reset Period (Seconds) Period of time, in seconds, for performing a meta data refresh. Valid entries are 1 to 900 seconds (15 minutes). Table 7-18 Application Acceleration and Optimization Additional Configuration Options (continued) Field Description 7-60 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers UTF-8 Character Set Threshold Number of 8-bit Unicode Transformation Format (UTF-8) characters that need to appear on a page to create a UTF-8 character set page. The UTF-8 character set is an international standard that allows Web pages to display non-ASCII or non-English multibyte characters. It can represent any universal character in the Unicode standard and is backwards compatible with ASCII. Valid entries are from 1 to 1,000,000. Server Load Threshold Trigger (%) Threshold, expressed as a percent, at which the TTL for cached objects is to be changed. The server load threshold trigger indicates that the time-to-live (TTL) period for cached objects is to be based dynamically on server load. With this method, TTL periods increase if the current response time from the origin sever is greater than the average response time and decrease if the current response time from the origin server is less than the average response time when the difference in response times exceeds a specified threshold amount. Valid entries are from 0 to 100 percent. Server Load Time-To-Live Change (%) Percentage by which the cache TTL is to be increased or decreased when the server load threshold trigger is met. This option specifies the percentage by which the cache TTL is increased or decreased in response to a change in server load. For example, if this value is set to 20 and the current TTL for a response is 300 seconds, and if the current server response times exceeds the trigger threshold, the cache TTL for the response is raised to 360 seconds. Valid entries are from 0 to 100 percent. Delta Optimization Mode Method by which delta optimization is to be implemented: • N/A—Indicates that a delta optimization mode is not configured. • Enable The All-User Mode For Delta Optimization—Indicates that the ACE is to generate the delta against a single base file that is shared by all users of the URL. This option is usable in most cases if the structure of a page is common across all users, and the disk space overhead is minimal. • Enable The Per-User Mode For Delta Optimization—Indicates that the ACE is to generate the delta against a base file that is created specifically for that user. This option is useful when page contents, including layout elements, are different for each user, and delivers the highest level of condensation. However, this increases disk space requirements because a copy of the base page that is delivered to each user is cached. This option is useful when privacy is required because base pages are not shared among users. Enable Appscope Options Appscope Optimize Rate (%) Percentage of all requests or sessions to be sampled for performance with acceleration (or optimization) applied. All applicable optimizations for the class will be performed. Valid entries are from 0 to 100 percent, with a default of 10 percent. The sum of this value and the value entered in the Passtthrough Rate Percent field must not exceed 100. Appscope Passthrough Rate (%) Percentage of all requests or sessions to be sampled for performance without optimization. No optimizations for the class will be performed. Valid entries are from 0 to 100, with a default of 10 percent. The sum of this value and the value entered in the Optimize Rate Percent field must not exceed 100. Table 7-18 Application Acceleration and Optimization Additional Configuration Options (continued) Field Description 7-61 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Table 7-19 lists the parameter expander functions that you can use. Max Number For Parameter Summary Log (Bytes) Maximum number of bytes that are to be logged for each parameter value in the parameter summary of a transaction log entry in the statistics log. If a parameter value exceeds this limit, it is truncated at the specified limit. Valid entries are 0 to 10,000 bytes. Specify String For Grouping Requests String that the ACE is to use to sort requests for AppScope reporting. The string can contain a URL regular expression that defines a set of URLs in which URLs that differ only by their query parameters are to be treated as separate URLs in AppScope reports. For example, to define a string that is used to identify the URLs http://server/catalog.asp?region=asia and http://server/catalog.asp?region=america as two separate reporting categories, you would enter http_query_param(region). Valid entries contain 1 to 255 characters and can contain the parameter expander functions listed in Table 7-19. Table 7-18 Application Acceleration and Optimization Additional Configuration Options (continued) Field Description Table 7-19 Parameter Expander Functions Variable Description $(number) Expands to the corresponding matching subexpression (by number) in the URL pattern. Subexpressions are marked in a URL pattern using parentheses (). The numbering of the subexpressions begins with 1 and is the number of the left-parenthesis “(“ counting from the left. You can specify any positive integer for the number. $(0) matches the entire URL. For example, if the URL pattern is ((http://server/.*)/(.*)/)a.jsp, and the URL that matches it is http://server/main/sub/a.jsp?category=shoes&session=99999, then the following are correct: $(0) = http://server/main/sub/a.jsp $(1) = http://server/main/sub/ $(2) = http://server/main $(3) = sub If the specified subexpression does not exist in the URL pattern, then the variable expands to the empty string. $http_query_string() Expands to the value of the whole query string in the URL. For example, if the URL is http://myhost/dothis?param1=value1¶m2=value2, then the following is correct: $http_query_string() = param1=value1¶m2=value2 This function applies to both GET and POST requests. 7-62 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers $http_query_param(query-param-name) The obsolete syntax is also supported: $param(query-param-name) Expands to the value of the named query parameter (case-sensitive). For example, if the URL is http://server/main/sub/a.jsp?category=shoes&session=99999, then the following are correct: $http_query_param(category) = shoes $http_query_param(session) = 99999 If the specified parameter does not exist in the query, then the variable expands to the empty string. This function applies to both GET and POST requests. $http_cookie(cookie-name) Evaluates to the value of the named cookie. For example, $http_cookie(cookiexyz). The cookie name is case-sensitive. $http_header(request-header-name) Evaluates to the value of the specified HTTP request header. In the case of multivalued headers, it is the single representation as specified in the HTTP specification. For example, $http_header(user-agent). The HTTP header name is not case-sensitive. $http_method() Evaluates to the HTTP method used for the request, such as GET or POST. Boolean Functions: $http_query_param_present(query-param-name) $http_query_param_notpresent(query-param-name) $http_cookie_present(cookie-name) $http_cookie_notpresent(cookie-name) $http_header_present(request-header-name) $http_header_notpresent(request-header-name) $http_method_present(method-name) $http_method_notpresent(method-name) Evaluates to a Boolean value: True or False, depending on the presence or absence of the element in the request. The elements are a specific query parameter (query-param-name), a specific cookie (cookie-name), a specific request header (request-header-name), or a specific HTTP method (method-name). All identifiers are case-sensitive except for the HTTP request header name. $regex_match(param1, param2) Evaluates to a Boolean value: True if the two parameters match and False if they do not match. The two parameters can be any two expressions, including regular expressions, that evaluate to two strings. For example, this function: $regex_match($http_query_param(URL), .*Store\.asp.*) compares the query URL with the regular expression string .*Store\.asp.* If the URL matches this regular expression, this function evaluates to True. Table 7-19 Parameter Expander Functions (continued) Variable Description 7-63 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 13 When you finish configuring match criteria and actions, do one of the following: • Click OK to save your entries and to return to the Rule Match and Actions table. • Click Cancel to exit this procedure without saving your entries and to return to the Rule Match and Actions table. Step 14 When you finish configuring virtual server properties, do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The ACE appliance validates the action list configuration and deploys it. • Click Cancel to exit this procedure without saving your entries and to return to the Virtual Servers table. • Click Deploy Later to save your entries and apply the configuration at a later time. Related Topics • Optimization Traffic Policies and Typical Configuration Flow, page 15-2 • Configuring Traffic Policies for HTTP Optimization, page 15-6 • Configuring Virtual Server Protocol Inspection, page 7-18 • Configuring Virtual Server Layer 7 Load Balancing, page 7-30 • Configuring Virtual Server Default Layer 7 Load Balancing, page 7-50 Configuring Virtual Server NAT You can configure Name Address Translation (NAT) for virtual servers. Assumptions This topic assumes the following: • Make sure that a virtual server has been configured in the Properties configuration subset. For more information, see the “Configuring Virtual Server Properties” section on page 7-11 • Make sure that a VLAN has been configured. See the “Configuring Virtual Context VLAN Interfaces” section on page 12-6 for information on configuring a VLAN interface. • Make sure that at least one NAT pool has been configured on a VLAN interface. See the “Configuring VLAN Interface NAT Pools” section on page 12-26 for information on configuring a NAT pool. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Virtual Servers. The Virtual Servers table appears. Step 2 In the Virtual Servers table, choose the virtual server you want to configure for NAT, and click Edit. The Virtual Server configuration window appears. Step 3 In the Virtual Server configuration window, click NAT. The NAT table appears. 7-64 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Step 4 In the NAT table, click Add to add an entry, or choose an existing entry and click Edit to modify it. Step 5 In the VLAN drop-down list, choose the VLAN that you want to use for NAT. VLANs that have previously been defined for NAT do not appear in this list. VLAN numbers provide an indication of available NAT pools. Step 6 In the NAT Pool ID drop-down list, choose the NAT pool that you want to associate with the selected VLAN. Note the following about the NAT pool ID selections: NAT Pool IDs (Begin IP - End IP: Netmask: PAT) appear in a format that provides the details of the beginning and ending IP address range, netmask, and the PAT enabled or disabled setting. For example: 2 (10.77.241.2 - 10.77.241.15: 255.255.255.192: PAT Enabled). If the NAT pool had previously been associated but is no longer defined, then it appears as “ (Warning: Undefined NAT Pool)”. For example: 2 (Warning: Undefined NAT Pool) For more information about NAT pools, see the “Configuring VLAN Interface NAT Pools” section on page 12-26. Step 7 Do one of the following: • Click OK to save your entries and to return to the NAT table. The NAT table refreshes with the new entry. • Click Cancel to exit the procedure without saving your entries and to return to the NAT table. Step 8 When you finish configuring virtual server properties, do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Virtual Servers table. • Click Deploy Later to save your entries and apply the configuration at a later time. Related Topics • Configuring Virtual Servers, page 7-2 • Configuring Virtual Server Properties, page 7-11 • Configuring Virtual Server SSL Termination, page 7-17 • Configuring Virtual Server Protocol Inspection, page 7-18 • Configuring Virtual Server Layer 7 Load Balancing, page 7-30 • Configuring Virtual Server Default Layer 7 Load Balancing, page 7-50 7-65 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Configuring Virtual Servers Displaying Virtual Servers by Context You can display all virtual servers associated with a virtual context. Procedure Step 1 Choose Config > Devices. The device tree appears. Step 2 In the device tree, choose the context associated with the virtual servers that you want to display, and choose Load Balancing > Virtual Servers. Table 7-20 describes the information that displays. Related Topics • Configuring Virtual Servers, page 7-2 • Managing Virtual Servers, page 7-66 • Displaying Detailed Virtual Server Information, page 7-81 • Displaying Virtual Servers, page 7-81 Displaying Virtual Server Statistics and Status Information You can display virtual server statistics and status information for a particular virtual server by using the Details button. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Virtual Servers. The Virtual Servers table appears. Table 7-20 Virtual Servers Window Field Description Name Virtual server name. Configured State Current configured state, such as In Service or Out Of Service. Operational State Current operating state (if known), such as In Service or Out Of Service. Last Polled Date and time that ANM last polled the virtual server for backup statistics. VIP Address Virtual server IP address. Port Port that the virtual server uses for TCP or UDP. VLANs Associated VLANs. Server Farms Associated server farms. Owner Owner and context in which the virtual server was created 7-66 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers Step 2 From the Virtual Servers table, choose a virtual server and click Details. A popup window appears that displays the show service-policy policy_name class-map class_name detail CLI command output. For details about the displayed fields, see either the Cisco ACE Module Server Load-Balancing Configuration Guide or the Cisco ACE 4700 Series Appliance Server Load-Balancing Configuration Guide. Note This feature requires ACE module software Version A2(1.2), ACE appliance software Version A3(2.1), or later versions of either software. An error displays with earlier software versions. Step 3 Click Update Details to refresh the window information. Step 4 Click Close to return to the Virtual Servers table. Related Topics • Configuring Virtual Servers, page 7-2 • Managing Virtual Servers, page 7-66 • Displaying Detailed Virtual Server Information, page 7-81 • Displaying Virtual Servers, page 7-81 Managing Virtual Servers This section shows how to display and manage the virtual servers from the Virtual Servers window (Config > Operations > Virtual Servers). This window provides you with information about each virtual server configured on ANM (see the “Displaying Virtual Servers” section on page 7-81) and provides access to function buttons that allow you to perform tasks such as activate or suspend a virtual server, display a virtual server topology map, or display connection statistics graphs. This section also shows how to display and manage GSS VIP answers (Config > Operations > GSS VIP Answers) and GSS DNS rules (Config > Operations > GSS DNS Rules). Guidelines and Restrictions The Virtual Servers, GSS VIP Answers, and GSS DNS Rules Operations windows contain a Rows per page option that includes an All setting for displaying all related configured items in one window. Use the All setting for viewing purposes only. ANM does not allow you to perform any operation from an Operations window if you have more than 200 items selected. For example, if you use the All option to display and select more than 200 virtual servers and then attempt to perform the suspend operation, ANM cancels the request and displays an error message. This section includes the following topics: • Managing Virtual Server Groups, page 7-67 • Activating Virtual Servers, page 7-71 • Suspending Virtual Servers, page 7-72 • Managing GSS VIP Answers, page 7-73 • Activating and Suspending DNS Rules Governing GSS Load Balancing, page 7-75 • Managing GSS VIP Answer and DNS Rule Groups, page 7-76 7-67 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers • Displaying Detailed Virtual Server Information, page 7-81 • Displaying Virtual Servers, page 7-81 • Using the Virtual Server Connection Statistics Graph, page 7-84 • Using the Virtual Server Topology Map, page 7-85 • Understanding CLI Commands Sent from Virtual Server Table, page 7-86 Managing Virtual Server Groups This section describes how to organize virtual servers into groups, which allows you to display and manage a specific group of virtual servers without having to filter the virtual server display. When creating a group, you specify whether the group is available to just you or is available globally to all ANM users. The virtual server group feature is available from the virtual servers operations window (Config > Operations > Virtual Servers), which contains the Groups option for managing object groups. Figure 7-1 shows the Groups icon with the following available options for managing object groups: • Create New Group—Adds a new group. • Edit Group—Modifies an existing group. This option displays only after you select a group to display in Group mode. • Exit Group Mode—Changes the display from the group mode display to the display of all virtual servers. This option displays only after you select a group and the display enters the Group mode. • Saved Groups—Lists the currently configured groups along with each group’s privilege level (local or global) and owner. From this view, you can choose a group to display or delete a group. Figure 7-1 Object Grouping for Virtual Servers Guidelines and Restrictions Object grouping guidelines and restrictions are as follows: • When you create a global group, other users can see the group if they have access to at least one object within the group. This rule does not apply to the admin user or a user with the anm-admin role because they have visibility to all global groups. • To edit or delete a group, you must be the group owner, a user with the anm-admin role, or the admin user. • When you delete a locally authenticated user from the ANM database, ANM deletes all the global and user-specific groups that the user created. However, when you delete a remotely authorized user from the remote AAA server database, ANM does not delete the groups that the user created. In this case, you must manually delete the user’s groups. 7-68 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers This section includes the following topics: • Creating a Virtual Server Group, page 7-68 • Editing or Copying a Virtual Server Group, page 7-69 • Displaying a Virtual Server Group, page 7-70 • Deleting a Virtual Server Group, page 7-70 Creating a Virtual Server Group You can create a virtual server group. Procedure Step 1 Choose Config > Operations > Virtual Servers. The Virtual Servers table appears. Step 2 Click the Groups icon located above the Virtual Servers table. The Groups menu appears below the icon (see Figure 7-1). Step 3 From the Groups menu, choose Create New Group. The display enters the edit mode and the Creating a New Group table appears with the list of the available virtual servers. Step 4 From the Creating a New Group table, check the check box next to the virtual servers that you want to include in the group. Step 5 (Optional) Check the Hide unselected check box to display only the virtual servers that you have chosen. Uncheck the check box to display all the available virtual servers. Step 6 Do one of the following: • Click Save as to save the group information. The Create Group popup window appears. From the popup window, do the following: a. In the Group Name text box, enter a name for the group. Enter 1 to 64 alphanumeric characters. Special characters and spaces are allowed. b. Choose the availability of the group by clicking one of the following radio buttons: – This user only (local)—Only you can view, modify, or delete the group. – All users (global)—All ANM users can view the group if they have permission to view at least one of the virtual servers associated with the group. A user with the admin or anm-admin can view all groups and can also edit or delete any group. c. Do one of the following: – Click Save to save the group information. The Create Group popup window closes and the Viewing Group table appears, displaying the new group’s name and associated virtual servers. To exit Group mode and return to the Virtual Servers table, click the Groups icon and click Exit Group Mode from the Groups menu. – Click Cancel to close the Create Group popup window without saving any information and return to the Creating a New Group table. 7-69 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers • Click Back to View to exit the Group display mode and return to the Virtual Servers table. Related Topics • Managing Virtual Server Groups, page 7-67 • Editing or Copying a Virtual Server Group, page 7-69 • Displaying a Virtual Server Group, page 7-70 • Deleting a Virtual Server Group, page 7-70 Editing or Copying a Virtual Server Group You can edit a virtual server group or create a copy of a virtual server group under a different name. Procedure Step 1 Choose Config > Operations > Virtual Servers. The Virtual Servers table appears. Step 2 Click the Groups icon located above the Virtual Servers table. The Groups menu appears below the icon (see Figure 7-1). Step 3 From the Groups menu, choose the group that you want to edit. The Viewing Group table appears, displaying the selected group’s name and associated virtual servers. Step 4 Click the Groups icon again and from the Groups menu, choose Edit Group. The Editing Group table appears, displaying the complete list of available virtual servers with the virtual servers currently associated with the group highlighted and checked. Step 5 Modify the group as needed by adding (check) or removing (uncheck) virtual servers as needed. Skip this step if you only want to save a copy of the current group under a different name. Step 6 Do one of the following: • Click Save to save the changes and return to the Viewing Group table, where you can view the changes. • Click Save as to save the configuration under a new group name. The Create Group popup window appears. From the popup window, do the following: a. In the Group Name text box, enter a name for the group. Enter 1 to 64 alphanumeric characters. Special characters and spaces are allowed. b. Choose the availability of the group by clicking one of the following radio buttons: – This user only (local)—Only you can view, modify, or delete the group. – All users (global)—All ANM users can view the group if they have permission to view at least one of the virtual servers associated with the group. The admin user or a user with the anm-admin role can view all global groups and can also edit or delete these groups. c. Do one of the following: – Click Save to save the group information. The Create Group popup window closes and the Viewing Group table appears, displaying the new group’s name and associated virtual servers. 7-70 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers – Click Cancel to close the Create Group popup window without saving any information and to return to the Creating a New Group table. Click Back to View to exit the edit mode and return to the Group mode. Step 7 (Optional) To exit Group mode and return to the Virtual Servers table, click the Groups icon and click Exit Group Mode from the Groups menu. Related Topics • Managing Virtual Server Groups, page 7-67 • Creating a Virtual Server Group, page 7-68 • Displaying a Virtual Server Group, page 7-70 • Deleting a Virtual Server Group, page 7-70 Displaying a Virtual Server Group You can display the list of virtual servers associated with a virtual server group. Procedure Step 1 Choose Config > Operations > Virtual Servers. The Virtual Servers table appears. Step 2 Click the Groups icon located above the Virtual Servers table. The Groups menu appears below the icon (see Figure 7-1). Step 3 From the Groups menu, choose the group that you want to display. The Viewing Group table appears, displaying the selected group’s name and associated virtual servers. Step 4 (Optional) To exit Group mode and return to the Virtual Servers table, click the Groups icon and click Exit Group Mode from the Groups menu. Related Topics • Managing Virtual Server Groups, page 7-67 • Creating a Virtual Server Group, page 7-68 • Editing or Copying a Virtual Server Group, page 7-69 • Deleting a Virtual Server Group, page 7-70 Deleting a Virtual Server Group You can delete a virtual server group. Deleting a virtual server group does not delete the group’s associated virtual servers from the ANM database. 7-71 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers Procedure Step 1 Choose Config > Operations > Virtual Servers. The Virtual Servers table appears. Step 2 Click the Groups icon located above the Virtual Servers table. The Groups menu appears below the icon (see Figure 7-1). Step 3 From the Groups menu, click X (delete) next to the group that you want to delete. The Delete Group confirmation popup window appears. Step 4 From the Delete Group confirmation popup window, do one of the following: • Click Delete to removes the virtual server group. • Click Cancel to ignore the deletion request. Related Topics • Managing Virtual Server Groups, page 7-67 • Creating a Virtual Server Group, page 7-68 • Editing or Copying a Virtual Server Group, page 7-69 • Displaying a Virtual Server Group, page 7-70 Activating Virtual Servers You can activate a virtual server. Note A missing operation or Admin state on a CSM or CSS device most likely means that the community string was not enabled on those devices. If the community string is not enabled on a CSM or CSS device, and any kind of operation is performed on those devices, it will not succeed, and ANM will not provide any kind of indication. • For CSM devices, you must enable the community string of the Catalyst 6500 series chassis. • For CSS devices, you must enable the community string of the CSS device itself. Guidelines and Restrictions ANM does not support CSM DNS virtual servers. If you create this type of virtual server, ANM issues an error message if you attempt to use ANM to activate or suspend it. Procedure Step 1 Choose Config > Operations > Virtual Servers. The Virtual Servers table appears. Step 2 (Optional) To display only the virtual servers of a specific virtual server group, do the following: a. Click the Groups icon located above the Virtual Servers table. The Groups menu appears below the icon (see Figure 7-1). 7-72 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers b. From the Groups menu, choose the group to display. Step 3 In the Virtual Servers table, choose the virtual server that you want to activate, and click Activate. The server is activated and the window refreshes with updated information in the Configured State column. Related Topics • Managing Virtual Servers, page 7-66 • Displaying Virtual Servers, page 7-81 • Suspending Virtual Servers, page 7-72 Suspending Virtual Servers You can suspend a virtual server. Note A missing operation or Admin state on a CSM or CSS device most likely means that the community string was not enabled on those devices. If the community string is not enabled on a CSM or CSS device, and any kind of operation is performed on those devices, it will not succeed, and ANM will not provide any kind of indication. • For CSM devices, you must enable the community string of the Catalyst 6500 series chassis. • For CSS devices, you must enable the community string of the CSS device itself. Guidelines and Restrictions ANM does not support CSM DNS virtual servers. If you create this type of virtual server, ANM issues an error message if you attempt to use ANM to activate or suspend it. Procedure Step 1 Choose Config > Operations > Virtual Servers. The Virtual Servers table appears. Step 2 (Optional) To display only the virtual servers of a specific virtual server group, do the following: a. Click the Groups icon located above the Virtual Servers table. The Groups menu appears below the icon (see Figure 7-1). b. From the Groups menu, choose the group to display. Step 3 In the Virtual Servers table, choose the virtual server that you want to suspend, and click Suspend. The Suspend Virtual Server window appears. Step 4 In the Reason field of the Suspend Virtual Server window, enter the reason for this action. You might enter a trouble ticket, an order ticket, or a user message. 7-73 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers Note Do not enter a password in this field. Related Topics • Managing Virtual Servers, page 7-66 • Displaying Virtual Servers, page 7-81 • Activating Virtual Servers, page 7-71 Managing GSS VIP Answers This section describes how to manage GSS VIP answers. In a GSS network, the term answers refers to resources that respond to content queries. When you create an answer using the primary Global Site Selector Manager (PGSSM), you are simply identifying a resource on your GSS network to which queries can be directed and that can provide your user’s D-proxy with the address of a valid host to serve their request. Virtual IP (VIP) addresses associated with an SLB such as the Cisco CSS, Cisco CSM, Cisco IOS-compliant SLB, LocalDirector, or a Web server are types of answers that are specified in the ANM user interface in the GSS VIP Answers table found in ANM under Configuration > Operations. Use this procedure to poll, activate, or suspend GSS VIP answers. Prerequisites Make sure that you have established GSS VIP answers using the PGSSM. Procedure Step 1 Choose Config > Operations > GSS VIP Answers. The GSS Answers table appears. For a list of fields available, see Table 7-21. Table 7-21 GSS Answer Table Field Description Multiple Row Selection Checkbox Check box that selects all entries at the same time, or you can check line items individually. IP Address VIP answer IP address. Name VIP answer name. Config State VIP answer configured status. PGSSM Oper State Operational status as shown on the primary GSS manager (PGSSM). Answer Group Answer group names to which the VIP answer belong. Location Logical groupings for GSS resources that correspond to geographical entities such as a city, data center, or content site. Device Primary GSS device name on ANM. PGSSM Time Last operational status update time on the primary GSS. 7-74 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers Step 2 (Optional) To display only the answers of a specific GSS VIP Answer group, do the following: a. Click the Groups icon located above the DNS Rules table. The Groups menu appears below the icon (see Figure 7-1). b. From the Groups menu, choose the group to display. Step 3 In the GSS Answers table, check the check boxes to the left of the answers that you want to poll, activate, or suspend. Step 4 Do one of the following: • Click Active/Suspended hyperlink to view the VIP answer details across the GSS node(s). A popup window appears listing all nodes associated with the VIP, operational state, hit count, and timestamp for each node. • Click Poll Now to query the chosen resource to verify it is still active. Note If you click Poll Now immediately after you click Activate or Suspend, you might not get the VIP answer operational status on the PGSSM that reflects your most recent configuration. It might be necessary to click Poll Now two or three times in succession to get an accurate result. The ability of Cisco License Manager to update the VIP answer operational status and statistics accurately in detailed GSS statistics window might depend on the polling interval that has been configured on the GSS. The polling interval can be configured directly on the GSS device. (The default is 5 minutes.) Depending on the interval, it can take 5 minutes or more for the ANM server to show an accurate result. • Click Activate to reactivate a GSS answer. • Click Suspend to temporarily stop the GSS from using an associated answer. If you clicked Activate or Suspend, a dialog box prompts for a Reason. Acceptable text consists of any characters or nothing at all. Step 5 Do one of the following: • Click Deploy Now to complete Activation or Suspension. • Click Cancel to cancel the Activation or Suspension operation. Related Topics • Managing GSS VIP Answer and DNS Rule Groups, page 7-76 • Information About Load Balancing, page 7-1 • Activating and Suspending DNS Rules Governing GSS Load Balancing, page 7-75 7-75 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers Activating and Suspending DNS Rules Governing GSS Load Balancing You can activate or suspend DNS rules associated with your GSS VIP answers table. The DNS rules table in Configuration > Operations navigation tree specifies actions for the GSS to take when it receives a request from a known source (a member of a source address list) for a known hosted domain (a member of a domain list). The DNS rule specifies which response (answer) is given to the requesting user’s local DNS host (D-proxy) and how that answer is chosen. One of a variety of balance methods is used to determine the best response to the request, based on the status and load of the GSS host devices. Prerequisites Make sure that you have established GSS VIP answers and DNS rules using the PGSSM. Procedure Step 1 Choose Config > Operations > DNS Rules. The DNS Rules table appears. For a list of fields available, see Table 7-22. Step 2 (Optional) To display only the rules of a specific DNS Rules group, do the following: a. Click the Groups icon located above the DNS Rules table. The Groups menu appears below the icon (see Figure 7-1). b. From the Groups menu, choose the group to display. Step 3 In the DNS Rules table, check the checkbox to the left of the rules that you want to activate or suspend. Step 4 Click the Activate or Suspend button. A dialog box prompts for a Reason. Acceptable text consists of any characters or none at all. Step 5 Do one of the following: • Click Deploy Now to complete Activation or Suspension. Table 7-22 DNS Rules Table Field Description Multiple Row Selection Checkbox Check box that selects all entries at the same time, or you can check line items individually. Name Name of the DNS rule. Source Address Collection of IP addresses or address blocks for known client DNS proxies (or D-proxies). Domains Domain list name containing one or more domain names that point to content for which the GSS is acting as the authoritative DNS server and for which you wish to use the GSS technology to balance traffic and user requests. Config State DNS rules configured status, either Active or Suspended. Answer Group Lists of GSS resources that are candidates to respond to DNS queries received from a user for a hosted domain. Owner Owner names, providing a simple way to organize and identify groups of related GSS resources. Device Primary GSS device name on ANM. PGSSM Time Last operational status update time on the GSS. 7-76 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers • Click Cancel to cancel the Activation or Suspension operation. Related Topics • Managing GSS VIP Answer and DNS Rule Groups, page 7-76 • Information About Load Balancing, page 7-1 • Managing GSS VIP Answers, page 7-73 Managing GSS VIP Answer and DNS Rule Groups This section describes how to organize GSS VIP answers or DNS rules into groups, which allows you to display and manage a specific group of VIP answers or DNS rules without having to filter the display. When creating a group, you specify whether the group is available to just you or is available globally to all ANM users. The GSS object grouping feature is available from the following operations windows: • Answer VIPs (Config > Operations > GSS VIP Answers) • DNS Rules (Config > Operations > GSS DNS Rules) These windows contain the Groups option for managing object groups. Figure 7-2 shows the Groups icon with the following available options for managing object groups: • Create New Group—Adds a new group. • Edit Group—Modifies an existing group. This option displays only after you select a group to display in Group mode. • Exit Group Mode—Changes the display from the Group mode display to the display of all VIP answers or DNS rules. This option displays only after you select a group and the display enters the Group mode. • Saved Groups—Lists the currently configured groups with each group’s privilege level (local or global) and owner. From this view, you can choose a group to display or delete a group. Figure 7-2 Object Grouping for GSS VIP Answers and DNS Rules Guidelines and Restrictions Object grouping guidelines and restrictions are as follows: • When you create a global group, other users can see the group if they have access to at least one object within the group. This rule does not apply to the admin user or a user with the anm-admin role because they have visibility to all global groups. 7-77 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers • To edit or delete a group, you must be the group owner, a user with the anm-admin role, or the admin user. • When you delete a locally authenticated user from the ANM database, ANM deletes all the global and user-specific groups that the user created. However, when you delete a remotely authorized user from the remote AAA server database, ANM does not delete the groups that the user created. In this case, you must manually delete the user’s groups. This section includes the following topics: • Creating a VIP Answer or DNS Rule Group, page 7-77 • Editing or Copying a VIP Answer or DNS Rule Group, page 7-78 • Displaying a VIP Answer or DNS Rule Group, page 7-79 • Deleting a VIP Answer or DNS Rule Group, page 7-80 Creating a VIP Answer or DNS Rule Group You can create a GSS answer VIP or DNS rule group. Procedure Step 1 Choose one of the following depending on the group type that you want to create: • Config > Operations > GSS VIP Answers. • Config > Operations > GSS DNS Rules Depending on your choice, either the Answer VIPs or DNS Rules object table appears. Step 2 Click the Groups icon located above the objects table. The Groups menu appears below the icon (see Figure 7-2). Step 3 From the Groups menu, choose Create New Group. The display enters the edit mode and the Creating a New Group table appears with the list of the available GSS VIP answer or DNS rule objects. Step 4 From the Creating a New Group table, check the check box next to the GSS objects that you want to include in the group. Step 5 (Optional) Check the Hide unselected check box to display only the GSS objects that you have chosen. Uncheck the check box to display all the available GSS objects. Step 6 Do one of the following: • Click Save as to save the group information. The Create Group popup window appears. From the popup window, do the following: a. In the Group Name text box, enter a name for the group. Enter 1 to 64 alphanumeric characters. Special characters and spaces are allowed. b. Choose the availability of the group by clicking one of the following radio buttons: – This user only (local)—Only you can view, modify, or delete the group. – All users (global)—All ANM users can view the group if they have permission to view at least one of the GSS objects associated with the group. A user with the admin or anm-admin can view all groups and can also edit or delete any group. c. Do one of the following: 7-78 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers – Click Save to save the group information. The Create Group popup window closes and the Viewing Group table appears, displaying the new group’s name and associated objects. To exit Group mode and return to the Real Servers table, click the Groups icon and click Exit Group Mode from the Groups menu. – Click Cancel to close the Create Group popup window without saving any information and to return to the Creating a New Group table. • Click Back to View to exit the Group display mode and return to the objects table Related Topics • Managing GSS VIP Answer and DNS Rule Groups, page 7-76 • Editing or Copying a VIP Answer or DNS Rule Group, page 7-78 • Displaying a VIP Answer or DNS Rule Group, page 7-79 • Deleting a VIP Answer or DNS Rule Group, page 7-80 • Managing GSS VIP Answers, page 7-73 • Activating and Suspending DNS Rules Governing GSS Load Balancing, page 7-75 Editing or Copying a VIP Answer or DNS Rule Group You can edit a GSS VIP answer or DNS rule group or create a copy of a group under a different name. Procedure Step 1 Choose one of the following depending on the group type that you want to edit or copy: • Config > Operations > GSS VIP Answers. • Config > Operations > GSS DNS Rules Depending on your choice, either the Answer VIPs or DNS Rules object table appears. Step 2 Click the Groups icon located above the objects table. The Groups menu appears below the icon (see Figure 7-2). Step 3 From the Groups menu, choose the group that you want to edit. The Viewing Group table appears, displaying the selected group’s name and associated GSS VIP answer or DNS rule objects. Step 4 Click the Groups icon again and from the Groups menu, choose Edit Group. The Editing Group table appears, displaying the complete list of available objects with the objects currently associated with the group highlighted and checked. Step 5 Modify the group as needed by adding (check) or removing (uncheck) objects as needed. Skip this step if you only want to save a copy of the current group under a different name. Step 6 Do one of the following: • Click Save to save the changes and return to the Viewing Group table, where you can view the changes. • Click Save as to save the configuration under a new group name. The Create Group popup window appears. 7-79 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers From the popup window, do the following: a. In the Group Name text box, enter a name for the group. Enter 1 to 64 alphanumeric characters. Special characters and spaces are allowed. b. Choose the availability of the group by clicking one of the following radio buttons: – This user only (local)—Only you can view, modify, or delete the group. – All users (global)—All ANM users can view the group if they have permission to view at least one of the real servers associated with the group. The admin user or a user with the anm-admin role can view all global groups and can also edit or delete these groups. c. Do one of the following: – Click Save to save the group information. The Create Group popup window closes and the Viewing Group table appears, displaying the new group’s name and associated objects. – Click Cancel to close the Create Group popup window without saving any information and to return to the Creating a New Group table. Click Back to View to exit the edit mode and return to the Group mode. Step 7 (Optional) To exit Group mode and return to the GSS objects table, click the Groups icon and click Exit Group Mode from the Groups menu. Related Topics • Managing GSS VIP Answer and DNS Rule Groups, page 7-76 • Creating a VIP Answer or DNS Rule Group, page 7-77 • Displaying a VIP Answer or DNS Rule Group, page 7-79 • Deleting a VIP Answer or DNS Rule Group, page 7-80 • Managing GSS VIP Answers, page 7-73 • Activating and Suspending DNS Rules Governing GSS Load Balancing, page 7-75 Displaying a VIP Answer or DNS Rule Group You can display the list of GSS objects associated with a VIP answer or DNS rule group. Procedure Step 1 Choose one of the following depending on the group type that you want to edit or copy: • Config > Operations > GSS VIP Answers. • Config > Operations > GSS DNS Rules Depending on your choice, either the Answer VIPs or DNS Rules object table appears. Step 2 Click the Groups icon located above the objects table. The Groups menu appears below the icon (see Figure 7-2). Step 3 From the Groups menu, choose the group that you want to display. The Viewing Group table appears, displaying the selected group’s name and associated objects. 7-80 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers Step 4 (Optional) To exit Group mode and return to the GSS objects table, click the Groups icon and click Exit Group Mode from the Groups menu. Related Topics • Managing GSS VIP Answer and DNS Rule Groups, page 7-76 • Creating a VIP Answer or DNS Rule Group, page 7-77 • Editing or Copying a VIP Answer or DNS Rule Group, page 7-78 • Deleting a VIP Answer or DNS Rule Group, page 7-80 • Managing GSS VIP Answers, page 7-73 • Activating and Suspending DNS Rules Governing GSS Load Balancing, page 7-75 Deleting a VIP Answer or DNS Rule Group You can delete a GSS VIP answer or DNS rule group. Deleting a group does not delete the group’s associated objects from the ANM database. Procedure Step 1 Choose one of the following depending on the group type that you want to edit or copy: • Config > Operations > GSS VIP Answers. • Config > Operations > GSS DNS Rules Depending on your choice, either the Answer VIPs or DNS Rules object table appears. Step 2 Click the Groups icon located above the objects table. The Groups menu appears below the icon (see Figure 7-2). Step 3 From the Groups menu, click X (delete) next to the group that you want to delete. The Delete Group confirmation popup window appears. Step 4 From the Delete Group confirmation popup window, do one of the following: • Click Delete to remove the selected group. • Click Cancel to ignore the deletion request. Related Topics • Managing GSS VIP Answer and DNS Rule Groups, page 7-76 • Creating a VIP Answer or DNS Rule Group, page 7-77 • Editing or Copying a VIP Answer or DNS Rule Group, page 7-78 • Displaying a VIP Answer or DNS Rule Group, page 7-79 • Activating and Suspending DNS Rules Governing GSS Load Balancing, page 7-75 7-81 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers Displaying Detailed Virtual Server Information You can display detailed information about the state of a virtual server. Procedure Step 1 Choose Config > Operations > Virtual Servers. The Virtual Servers table appears. Step 2 (Optional) To display only the virtual servers of a specific virtual server group, do the following: a. Click the Groups icon located above the Virtual Servers table. The Groups menu appears below the icon (see Figure 7-1). b. From the Groups menu, choose the group to display. Step 3 In the Virtual Servers table, choose the virtual server whose configuration details that you want to display. Click the hyperlinked entry for that virtual server that appears in the Operational State column. The Details window appears with the following information: • Current operational status • Description, if one was entered • Configured interfaces, such as VLANs • Configured service policies including: – Configured class maps, detailed by type (such as load balancing or inspection) – States of configured options, indicated by word (ACTIVE, DISABLED, OUTOFSERVICE) and color (green, orange/yellow, and red) – Associated policy maps with details on their type and action (L7 loadbalance, serverfarm) – Statistics regarding connections and counts Related Topics • Configuring Virtual Servers, page 7-2 • Displaying Virtual Servers by Context, page 7-65 • Displaying Virtual Server Statistics and Status Information, page 7-65 • Managing Virtual Servers, page 7-66 Displaying Virtual Servers You can display all virtual servers. Procedure Step 1 Choose Config > Operations > Virtual Servers. The Virtual Servers table appears. Table 7-23 describes the Virtual Servers table information. 7-82 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers Table 7-23 Virtual Server Table Fields Item Description Name Server farm name sorted by virtual context. Policy Map Associated policy map. IP Address:Protocol:Port Server farm IP address, protocol, and port used for communications. HA Indicators that display when the virtual server is part of a high availability pair. The indicators are as follows: • Asterisk (*)—The virtual server is associated with an HA pair and the HA configuration is complete. • Red dash (-)—The virtual server is associated with an HA pair; however, the HA configuration is incomplete. Typically, the HA pair are not properly configured for HA or only one of the devices has been imported into ANM. Ensure that both devices are imported into ANM and that they are configured as described in the “Configuring ACE High Availability” section on page 13-14. The table displays HA pair virtual servers together in the same row and they remain together no matter how you sort the information. SLB Device Associated ACE IP address and context. Admin Administrative state of the virtual server: Up or Down. Note For a CSM device, the virtual server Admin State is derived from the Operational State. In this case, the Operational State may display an Out of Service condition when the virtual server is configured to be Inservice (if all of the real servers are out of service). Oper Operational state of the virtual server: Up or Down. (ACE devices only) To display detailed information about the virtual server in a popup window, click the linked state value in this column. For more information about this popup window, see the “Displaying Virtual Server Statistics and Status Information” section on page 7-65. Note The display virtual server details feature requires ACE module software Version A2(1.2), ACE appliance software Version A3(2.1), or later versions of either software. An error displays with earlier software versions. DWS Operating state of Dynamic Workload Scaling for the virtual server, which can be: • N/A—Not applicable; the server farms associated with the virtual server are not configured to use Dynamic Workload Scaling. • Local—At least one server farm associated the virtual server is configured to use Dynamic Workload Scaling, but the ACE is sending traffic to the VM Controller’s local VMs only. • Expanded—At least one server farm associated the virtual server is configured to use Dynamic Workload Scaling and the ACE is sending traffic to the VM Controller’s local and remote VMs. 7-83 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers You can activate or suspend virtual servers from this table and obtain additional information about the state of the virtual server. Step 2 (Optional) Use the display toggle button ( ) located above the table to control which virtual servers ANM displays as follows: • Show ANM recognized Virtual Servers—Displays only virtual servers that match ANM’s virtual server definition (see the “Virtual Server Configuration and ANM” section on page 7-2). • Show all Virtual Servers—Displays virtual servers that match ANM’s virtual server definition and those that do not match this definition but that ANM can recognize as virtual servers using SNMP polling. Note The display toggle button displays only when you have the “Display All Virtual Servers in Monitoring & Operations page” advanced setting feature enabled (see the “Managing the Display of Virtual Servers in the Operations and Monitoring Windows” section on page 18-66). Step 3 (Optional) To display only the virtual servers of a specific virtual server group, do the following: a. Click the Groups icon located above the Virtual Servers table. The Groups menu appears below the icon (see Figure 7-1). b. From the Groups menu, choose the group to display. You can activate or suspend virtual servers from this table and obtain additional information about the state of the virtual server. Related Topics • Activating Virtual Servers, page 7-71 • Suspending Virtual Servers, page 7-72 Conn Number of active connections. Note This column is populated for ACE appliances. For ACE devices, the Active Connections column displays N/A for older versions of the ACE appliance and module. Stat Age Age of the statistical information. Serverfarms Associated server farms. Note If you have the Details popup window feature enabled, click the value in this column to open the Details popup window and display detailed information about the server farm. By default, this feature is disabled. For information about enabling or disabling this feature, see the “Enabling the ACE Server Farm Details Popup Window Option for Virtual Servers” section on page 18-65. VLANs Associated VLANs. Table 7-23 Virtual Server Table Fields (continued) Item Description 7-84 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers • Managing Virtual Server Groups, page 7-67 • Displaying Detailed Virtual Server Information, page 7-81 • Displaying Virtual Server Statistics and Status Information, page 7-65 • Displaying Virtual Servers by Context, page 7-65 Using the Virtual Server Connection Statistics Graph You can display real time and historical statistical information about the connections of a virtual server. ANM displays the information in graph or chart form. This feature also allows you to compare similar connection information across multiple virtual servers. Procedure Step 1 Choose Config > Operations > Virtual Servers. The Virtual Servers table appears. You can activate or suspend virtual servers from this table and obtain additional information about the state of the virtual server. Step 2 (Optional) To display only the virtual servers of a specific virtual server group, do the following: a. Click the Groups icon located above the Virtual Servers table. The Groups menu appears below the icon (see Figure 7-1). b. From the Groups menu, choose the group to display. Step 3 In the Virtual Servers table, check the check box next to server whose connection information you want to display, and click Graph. You can choose up to four virtual servers if you want to compare statistical data. The Virtual Server Graph window appears, displaying the default graph for each selected virtual server. For details about using the graph feature, see the “Configuring Historical Trend and Real Time Graphs for Devices” section on page 17-48. Step 4 Click Exit to return to the Virtual Server widow. Related Topics • Configuring Historical Trend and Real Time Graphs for Devices, page 17-48 • Activating Virtual Servers, page 7-71 • Suspending Virtual Servers, page 7-72 • Managing Virtual Server Groups, page 7-67 • Displaying Detailed Virtual Server Information, page 7-81 • Displaying Virtual Servers, page 7-81 • Using the Virtual Server Topology Map, page 7-85 • Displaying Virtual Server Statistics and Status Information, page 7-65 • Displaying Virtual Servers by Context, page 7-65 7-85 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Managing Virtual Servers Using the Virtual Server Topology Map You can display the nodes on your network based on the virtual server that you select. Procedure Step 1 Choose Config > Operations > Virtual Servers. The Virtual Servers table appears. Step 2 (Optional) To display only the virtual servers of a specific virtual server group, do the following: a. Click the Groups icon located above the Virtual Servers table. The Groups menu appears below the icon (see Figure 7-1). b. From the Groups menu, choose the group to display. Step 3 Use the display toggle button ( ) to ensure that the Virtual Servers table is set to Show ANM Recognized Virtual Servers. Note The topology map feature is not available when the Virtual Server table is set to Show All Virtual Servers (for more information, see the “Displaying Virtual Servers” section on page 7-81). Step 4 In the Virtual Servers table, choose the server whose topology map you want to display, and click Topology. The ANM Topology map appears. The map includes several tools for navigating the network map and zooming in and out. For details about using the map tools, see the “Displaying Network Topology Maps” section on page 17-68. Step 5 Click Exit to return to the Virtual Server widow. Related Topics • Suspending Virtual Servers, page 7-72 • Managing Virtual Server Groups, page 7-67 • Displaying Detailed Virtual Server Information, page 7-81 • Displaying Virtual Servers, page 7-81 • Using the Virtual Server Connection Statistics Graph, page 7-84 • Displaying Virtual Server Statistics and Status Information, page 7-65 • Displaying Virtual Servers by Context, page 7-65 7-86 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Deploying Virtual Servers Understanding CLI Commands Sent from Virtual Server Table Table 7-24 displays the CLI commands dispatched to the device for a given Virtual Servers table option, and is sorted by device. Deploying Virtual Servers You can deploy virtual servers on your network at times that are convenient and appropriate for your environment. For example, if your site prefers to make changes to the network during a specific time each night, you can modify and save virtual server configurations during the day and then deploy them when appropriate. This section includes the following topics: • Deploying a Virtual Server, page 7-87 • Displaying All Staged Virtual Servers, page 7-87 • Modifying Deployed Virtual Servers, page 7-88 • Modifying Staged Virtual Servers, page 7-88 Table 7-24 CLI Commands Deployed from Virtual Servers Table Command Sample CLI Sent ACE Modules and Appliances Virtual Server Activate policy-map multi-match int25 class VIP3 loadbalance vip inservice Virtual Server Suspend policy-map multi-match int25 class VIP3 no loadbalance vip inservice CSMs Virtual Server Activate vserver APP1 inservice Virtual Server Suspend vserver APP1 no inservice CSS Devices Virtual Server Activate owner hm content LB active Virtual Server Suspend owner hm content LB suspend 7-87 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Deploying Virtual Servers Deploying a Virtual Server You can deploy virtual servers on your network at times that are convenient and appropriate for your environment. For example, if your site prefers to make changes to the network during a specific time each night, you can modify and save virtual server configurations during the day and then deploy them when appropriate. Procedure Step 1 Choose Config > Deploy. The Staged Objects table appears. Step 2 Fro the Staged Objects table, choose the virtual server that you want to deploy on your network, and click Deploy. The virtual server is deployed and the table refreshes with updated information. Related Topics • Configuring Virtual Servers, page 7-2 • Displaying All Staged Virtual Servers, page 7-87 • Modifying Staged Virtual Servers, page 7-88 Displaying All Staged Virtual Servers You can display all objects that have been configured but have not yet been deployed on your network. Procedure Step 1 Do one of the following: • Choose Config > Deploy. The Staged Objects table appears listing the following: – Virtual server name – Device ID and virtual context – Time the virtual server was created – User who last modified the object – Time the object was last updated • Choose Config > Devices > context > Load Balancing > Virtual Servers. The Virtual Servers table appears. Virtual servers with configurations that have not been deployed appear with the status Not Deployed in the Configured State column. Related Topics • Configuring Virtual Servers, page 7-2 7-88 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Deploying Virtual Servers • Deploying a Virtual Server, page 7-87 • Modifying Staged Virtual Servers, page 7-88 • Modifying Deployed Virtual Servers, page 7-88 Modifying Deployed Virtual Servers You can modify the configuration of a deployed virtual server. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Virtual Servers. The Virtual Servers table appears. Step 2 In the Virtual Servers table, choose the virtual server you want to modify, and click Edit. The Virtual Server configuration window appears. Step 3 In the Virtual Server configuration window, modify the virtual server's configuration as desired. See Table 7-1 for virtual server configuration options. Step 4 When you are done modifying the configuration, do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Virtual Servers table. Related Topics • Managing Virtual Servers, page 7-66 • Displaying All Staged Virtual Servers, page 7-87 • Activating Virtual Servers, page 7-71 • Suspending Virtual Servers, page 7-72 Modifying Staged Virtual Servers You can modify the configuration of a staged virtual server. Procedure Step 1 Choose Config > Deploy. The Staged Objects table appears, listing those virtual servers that have not yet been deployed in the network. Step 2 From the Staged Objects table, choose the virtual server you want to modify, and click Edit. The Virtual server configuration window appears. Step 3 In the Virtual server configuration window, modify the virtual server configuration as desired. 7-89 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Deploying Virtual Servers See Table 7-1 for virtual server configuration options. Step 4 When you are done modifying the configuration, do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Virtual Servers table. • Click Deploy Later to save your entries and apply this configuration at a later time. Related Topics • Deploying a Virtual Server, page 7-87 • Displaying All Staged Virtual Servers, page 7-87 • Activating Virtual Servers, page 7-71 7-90 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 7 Configuring Virtual Servers Deploying Virtual Servers CHAPTER 8-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 8 Configuring Real Servers and Server Farms Date: 3/28/12 This chapter describes how to configure real servers and server farms on the Cisco Application Control Engine (ACE) using Cisco Application Networking Manager (ANM). Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • Information About Server Load Balancing, page 8-1 • Configuring Real Servers, page 8-5 • Managing Real Servers, page 8-9 • Configuring Dynamic Workload Scaling, page 8-26 • Configuring Server Farms, page 8-30 • Configuring Health Monitoring, page 8-49 • Configuring Secure KAL-AP, page 8-77 Information About Server Load Balancing Server load balancing (SLB) is the process of deciding to which server a load-balancing device should send a client request for service. For example, a client request can consist of an HTTP GET for a Web page or an FTP GET to download a file. The job of the load balancer is to select the server that can successfully fulfill the client request and do so in the shortest amount of time without overloading either the server or the server farm as a whole. 8-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Information About Server Load Balancing Depending on the load-balancing algorithm or predictor that you configure, the ACE performs a series of checks and calculations to determine the server that can best service each client request. The ACE bases server selection on several factors, including the server with the fewest connections with respect to load, source or destination address, cookies, URLs, or HTTP headers. ANM allows you to configure load balancing using: • Virtual servers—See Configuring Virtual Servers, page 7-2. • Real servers—See Configuring Real Servers, page 8-5. • Dynamic Workload Scaling—See Configuring Dynamic Workload Scaling, page 8-26. • Server farms—See Configuring Server Farms, page 8-30. • Sticky groups—See Configuring Sticky Groups, page 9-7. • Parameter maps—See Configuring Parameter Maps, page 10-1. For more information about SLB as configured and performed by the ACE, see: • Configuring Virtual Servers, page 7-2 • Load-Balancing Predictors, page 8-2 • Real Servers, page 8-3 • Dynamic Workload Scaling Overview, page 8-4 • Server Farms, page 8-5 • Configuring Health Monitoring, page 8-49 • TCL Scripts, page 8-50 • Configuring Stickiness, page 9-1 This section includes the following topics: – Load-Balancing Predictors, page 8-2 – Real Servers, page 8-3 – Server Farms, page 8-5 Load-Balancing Predictors The ACE uses the following predictors to select the best server to satisfy a client request: • Hash Address—Selects the server using a hash value based on either the source or destination IP address, or both. Use these predictors for firewall load balancing (FWLB). Note FWLB allows you to scale firewall protection by distributing traffic across multiple firewalls on a per-connection basis. All packets belonging to a particular connection must go through the same firewall. The firewall then allows or denies transmission of individual packets across its interfaces. For more information about configuring FWLB on the ACE, see the Cisco 4700 Series Application Control Engine Appliance Server Load-Balancing Configuration Guide. • Hash Content— Selects the server by using a hash value based on the specified content string of the HTTP packet body • Hash Cookie—Selects the server using a hash value based on a cookie name. • Hash Header—Selects the server using a hash value based on the HTTP header name. 8-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Information About Server Load Balancing • Hash Layer4—Selects the server using a Layer 4 generic protocol load-balancing method. • Hash URL—Selects the server using a hash value based on the requested URL. You can specify a beginning pattern and an ending pattern to match in the URL. Use this predictor method to load-balance cache servers. Cache servers perform better with the URL hash method because you can divide the contents of the caches evenly if the traffic is random enough. In a redundant configuration, the cache servers continue to work even if the active ACE switches over to the standby ACE. For information about configuring redundancy, see the “Configuring High Availability” section on page 13-1. • Least Bandwidth—Selects the server with the least amount of network traffic or a specified sampling period. Use this type for server farms with heavy traffic, such as downloading video clips. • Least Connections—Selects the server with the fewest number of active connections based on server weight. For the least connection predictor, you can configure a slow-start mechanism to avoid sending a high rate of new connections to servers that you have just put into service. • Least Loaded—Selects the server with the lowest load as determined by information from SNMP probes. • Response—Selects the server with the lowest response time for a specific response-time measurement. • Round Robin—Selects the next server in the list of real servers based on server weight (weighted roundrobin). Servers with a higher weight value receive a higher percentage of the connections. This is the default predictor. Note The different hash predictor methods do not recognize the weight value that you configure for real servers. The ACE uses the weight that you assign to real servers only in the round-robin and least-connections predictor methods. Related Topics Configuring the Predictor Method for Server Farms, page 8-39 Real Servers To provide services to clients, you configure real servers on the ACE. Real servers can be dedicated physical servers or VMware virtual machines (VMs) that you configure in groups called server farms. Note VMs that you define as real servers can be VMs associated with a VMware vCenter Server that you import into ANM (see the “Importing VMware vCenter Servers” section on page 5-24) and VMs that the ACE recognizes when configured for Dynamic Workload Scaling (see the “Configuring Dynamic Workload Scaling” section on page 8-26). Real servers provide client services such as HTTP or XML content, website hosting, FTP file uploads or downloads, redirection for web pages that have moved to another location, and so on. You identify real servers with names and characterize them with IP addresses, connection limits, and weight values. The ACE also allows you to configure backup servers in case a server is taken out of service for any reason. After you create and name a real server on the ACE, you can configure several parameters, including connection limits, health probes, and weight. You can assign a weight to each real server based on its relative importance to other servers in the server farm. The ACE uses the server weight value for the 8-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Information About Server Load Balancing weighted round-robin and the least-connections load-balancing predictors. The load-balancing predictor algorithms (for example, roundrobin, least connections, and so on) determine the servers to which the ACE sends connection requests. For a listing and brief description of the load-balancing predictors, see the “Load-Balancing Predictors” section on page 8-2. The ACE uses traffic classification maps (class maps) within policy maps to identify traffic that meets defined criteria and to apply specific actions to that traffic based on the SLB configuration. If a primary real server fails, the ACE takes that server out of service and no longer includes it in load-balancing decisions. If you configured a backup server for the real server that failed, the ACE redirects the primary real server connections to the backup server. For information about configuring a backup server, see the “Configuring Virtual Server Layer 7 Load Balancing” section on page 7-30. The ACE can take a real server out of service for the following reasons: • Probe failure • ARP timeout • Neighbor Discovery (ND) failure (IPv6 only, which requires ACE module and ACE appliance software Version A5(1.0) or later) • Specifying Out Of Service as the administrative state of a real server • Specifying Inservice Standby as the administrative state of a real server The Out Of Service and Inservice Standby selections both provide the graceful shutdown of a server. Related Topics • Configuring Real Servers, page 8-5 • Configuring Health Monitoring for Real Servers, page 8-51 Dynamic Workload Scaling Overview Note Dynamic Workload Scaling requires ACE module or appliance software Version A4(2.0) or later and a pair of the Cisco Nexus 7000 Series switches with Overlay Transport Virtualization (OTV) technology. The ACE Dynamic Workload Scaling (DWS) feature permits on-demand access to remote resources, such as VMs, that you own or lease from an Internet service provider or cloud service provider. This feature uses Cisco Nexus 7000 Series switches with OTV to create a Data Center Interconnect (DCI) on a Layer 2 link over an existing IP network between geographically distributed data centers (see Figure 1-1). The local data center Cisco Nexus 7000 Series switch contains an OTV forwarding table that lists the MAC addresses of the Layer 2 extended virtual private network (VPN) and identifies the addresses as either local or remote. When you configure the ACE for DWS, the ACE uses an XML query to poll the Cisco Nexus 7000 Series switch and obtain the OTV forwarding table information to determine the locality of the VMs (local or remote). The ACE also uses a health monitor probe that it sends to the local VMware vCenter Server to monitor the load of the local VMs based on CPU usage, memory usage, or both. When the average CPU and/or memory usage of the local VMs reaches its configured maximum threshold value, the ACE bursts traffic to the remote VMs. The ACE stops bursting traffic to the remote VMs when local VM usage drops below its configured minimum threshold value. 8-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Real Servers To use DWS, you configure the ACE to connect to the Data Center Interconnect device (Cisco Nexus 7000 Series switch) and the VMware Controller associated with the local and remote VMs. You also configure the ACE with the probe type VM to monitor a server farm’s local VM CPU and memory usage, which determines when the ACE bursts traffic to the remote VMs (see the “Configuring Dynamic Workload Scaling” section on page 8-26). For more details on this feature, see the Cisco 4700 Series Application Control Engine Appliance Server Load-Balancing Configuration Guide. Server Farms Typically, in data centers, servers are organized into related groups called server farms. Servers within server farms often contain identical content (referred to as mirrored content) so that if one server becomes inoperative, another server can take its place immediately. Also, having mirrored content allows several servers to share the load of increased demand during important local or international events, such as the Olympic Games. This phenomenon of a sudden large demand for content is called a flash crowd. After you create and name a server farm, you can add existing real servers to it and configure other server farm parameters, such as the load-balancing predictor, server weight, backup server, health probe, and so on. For a listing and brief description of load-balancing predictors, see the “Load-Balancing Predictors” section on page 8-2. Related Topics Configuring Server Farms, page 8-30 Configuring Real Servers Real servers are dedicated physical servers that are typically configured in groups called server farms. These servers provide services to clients, such as HTTP or XML content, streaming media (video or audio), TFTP or FTP services, and so on. When configuring real servers, you assign names to them and specify IP addresses, connection limits, and weight values. The ACE uses traffic classification maps (class maps) within policy maps to filter specified traffic and to apply specific actions to that traffic based on the load-balancing configuration. A load-balancing predictor algorithm (such as round-robin or least connections) determines the servers to which the ACE sends connection requests. For information about configuring class maps, see the “Configuring Virtual Context Class Maps” section on page 14-6. This section includes the following topics: • Configuring Load Balancing on Real Servers, page 8-6 • Displaying Real Server Statistics and Status Information, page 8-9 8-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Real Servers Configuring Load Balancing on Real Servers You can configure load balancing on real servers. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Real Servers. The Real Servers table appears. Step 2 In the Real Servers table, click Poll Now to instruct ANM to poll the devices and display the current values, and click OK when prompted if you want to poll the devices for data now. Step 3 Click Add to add a new real server, or choose a real server you want to modify and click Edit. The Real Servers configuration window appears. Step 4 In the Real Servers configuration window, configure the server using the information in Table 8-1. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Table 8-1 Real Server Attributes Field Description Name Field that allows you to either enter a unique name for this server or accept the automatically incremented value in this field. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. Type Type of server: • Host—The real server provides content and services to clients. • Redirect—The server redirects traffic to a new location. State State of the real server: • In Service—The real server is in service. • Out Of Service—The real server is out of service. Description Brief description for this real server. Valid entries are strings of up to 240 characters. Spaces and special characters are allowed. IP Address Type Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. These selections appear only for real servers specified as hosts. Select the IP address type of this real server: • IPv6—The real server has an IPv6 address. • IPv4—The real server has an IPv4 address. IPv6/IPv4 Address For ACE module and ACE appliance software versions earlier than A5(1.0), this field does not include the IP version number. This field appears for only real servers specified as hosts. Enter a unique IP address as indicated by the IP Address Type field. The IP address cannot be of an existing virtual IP address (VIP), real server or interface in the context. 8-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Real Servers Fail-On-All Field that appears only for real servers identified as host servers. By default, real servers with multiple probes configured for them have an OR logic associated with them, which means that if one of the real server probes fails, the real server fails and enters the PROBE-FAILED state. Check this checkbox to configure a real server to remain in the OPERATIONAL state unless all probes associated with it fail (AND logic). The Fail-On-All function is applicable to all probe types. Min. Connections Minimum number of connections to be allowed on this server before the ACE starts sending connections again after it has exceeded the Max. Connections limit. This value must be less than or equal to the Max. Connections value. By default, this value is equal to the Max. Connections value. Valid entries are from 2 to 4000000. Max. Connections Maximum number of active connections allowed on this server. When the number of connections exceeds this value, the ACE stops sending connections to this server until the number of connections falls below the Min. Connections value. Valid entries are from 2 to 4000000, and the default is 4000000. Weight Field that appears only for real servers identified as hosts. Enter the weight to be assigned to this real server in a server farm. Valid entries are from 1 to 100, and the default is 8. Probes Field that appears only as follows: • For all host real servers. The Available probe list contains all configured probe types. • For redirect real servers configured on ACE devices that use the following software versions: – ACE module: A2(3.x) and later releases – ACE appliance: A3(x) and later releases The redirect real server Available probe list contains only configured probes of the type Is Routed, which means that the ACE routes the probe address according to the ACE internal routing table (see the “Configuring Health Monitoring for Real Servers” section on page 8-51). In the Probes field, choose the probes to use for health monitoring in the Available Items list, and click Add. The probes appear in the Selected Items list. Note The probe must have the same IP address type (IPv6 or IPv4) as the real server. For example, you cannot configure an IPv6 probe to an IPv4 real server. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Note The list of available probes does not include VM probes used to monitor local VM usage. To remove probes that you do not want to use for health monitoring, choose them in the Selected Items list, and click Remove. The probes appear in the Available probe list. Table 8-1 Real Server Attributes (continued) Field Description 8-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Real Servers Step 5 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Real Servers table. • Click Next to deploy your entries and to configure another real server. Step 6 To display statistics and status information for an existing real server, choose a real server from the Real Servers table, then click Details. The show rserver name detail CLI command output appears. See the “Displaying Real Server Statistics and Status Information” section on page 8-9 for details. Related Topics • Managing Real Servers, page 8-9 • Configuring Health Monitoring for Real Servers, page 8-51 • Configuring Server Farms, page 8-30 Web Host Redirection URL string used to redirect requests to another server. This field appears only for real servers identified as redirect servers. Enter the URL and port used to redirect requests to another server. Valid entries are in the form http://host.com:port where host is the name of the server and port is the port to be used. Valid host entries are unquoted text strings with no spaces and a maximum of 255 characters. Valid port numbers are from 1 to 65535. The relocation string supports the following special characters: • %h—Inserts the hostname from the request Host header • %p—Inserts the URL path string from the request Redirection Code Field that appears only for real servers identified as redirect servers. Choose the appropriate redirection code: • N/A—Webhost redirection code is not defined. • 301—Requested resource has been moved permanently. For future references to this resource, the client should use one of the returned URIs. • 302—Requested resource has been found, but has been moved temporarily to another location. For future references to this resource, the client should use the request URI because the resource may be moved to other locations from time to time. Rate Bandwidth Bandwidth rate is the number of bytes per second and applies to the network traffic exchanged between the ACE and the real server in both directions. Specify the real server bandwidth limit in bytes per second. Valid entries are from 2 to 300000000. The default is 300000000. Rate Connection Connection rate is the number of connections per second received by the ACE and applies only to new connections destined to a real server. Specify the limit for connections per second. Valid entries are from 2 to 350000. The default is 350000. Table 8-1 Real Server Attributes (continued) Field Description 8-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers • Configuring Sticky Groups, page 9-7 Displaying Real Server Statistics and Status Information You can display statistics and status information for a particular real server. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Real Servers. The Real Servers table appears. Step 2 In the Real Servers table, choose a real server from the Real Servers table, and click Details. The show rserver name detail CLI command output appears. For details on the displayed output fields, see either the Cisco ACE Module Server Load-Balancing Configuration Guide or the Cisco ACE 4700 Series Appliance Server Load-Balancing Configuration Guide, Chapter 2, Configuring Real Servers and Server Farms. Step 3 Click Update Details to refresh the output for the show rserver name detail CLI command. The new information appears in a separate panel with a new timestamp; both the old and the new real server statistics and status information appear side-by-side to avoid overwriting the last updated information. Step 4 Click Close to return to the Real Servers table. Related Topics • Configuring Real Servers, page 8-5 • Managing Real Servers, page 8-9 • Displaying Real Servers, page 8-18 Managing Real Servers This section shows how to display and manage the real servers from the Real Servers window (Config > Operations > Real Servers). This window provides you with information about each real server configured on ANM (see the “Displaying Real Servers” section on page 8-18) and provides access to function buttons that allow you to perform tasks such as activate or suspend a real server, display a real server topology map, or display connection statistics graphs. Guidelines and Restrictions The Real Servers window contains a Rows per page option that includes an All setting for displaying all configured real servers in one window. Use the All setting for viewing purposes only. ANM does not allow you to perform any operation from this window if you have more than 200 real servers selected. For example, if you use the All option to display and select more than 200 real servers and then attempt to perform the suspend operation, ANM cancels the request and displays an error message. This section includes the following topics: • Managing Real Server Groups, page 8-10 • Activating Real Servers, page 8-14 • Suspending Real Servers, page 8-15 8-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers • Modifying Real Server Weight Value, page 8-17 • Displaying Real Servers, page 8-18 • Using the Real Server Connection Statistics Graph, page 8-22 • Using the Real Server Topology Map, page 8-23 • CLI Commands Sent from the Real Server Table, page 8-23 • Server Weight Ranges, page 8-25 Managing Real Server Groups This section describes how to organize real servers into groups, which allows you to display and manage a specific group of real servers without having to filter the real server display. When creating a group, you specify whether the group is available to just you or is available globally to all ANM users. The real server group feature is available from the real servers operations window (Config > Operations > Real Servers), which contains the Groups option for managing object groups. Figure 8-1 shows the Groups icon with the following available options for managing object groups: • Create New Group—Adds a new group. • Edit Group—Modifies an existing group. This option displays only after you select a group to display in Group mode. • Exit Group Mode—Changes the display from the specific group display to the display of all real servers. This option displays only after you select a group and the display enters the Group mode. • Saved Groups—Lists the currently configured groups with each group’s privilege level (local or global) and owner. From this view, you can choose a group to display or delete a group. Figure 8-1 Object Grouping for Real Servers Guidelines and Restrictions This topic includes the following guidelines and restrictions: • When you create a global group, other users can see the group if they have access to at least one object within the group. This rule does not apply to the admin user or a user with the anm-admin role because they have visibility to all global groups. • To edit or delete a group, you must be the group owner, a user with the anm-admin role, or the admin user. 8-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers • When you delete a locally authenticated user from the ANM database, ANM deletes all the global and user-specific groups that the user created. However, when you delete a remotely authorized user from the remote AAA server database, ANM does not delete the groups that the user created. In this case, you must manually delete the user’s groups. This section includes the following topics: • Creating a Real Server Group, page 8-11 • Editing or Copying a Real Server Group, page 8-12 • Displaying a Real Server Group, page 8-13 • Deleting a Real Server Group, page 8-13 Creating a Real Server Group You can create a real server group. Procedure Step 1 Choose Config > Operations > Real Servers. The Real Servers table appears. Step 2 Click the Groups icon located above the Real Servers table. The Groups menu appears below the icon (see Figure 8-1). Step 3 From the Groups menu, choose Create New Group. The display enters the edit mode and the Creating a New Group table appears with the list of the available real servers. Step 4 From the Creating a New Group table, check the check box next to the real servers that you want to include in the group. Step 5 (Optional) Check the Hide unselected check box to display only the real servers that you have chosen. Uncheck the check box to display all the available real servers. Step 6 Do one of the following: • Click Save as to save the group information. The Create Group popup window appears. From the popup window, do the following: a. In the Group Name text box, enter a name for the group. Enter 1 to 64 alphanumeric characters. Special characters and spaces are allowed. b. Choose the availability of the group by clicking one of the following radio buttons: – This user only (local)—Only you can view, modify, or delete the group. – All users (global)—All ANM users can view the group if they have permission to view at least one of the real servers associated with the group. A user with the admin or anm-admin can view all groups and can also edit or delete any group. c. Do one of the following: – Click Save to save the group information. The Create Group popup window closes and the Viewing Group table appears, displaying the new group’s name and associated real servers. To exit Group mode and return to the Real Servers table, click the Groups icon and click Exit Group Mode from the Groups menu. 8-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers – Click Cancel to close the Create Group popup window without saving any information and to return to the Creating a New Group table. • Click Back to View to exit the Group mode and return to the Virtual Servers table. Related Topics • Managing Real Server Groups, page 8-10 • Editing or Copying a Real Server Group, page 8-12 • Displaying a Real Server Group, page 8-13 • Deleting a Real Server Group, page 8-13 Editing or Copying a Real Server Group You can edit a real server group or create a copy of a real server group under a different name. Procedure Step 1 Choose Config > Operations > Real Servers. The Real Servers table appears. Step 2 Click the Groups icon located above the Real Servers table. The Groups menu appears below the icon (see Figure 8-1). Step 3 From the Groups menu, choose the group that you want to edit. The Viewing Group table appears, displaying the selected group’s name and associated real servers. Step 4 Click the Groups icon again and from the Groups menu, choose Edit Group. The Editing Group table appears, displaying the complete list of available real servers with the real servers currently associated with the group highlighted and checked. Step 5 Modify the group as needed by adding (check) or removing (uncheck) real servers as needed. Skip this step if you only want to save a copy of the current group under a different name. Step 6 Do one of the following: • Click Save to save the changes and return to the Viewing Group table, where you can view the changes. • Click Save as to save the configuration under a new group name. The Create Group popup window appears. From the popup window, do the following: a. In the Group Name text box, enter a name for the group. Enter 1 to 64 alphanumeric characters. Special characters and spaces are allowed. b. Choose the availability of the group by clicking one of the following radio buttons: – This user only (local)—Only you can view, modify, or delete the group. – All users (global)—All ANM users can view the group if they have permission view at least one of the real servers associated with the group. The admin user or a user with the anm-admin role can view all global groups and can also edit or delete these groups. c. Do one of the following: 8-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers – Click Save to save the group information. The Create Group popup window closes and the Viewing Group table appears, displaying the new group’s name and associated real servers. – Click Cancel to close the Create Group popup window without saving any information and to return to the Creating a New Group table. Click Back to View to exit the edit mode and return to the Group mode. Step 7 (Optional) To exit Group mode and return to the Real Servers table, click the Groups icon and click Exit Group Mode from the Groups menu. Related Topics • Managing Real Server Groups, page 8-10 • Creating a Real Server Group, page 8-11 • Displaying a Real Server Group, page 8-13 • Deleting a Real Server Group, page 8-13 Displaying a Real Server Group You can display the list of real servers associated with a real server group. Procedure Step 1 Choose Config > Operations > Real Servers. The Real Servers table appears. Step 2 Click the Groups icon located above the Real Servers table. The Groups menu appears below the icon (see Figure 8-1). Step 3 From the Groups menu, choose the group that you want to display. The Viewing Group table appears, displaying the selected group’s name and associated real servers. Step 4 (Optional) To exit Group mode and return to the Real Servers table, click the Groups icon and click Exit Group Mode from the Groups menu. Related Topics • Managing Real Server Groups, page 8-10 • Creating a Real Server Group, page 8-11 • Editing or Copying a Real Server Group, page 8-12 • Deleting a Real Server Group, page 8-13 Deleting a Real Server Group You can delete a real server group. Deleting a real server group does not delete the group’s associated real servers from the ANM database. 8-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers Procedure Step 1 Choose Config > Operations > Real Servers. The Real Servers table appears. Step 2 Click the Groups icon located above the Real Servers table. The Groups menu appears below the icon (see Figure 8-1). Step 3 From the Groups menu, click X (delete) next to the group that you want to delete. The Delete Group confirmation popup window appears. Step 4 From the Delete Group confirmation popup window, do one of the following: • Click Delete to removes the real server group. • Click Cancel to ignore the deletion request. Related Topics • Managing Real Server Groups, page 8-10 • Creating a Real Server Group, page 8-11 • Editing or Copying a Real Server Group, page 8-12 • Displaying a Real Server Group, page 8-13 Activating Real Servers You can activate a real server. Note If you are using the ANM plug-in for vCenter Server to access ANM, see the “Activating Real Servers Using vSphere Client” section on page B-15. Procedure Step 1 Choose Config > Operations > Real Servers. The Real Servers table appears. Step 2 (Optional) To display only the real servers of a specific real server group, do the following: a. Click the Groups icon located above the Real Servers table. The Groups menu appears below the icon (see Figure 8-1). b. From the Groups menu, choose the group to display. Step 3 From the Real Servers table, choose the servers that you want to activate, and click Activate. The Activate Server window appears. Step 4 In the Reason field of the Activate Server window, enter a reason for this action. You might enter a trouble ticket, an order ticket, or a user message. 8-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers Note Do not enter a password in this field. Step 5 Do one of the following: • Click OK to activate the server and to return to the Real Servers table. The server appears in the table with the status Inservice. • Click Cancel to exit this procedure without activating the server and to return to the Real Servers table. Related Topics • Managing Real Servers, page 8-9 • Managing Real Server Groups, page 8-10 • Suspending Real Servers, page 8-15 • Displaying Real Servers, page 8-18 • Using the Real Server Connection Statistics Graph, page 8-22 • Using the Real Server Topology Map, page 8-23 Suspending Real Servers You can suspend a real server. Note If you are using the ANM plug-in for vCenter Server to access ANM, see the “Suspending Real Servers Using vSphere Client” section on page B-16. Procedure Step 1 Choose Config > Operations > Real Servers. The Real Servers table appears. Step 2 (Optional) To display only the real servers of a specific real server group, do the following: a. Click the Groups icon located above the Real Servers table. The Groups menu appears below the icon (see Figure 8-1). b. From the Groups menu, choose the group to display. Step 3 In the Real Servers table, choose the server that you want to suspend, and click Suspend. The Suspend Real Servers window appears. Step 4 In the Reason field of the Suspend Real Servers window, enter the reason for this action. You might enter a trouble ticket, an order ticket, or a user message. Note Do not enter a password in this field. 8-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers Step 5 From the Suspend Real Servers Type drop-down list, choose one of the following: • Graceful—When executed on a primary server, the ACE gracefully shuts down the server with sticky connections as follows: – Tears down existing non-TCP connections to the server – Allows current TCP connections to complete – Allows new sticky connections for existing server connections that match entries in the sticky database – Load balances all new connections (other than the matching sticky connections mentioned above) to the other servers in the server farm When executed on a backup real server, the ACE places the backup server in service standby mode. Note For the CSS, when the device is in the In Service admin state and you perform a graceful suspend operation, ANM saves the last known non-zero service (or real server) weight, and then sets the weight to zero. ANM references the saved weight when performing an Activate operation. If the current weight is zero, and a non-zero weight has been saved for that service (or real server), the Activate operation also sets the weight to the saved value. To allow ANM to save and reset the weight value when gracefully suspending and then activating the CSS, you must have the device configured to permit SNMP traffic. For each device type, see the corresponding configuration guide to configure the device to permit SNMP traffic. When the CSS is in the In Service Standby admin state and you perform a graceful suspend operation, ANM does not set the weight to zero. Note Graceful suspend and suspend options vary by device type. For the commands deployed by the device type when these options are selected, see the “CLI Commands Sent from the Real Server Table” section on page 8-23. • Suspend—The ACE resets all non-TCP connections to the server. For TCP connections, existing flows are allowed to complete before the ACE takes the real server out of service. No new connections are allowed. The ACE resets all Secure Sockets Layer (SSL) connections to the real server. • Suspend and Clear Connections—Performs the tasks described for Suspend and clears the existing connections to this server. Step 6 Do one of the following: • Click Deploy Now to suspend the server and to return to the Real Servers table. The server appears in the table with the status Out Of Service. • Click Cancel to exit this procedure without suspending the server and to return to the Real Servers table. Related Topics • Managing Real Servers, page 8-9 • Managing Real Server Groups, page 8-10 8-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers • Activating Real Servers, page 8-14 • Displaying Real Servers, page 8-18 • Using the Real Server Connection Statistics Graph, page 8-22 • Using the Real Server Topology Map, page 8-23 Modifying Real Server Weight Value You can modify the weight value assigned to a real server that defines the connection capacity of the server in relation to the other real servers. The ACE uses the weight value that you specify for a server in the weighted round-robin and least-connections load-balancing predictors. Servers with a higher configured weight value have a higher priority with respect to connections than servers with a lower weight. For example, a server with a weight of 5 would receive five connections for every one connection for a server with a weight of 1. Note If you are using the ANM plug-in for vCenter Server to access ANM, see the “Modifying Real Server Weight Value Using vSphere Client” section on page B-18. Procedure Step 1 Choose Config > Operations > Real Servers. The Real Servers table appears. Step 2 (Optional) To display only the real servers of a specific real server group, do the following: a. Click the Groups icon located above the Real Servers table. The Groups menu appears below the icon (see Figure 8-1). b. From the Groups menu, choose the group to display. Step 3 In the Real Servers table, choose the servers whose configuration you want to modify, and click Change Weight below the table to the right of Activate and Suspend. The Change Weight Real Servers window appears. Step 4 In the Change Weight Real Servers window, enter the following information for the selected server: • Reason for change such as trouble ticket, order ticket or user message. Note Do not enter a password in this field. • Weight value (for allowable ranges for each device type, see Table 8-5). Step 5 Do one of the following: • Click Deploy Now to accept your entries and to return to the Real Servers table. The server appears in the table with the updated information. • Click Cancel to exit this procedure without saving your entries and to return to the Real Servers table. 8-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers Related Topics • Managing Real Servers, page 8-9 • Managing Real Server Groups, page 8-10 • Activating Real Servers, page 8-14 • Displaying Real Servers, page 8-18 • Using the Real Server Connection Statistics Graph, page 8-22 • Using the Real Server Topology Map, page 8-23 Displaying Real Servers You can display the list of real servers configured on ANM with information specific to each server. Procedure Step 1 Choose Config > Operations > Real Servers. The Real Servers table appears, which contains the information described in Table 8-2. Note In the table, N/A indicates that either the information is not available from the database or that it is not being collected using SNMP. Table 8-2 Real Server Table Fields Item Description Name Real server name. For CSM real servers only, if you have the reverse DNS lookup feature enabled, ANM displays the DNS name of the CSM real server in this field. ANM learns and updates the DNS names during the following operations: • CSM import • CSM CLI synchronization • ANM restart By default, the reverse DNS lookup feature is disabled. You can enable it by modifying the ANM properties file and restarting ANM as follows: a. echo "cisco.anm.enable-csm-dns-lookup=true" >> /opt/CSCOanm/etc/cs-config.properties b. /opt/CSCOanm/bin/anm-tool restart IP address Real server IP address. Port Port used by the real server for communications. 8-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers VM Virtual machine indicator that specifies if the real server is a VMware vCenter Server virtual machine (Yes) or is not a virtual machine (–). If the indicator state is Yes, you can click this link to open the Virtual Machine Details popup window to display statistical information about the VM. ANM polls the VM on a regular basis to update the displayed information. Click OK to close the popup window and return to the Real Servers table. Vservers Associated virtual servers. HA Indicators that display when the real server is part of a high availability pair. The indicators are as follows: • Asterisk (*)—The real server is associated with an HA pair and the HA configuration is complete. • Red dash (-)—The real server is associated with an HA pair; however, the HA configuration is incomplete. Typically, the HA pair are not properly configured for HA or only one of the devices has been imported into ANM. Ensure that both devices are imported into ANM and that they are configured as described in the “Configuring ACE High Availability” section on page 13-14. The table displays HA pair real servers together in the same row and they remain together no matter how you sort the information. SLB Device Name of the server load-balancing device. Admin Administrative state of the real server: In Service, Out Of Service, or In Service Standby. Table 8-2 Real Server Table Fields (continued) Item Description 8-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers Oper Operational state of the real server. Possible states are as follows: • Failed—Server has failed and is not retried for the amount of time specified by its retry timer. • Inband probe failed—Server has failed the inband Health Probe agent. • Inservice—Server is in use as a destination for server load-balancing client connections. • Inservice standby—Server is the backup real server, which remains inactive unless the primary real server fails. • Operation wait—Server is ready to become operational but is waiting for the associated redirect virtual server to be in service. • Out of service—Server is not in use by a server load balancer as a destination for client connections. • Probe failed—Server load-balancing probe to this server has failed. No new connections are assigned to this server until a probe to this server succeeds. • Probe testing—Server has received a test probe from the server load balancer. • Ready to test —Server has failed and its retry timer has expired; test connections will begin flowing to it soon. • Return code failed—Server has been disabled because it returned an HTTP code that matched a configured value. • Test wait—Server is ready to be tested. This state is applicable only when the server is used for HTTP redirect load balancing. • Testing—Server has failed and has been given another test connection. The success of this connection is not known. • Throttle: DFP —DFP has lowered the weight of the server to throttle level; no new connections are assigned to the server until DFP raises its weight. • Throttle: max clients—Server has reached its maximum number of allowed clients. • Throttle: max connections —Server has reached its maximum number of connections and is no longer being given connections. • Unknown—State of the server is not known. Note If you have the Details popup window feature enabled, click the value in this column to open the Details popup window and display detailed information about the real server. By default, this feature is disabled. For information about enabling or disabling this feature, see the “Enabling the ACE Real Server Details Popup Window Option” section on page 18-64. Conn Number of current connections. Wt Current server weight. Table 8-2 Real Server Table Fields (continued) Item Description 8-21 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers Step 2 (Optional) To display only the real servers of a specific real server group, do the following: a. Click the Groups icon located above the Real Servers table. The Groups menu appears below the icon (see Figure 8-1). b. From the Groups menu, choose the group to display. Step 3 (Optional) Use the function buttons located at the bottom of the window to activate or suspend a real server, change the weight assigned to a real server, and so forth. Table 8-3 describes the check box and function button options. Step 4 (Optional) To identify any SNMP-related issues, select the real server’s virtual context in the object selector. If there are problems with SNMP, the SNMP status appears in the upper right above the content pane. Locality Item that pertains only to ACE software Version A4(2.0) or later releases on either device type (appliance or module). Locality also requires that you have the ACE configured for Dynamic Workload Scaling (see the “Configuring Dynamic Workload Scaling” section on page 8-26). Location of the real server, which must be a VM and not a physical server. Possible locality states are as follows: • N/A—Not available; the ACE cannot determine if the real server is local or remote. A possible cause for this issue is that Dynamic Workload Scaling is not configured correctly. • Local—The real server is located in the local network. • Remote—The real server is located in the remote network. The ACE bursts traffic to this server when the CPU and/or memory usage of the local real servers reaches the specified maximum threshold value. Stat Age Age of the statistical information. Server Farm Associated server farm. Table 8-2 Real Server Table Fields (continued) Item Description Table 8-3 Real Server Window Check Box and Function Button Options Check Box/Function Button Description Poll Now Function button that updates the displayed information. Activate Function button that activates a suspended real server (see the “Activating Real Servers” section on page 8-14). Suspend Function button that suspends an active real server (see the “Suspending Real Servers” section on page 8-15). Change Weight Function button used to change the weight assigned to a real server (see the “Server Weight Ranges” section on page 8-25). Graph Function button that displays the statistics graph for a selected real server (see the “Using the Real Server Connection Statistics Graph” section on page 8-22). Topology Function button that displays the topology map for a selected real server (see the “Using the Real Server Topology Map” section on page 8-23). 8-22 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers Related Topics • Displaying Real Server Statistics and Status Information, page 8-9 • Using the Real Server Connection Statistics Graph, page 8-22 • Managing Real Server Groups, page 8-10 • Using the Real Server Topology Map, page 8-23 • Activating Real Servers, page 8-14 • Suspending Real Servers, page 8-15 • Modifying Real Server Weight Value, page 8-17 • Enabling the ACE Real Server Details Popup Window Option, page 18-64 • Filtering Entries, page 1-14 Using the Real Server Connection Statistics Graph You can display real time and historical statistical information about the connections of a real server. ANM displays the information in graph or chart form. This feature also allows you to compare similar connection information across multiple real servers. Procedure Step 1 Choose Config > Operations > Real Servers. The Real Servers table appears. Step 2 (Optional) To display only the real servers of a specific real server group, do the following: a. Click the Groups icon located above the Real Servers table. The Groups menu appears below the icon (see Figure 8-1). b. From the Groups menu, choose the group to display. Step 3 In the Real Servers table, check the check box next to server whose connection information you want to display, and click Graph. You can choose up to four real servers if you want to compare statistical data. The Real Server Graph window appears, displaying the default graph for each selected real server. For details about using the graph feature, see the “Configuring Historical Trend and Real Time Graphs for Devices” section on page 17-48. Related Topics • Managing Real Server Groups, page 8-10 • Activating Real Servers, page 8-14 • Suspending Real Servers, page 8-15 • Modifying Real Server Weight Value, page 8-17 • Displaying Real Servers, page 8-18 • Using the Real Server Topology Map, page 8-23 8-23 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers Using the Real Server Topology Map You can display the nodes on your network based on the real server that you select. Procedure Step 1 Choose Config > Operations > Real Servers. The Real Servers table appears. Step 2 (Optional) To display only the real servers of a specific real server group, do the following: a. Click the Groups icon located above the Real Servers table. The Groups menu appears below the icon (see Figure 8-1). b. From the Groups menu, choose the group to display. Step 3 In the Real Servers table, choose the server whose topology map you want to display, and click Topology. The ANM Topology map appears. The map includes several tools for navigating the network map and zooming in and out. For details about using the map tools, see the “Displaying Network Topology Maps” section on page 17-68. Step 4 Click Exit to return to the Real Server widow. Related Topics • Managing Real Server Groups, page 8-10 • Activating Real Servers, page 8-14 • Suspending Real Servers, page 8-15 • Modifying Real Server Weight Value, page 8-17 • Displaying Real Servers, page 8-18 • Using the Real Server Connection Statistics Graph, page 8-22 CLI Commands Sent from the Real Server Table Table 8-4 displays the CLI commands dispatched to the device for a given Real Servers table option and is sorted by device type. Table 8-4 CLI Commands Deployed from the Real Servers Table Command Sample CLI Sent ACE Modules and Appliances Real Server Activation serverfarm host sf1 rserver rs1 80 inservice 8-24 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers Real Server Graceful Suspend serverfarm host sf1 rserver rs1 80 inservice standby Real Server Suspend serverfarm host sf1 rserver rs1 80 no inservice Real Server Suspend and Clear Connections serverfarm host sf1 rserver rs1 80 no inservice clear conn rserver rs1 80 serverfarm sf1 Real Server Change Weight serverfarm host sf1 rserver rs1 80 weight 2 CSMs Real Server Activation serverfarm host sf1 real 10.10.10.10 80 inservice Real Server Graceful Suspend serverfarm host sf1 real 10.10.10.10 80 inservice standby Real Server Suspend serverfarm host sf1 real 10.10.10.10 80 no inservice Real Server Suspend and Clear Connections serverfarm host sf1 real 10.10.10.10 80 no inservice clear module contentSwitchingModule 3 connections real 10.10.10.10 Real Server Change Weight serverfarm host sf1 rserver 10.10.10.10 80 weight 2 CSM Named Real Commands Sent Real Server Activation serverfarm host sf1 real name rs1 80 inservice Real Server Graceful Suspend serverfarm host sf1 real name rs1 80 inservice standby Table 8-4 CLI Commands Deployed from the Real Servers Table (continued) Command Sample CLI Sent 8-25 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Managing Real Servers Server Weight Ranges Table 8-5 displays the allowable server weight ranges by device type. Real Server Suspend serverfarm host sf1 real name rs1 80 no inservice Real Server Suspend and Clear Connections serverfarm host sf1 real name rs1 80 no inservice clear module contentSwitchingModule 3 connections real 10.10.10.10 Real Server Change Weight serverfarm host sf1 real name rs1 80 weight 2 CSS Devices Real Server Activation service myReal7 active Real Server Graceful Suspend service myReal7 weight 0 Real Server Suspend service myReal7 suspend Real Server Suspend and Clear Connections service myReal7 suspend Real Server Change Weight service myReal7 weight 2 Table 8-4 CLI Commands Deployed from the Real Servers Table (continued) Command Sample CLI Sent Table 8-5 Real Servers Table Server Weight Ranges Device Type Valid Weight Configurations ACE Appliances and Modules 1 to 100 CSMs 0 to 100 CSS Devices 0 to 10 8-26 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Dynamic Workload Scaling Configuring Dynamic Workload Scaling Note Dynamic Workload Scaling requires ACE software Version A4(2.0) or later release on either device type (appliance or module). This section describes how to configure the ACE Dynamic Workload Scaling (DWS) feature, which enables an ACE to burst traffic to a remote pool of VMs when the average CPU and/or memory usage of the local VMs has reached a specified maximum threshold value. When the usage drops below a specified minimum threshold value, the ACE stops bursting traffic to the remote VMs. Note To enable the ACE to use the VMs associated with DWS for load balancing, you must configure them as real servers on the ACE (see the “Configuring Real Servers” section on page 8-5). For more information about DWS, see the “ANM Overview” section on page 1-1 and the “Dynamic Workload Scaling Overview” section on page 8-4. Prerequisites DWS requires the following configuration elements: • An ACE with software Version A4(2.0) or later and configured with the following items: – Nexus 7000 Series switch—XML interface IP address of the local Cisco Nexus 7000 Series switch that the ACE polls to obtain VM location information (local or remote). You can define up to two switch profiles per Admin context depending on the ACE software version (see Guidelines and Restrictions). For information about defining a switch profile, see the “Configuring and Verifying a Cisco Nexus 7000 Series Switch Connection” section on page 8-27. Note The Nexus 7000 Series switch must be configured for DCI/OTV in the local data center and in the remote data center. For details about configuring a Nexus 7000 for DCI/OTV, see the Cisco Nexus 7000 NX-OS OTV Configuration Guide, Release 5.x. – VM Controller—IP address of the VM Controller (also known as VMware vCenter Server) that the ACE sends a health probe to monitor usage of the local VMs associated with a server farm. – VM probe—Probe that the ACE sends to the VM Controller to monitor local VM usage based on CPU usage, memory usage, or both (see the “Configuring Health Monitoring” section on page 8-49). – Server Farms—Groups of networked real servers (physical servers and VMs) that provide content delivery (see the “Configuring Server Farms” section on page 8-30).V • VMware vCenter Server 4.0 or later. • Multiple local and remote VMs configured as real servers and associated with server farms configured on the ACE. • ACE backend interface MTU set to 1430 or less to accommodate DCI encapsulation and the Don’t Fragment (DF) bit is automatically set on the DCI link. For details about setting the ACE MTU, see the Cisco 4700 Series Application Control Engine Appliance Routing and Bridging Configuration Guide. 8-27 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Dynamic Workload Scaling This section includes the following topics: • Configuring and Verifying a Cisco Nexus 7000 Series Switch Connection, page 8-27 • Configuring and Verifying a VM Controller Connection, page 8-29 Configuring and Verifying a Cisco Nexus 7000 Series Switch Connection Note This feature requires ACE software Version A4(2.0) or later release on either device type (appliance or module). You can configure an ACE with the Cisco Nexus 7000 Series switch attributes required to allow the ACE to communicate with the switch using SSH. When configured for DWS, the ACE uses the Nexus 7000 Series switch to obtain VM location information (local or remote). You can also use this procedure to edit the attributes of an existing Nexus 7000 Series switch profile or remove a switch profile. Guidelines and Restrictions The number of Nexus 7000 Series switch profiles that you can define per ACE Admin context is as follows: • ACE software Version A4(2.0) to A5(1.1)—One switch profile only. • ACE software Version A5(1.2) or later—Up to two switch profiles. Procedure Step 1 Choose Config > Devices > Admin_context > Load Balancing > Dynamic Workload Scaling > Nexus 7000 Setup. The Nexus 7000 Setup pane appears. Note If existing Nexus 7000 Series switch profiles already exist, the Name field lists their profile names in drop-down list on the right. Multiple switch profiles requires ACE software Version A5(1.2) or later. Step 2 From the Nexus 7000 Setup pane, do one of the following: • To define a new Nexus 7000 series switch profile, do the following: a. From the Name field, click the text box radio button if it is not already selected and enter a Nexus 7000 name with a maximum of 64 characters. See the Note at the beginning of this chapter for ACE object naming specifications. b. From the Primary IP filed, enter the Nexus 7000 XML interface IP address in dotted-decimal format (such as 192.168.11.1). c. From the User Name field, enter the username that the ACE uses for access and authentication on the Nexus 7000 Series switch. Valid entries are unquoted text strings with a maximum of 64 characters with no spaces. 8-28 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Dynamic Workload Scaling Note The user must have either the vdc-admin or network-admin role to receive the Nexus 7000 Series switch output for the VM location information in XML format. d. From the Password field, enter the password that the ACE uses for authentication on the Nexus 7000 Series switch. Valid entries are unquoted text strings with a maximum of 64 characters with no spaces. e. From the Confirm field, reenter the password and go to Step 3. • To edit an existing Nexus 7000 Series switch profile, do the following: a. From the Name field, click the radio button for the drop down list that contains the list of existing switch profile names. b. From the drop down list, choose the switch profile to edit. The current profile attributes display. c. Edit the profile fields as described in the procedure above for creating a new profile and go to Step 3. Step 3 Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. Note Configuring the ACE for DWS also requires configuring the ACE with the VM Controller information (see the “Configuring and Verifying a VM Controller Connection” section on page 8-29) and configuring a VM health probe (see the “Configuring Health Monitoring” section on page 8-49). Step 4 (Optional) Click Details to verify connectivity between the ACE and the Nexus 7000 Series switch. The ACE show nexus-device device_name detail CLI command output displays in a popup window and includes information such as the device name, IP address, and connection information. For more information about the command output, see the Cisco 4700 Series Application Control Engine Appliance Server Load-Balancing Configuration Guide. Step 5 (Optional) Click Delete to delete the currently configured Cisco Nexus 7000 series switch. Caution If the ACE is currently configured for DWS, deleting the Nexus 7000 Series switch disables the feature. Related Topics • Configuring and Verifying a VM Controller Connection, page 8-29 • Configuring Health Monitoring, page 8-49 • Configuring Dynamic Workload Scaling, page 8-26 • Dynamic Workload Scaling Overview, page 8-4 • Configuring Real Servers, page 8-5 • Configuring Load Balancing Using Server Farms, page 8-31 8-29 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Dynamic Workload Scaling Configuring and Verifying a VM Controller Connection Note This feature requires ACE software Version A4(2.0) or later release on either device type (appliance or module). You can configure an ACE with the VM Controller (VMware vCenter Server) attributes required to allow the ACE to communicate with the VM Controller to obtain local VM load information. Guidelines and Restrictions Configure only one VM Controller per ACE Admin context. Prerequisites The ACE is configured to communicate with the local Cisco Nexus 7000 Series switch that enables the ACE to discover the locality of the VM Controller VMs (see the “Configuring and Verifying a Cisco Nexus 7000 Series Switch Connection” section on page 8-27). Procedure Step 1 Choose Config > Devices > Admin_context > Load Balancing > Dynamic Workload Scaling > VM Controller Setup. The VM Controller Setup pane appears. Step 2 From the VM Controller Setup pane, define the VM Controller using the information in Table 8-6. Step 3 Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. Note Configuring the ACE for Dynamic Workload Scaling also requires configuring the ACE with the Nexus 7000 information (see the “Configuring and Verifying a Cisco Nexus 7000 Series Switch Connection” section on page 8-27) and configuring a VM health probe (see the “Configuring Health Monitoring” section on page 8-49). Table 8-6 VM Controller Setup Field Description Name VM Controller name (see the Note at the beginning of this chapter for ACE object naming specifications). URL IP address or URL for the VM Controller web services API agent. The URL must point to the VM Controller software development kit (SDK). For example, https://1.2.3.4/sdk. Enter up to 255 characters. User Name Username that the ACE uses for access and authentication on the VM Controller. The user must have a read-only role at least or a role with a read privilege. Valid entries are unquoted text strings with a maximum of 64 characters and no spaces. Password Password that the ACE uses for authentication on the VM Controller. Valid entries are unquoted text strings with a maximum of 64 characters and no spaces. Reenter the password in the Confirm field. 8-30 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Step 4 (Optional) Click Details to verify connectivity between the ACE and the remote VM Controller. The ACE show vm-controller device_name detail CLI command output displays in a popup window and includes information such as the VM Controller status, IP address, and connection information. Step 5 (Optional) Click Delete to delete the currently configured VM Controller. Note If the ACE is currently configured for Dynamic Workload Scaling, you must delete the associated VM health probe before you can delete the VM controller (see the “Configuring Health Monitoring” section on page 8-49). Related Topics • Configuring and Verifying a Cisco Nexus 7000 Series Switch Connection, page 8-27 • Configuring Health Monitoring, page 8-49 • Configuring Dynamic Workload Scaling, page 8-26 • Dynamic Workload Scaling Overview, page 8-4 • Configuring Real Servers, page 8-5 • Configuring Load Balancing Using Server Farms, page 8-31 Configuring Server Farms You can configure load balancing using server farms, which are groups of networked real servers (physical servers and VMs) that contain the same content and that typically reside in the same physical location in a data center. Websites often include groups of servers configured in a server farm. Load-balancing software distributes client requests for content or services among the real servers based on the configured policy and traffic classification, server availability and load, and other factors. If one server goes down, another server can take its place and continue to provide the same content to the clients who requested it. Guidelines and Restrictions • With Dynamic Workload Scaling configured on the ACE, the real servers that are VMs can also reside in a remote datacenter (see the “Configuring Dynamic Workload Scaling” section on page 8-26). • A server farm can support a mix of IPv6 and IPv4 real servers, and can be associated with both IPv6 and IPv4 probes. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. This section includes the following topics: • Configuring Load Balancing Using Server Farms, page 8-31 • Adding Real Servers to a Server Farm, page 8-37 • Configuring the Predictor Method for Server Farms, page 8-39 • Configuring Server Farm HTTP Return Error-Code Checking, page 8-46 • Displaying All Server Farms, page 8-48 • Displaying Server Farm Statistics and Status Information, page 8-48 8-31 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Configuring Load Balancing Using Server Farms Procedure Step 1 Choose Config > Devices > context > Load Balancing > Server Farms. The Server Farms table appears. Step 2 In the Server Farms table, click Poll Now to instruct ANM to poll the devices and display the current values, and click OK when prompted if you want to poll the devices for data now. Step 3 Click Add to add a new server farm, or choose an existing server farm and click Edit. The Server Farms configuration window appears. Step 4 In the Server Farms configuration window, configure the server farm using the information in Table 8-7. Table 8-7 Server Farm Attributes Field Description Name Unique name for this server farm or accept the automatically incremented value in this field. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. Type Type of server farm as follows: • Host—Server farm consists of real servers that provide content and services to clients. • Redirect—Server farm consists only of real servers that redirect client requests to alternate locations specified in the real server configuration. (See the “Configuring Real Servers” section on page 8-5.) Description Brief description for this server farm. Valid entries are unquoted alphanumeric text strings with no spaces and a maximum of 240 characters. Fail Action Action that the ACE is to take with respect to connections if any real server in the server farm fails: • N/A—The ACE is to take no action if any server in the server farm fails. • Purge—The ACE is to remove connections to a real server if that real server in the server farm fails. The ACE sends a reset command to both the client and the server that failed. • Reassign—The ACE is to reassign the existing server connections to the backup real server (if configured) if the real server fails after you enter this command. If a backup real server has not been configured for the failing server, this selection leaves the existing connections untouched in the failing real server. 8-32 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Failaction Reassign Across Vlans Option that is available only for the ACE module A2(3.0), ACE appliance A4(1.0), and later releases of either device type. This field appears only when the Fail Action is set to Reassign. Check the check box to specify that the ACE reassigns the existing server connections to the backup real server on a different VLAN interface (commonly referred to as a bypass VLAN) if the real server fails. If a backup real server has not been configured for the failing server, this option has no effect and leaves the existing connections untouched in the failing real server. Note the following configuration requirements and restrictions when you enable this option: • Enable the Transparent option (see the next Field) to instruct the ACE not to use NAT to translate the ACE VIP address to the server IP address. The Failaction Reassign Across Vlans option is intended for use in stateful firewall load balancing (FWLB) on your ACE, where the destination IP address for the connection coming in to the ACE is for the end-point real server, and the ACE reassigns the connection so that it is transmitted through a different next hop. • Enable the MAC Sticky option on all server-side interfaces to ensure that packets that are going to and coming from the same server in a flow will traverse the same firewalls or stateful devices (see the “Configuring Virtual Context VLAN Interfaces” section on page 12-6). • Configure the Predictor Hash Address option after you add the serverfarm (see the “Configuring the Predictor Method for Server Farms” section on page 8-39). • You must configure identical policies on the primary interface and the backup-server interface. The backup interface must have the same feature configurations as the primary interface. • If you configure a policy on the backup-server interface that is different from the policies on the primary-server interface, that policy will be effective only for new connections. The reassigned connection will always have only the primary-server interface policies. • Interface-specific features (for example, NAT, application protocol inspection, outbound ACLs, or SYN cookie) are not supported. • You cannot reassign connections to the failed real server after it comes back up. This restriction also applies to same-VLAN backup servers. • Real servers must be directly connected to the ACE. This requirement also applies to same-VLAN backup server. • You must disable sequence number randomization on the firewall (see the “Configuring Connection Parameter Maps” section on page 10-3). • Probe configurations should be similar on both ACEs and the interval values should be low. For example, if you configure a high interval value on ACE-1 and a low interval value on ACE-2, the reassigned connections may become stuck because of the probe configuration mismatch. ACE-2 with the low interval value will detect the primary server failure first and will reassign all its incoming connections to the backup-server interface VLAN. ACE-1 with the high interval value may not detect the failure before the primary server comes back up and will still point to the primary server. To minimize packet loss, we recommend the following probe parameter values on both ACEs: Interval: 2, Faildetect: 2, Passdetect interval: 2, and Passdetect count: 5. Table 8-7 Server Farm Attributes (continued) Field Description 8-33 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Transparent Field that appears only for host server farms. Specify whether network address translation from the VIP address to the server IP is to occur. Check the check box to indicate that network address translation from the VIP address to the server IP address is to occur. Uncheck the check box to indicate that network address translation from the VIP address to the server IP address is not to occur. Dynamic Workload Scaling Option that is available only for ACE software Version A4(2.0) or later release on either device type (appliance or module). Field that appears only for host server farms. Allows the ACE to burst traffic to remote VMs when the average CPU or memory usage of the local VMs has reached its specified maximum threshold value. The ACE stops bursting traffic to the remote VMs when the average CPU or memory usage of the local VMs has dropped below its specified minimum threshold value. This option requires that you have the ACE configured for Dynamic Workload Scaling using a Nexus 7000, VM Controller, and VM probe (see the “Configuring Dynamic Workload Scaling” section on page 8-26). Click one of the following radio button options: • N/A—Not applicable (default). • Local—Restricts the ACE to use of local VMs only for server load balancing. • Burst—Enables the ACE to burst traffic to remote VMs when needed. When you choose Burst, the VM Probe Name field displays along with a list of available VM probes. Choose an available VM probe or click Add to display the Health Monitoring popup window and create or edit a VM probe (see the “Configuring Health Monitoring” section on page 8-49). Fail-On-All Field that appears only for host server farms. By default, real servers that you configure in a server farm inherit the probes that you configure directly on that server farm. When you configure multiple probes on a server farm, the real servers in the server farm use an OR logic with respect to the probes, which means that if one of the probes configured on the server farm fails, all the real servers in that server farm fail and enter the PROBE-FAILED state. With AND logic, if one server farm probe fails, the real servers in the server farm remain in the operational state. If all the probes associated with the server farm fail, then all the real servers in that server farm fail and enter the PROBE-FAILED state. Check this check box to configure the real servers in a server farm to use AND logic with respect to multiple server farm probes. The Fail-On-All function is applicable to all probe types. Table 8-7 Server Farm Attributes (continued) Field Description 8-34 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Inband-Health Check Option that is available only for the ACE module A4(1.0), ACE appliance A4(1.0), and later releases of either device type. Field that appears only for host server farms. By default, the ACE monitors the health of all real servers in a configuration through the use of ARPs and health probes. However, there is latency period between when the real server goes down and when the ACE becomes aware of the state. The inband health monitoring feature allows the ACE to monitor the health of the real servers in the server farm through the following connection failures: • For TCP, resets (RSTs) from the server or SYN timeouts. • For UDP, ICMP Host, Network, Port, Protocol, and Source Route unreachable messages. When you configure the failure-count threshold and the number of these failures exceeds the threshold within the reset-time interval, the ACE immediately marks the server as failed, takes it out of service, and removes it from load balancing. The server is not considered for load balancing until the optional resume-service interval expires. The Inband-Health Check attributes are as follows: • Count—Tracks the total number of TCP or UDP failures, and increments the counters. • Log—Logs a syslog error message when the number of events reaches the threshold value that you set for the Connection Failure Threshold Count attribute. • Remove—Logs a syslog error message when the number of events reaches the configured threshold and removes the real server from service. Connection Failure Threshold Count This field appears only when the Inband-Health Check is set to Log or Remove. Enter the maximum number of connection failures that a real server can exhibit in the reset-time interval before ACE marks the real server as failed. Valid entries are as follows: • ACE appliance—1 to 4294967295 • ACE module—4 to 4294967295 Reset Timeout (Milliseconds) This field appears only when the Inband-Health Check is set to Log or Remove. Enter the number of milliseconds for the reset-time interval. Valid entries are integers from 100 to 300000. The default interval is 100. This interval starts when the ACE detects a connection failure. If the connection failure threshold is reached during this interval, the ACE generates a syslog message. If you configure the remove keyword, the ACE also removes the real server from service. Changing the setting of this option affects the behavior of the real server, as follows: • When the real server is in the OPERATIONAL state, even if several connection failures have occurred, the new reset-time interval takes effect the next time that a connection error occurs. • When the real server in the INBAND-HM-FAILED state, the new reset-time interval takes effect the next time that a connection error occurs after the server transitions to the OPERATIONAL state. Table 8-7 Server Farm Attributes (continued) Field Description 8-35 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Resume Service (Seconds) Field that appears only when the Inband-Health Check is set to Remove. Enter the number of seconds after a server has been marked as failed to reconsider it for sending live connections. Valid entries are integers from 30 to 3600. The default setting is 0. The setting of this option affects the behavior of the real server in the inband failed state, as follows: • When this field is not configured and has the default setting of 0, the real server remains in the failed state until you manually suspend and then reactivate it. • When this field is not configured and has the default setting of 0 and then you configure this option with an integer between 30 and 3,600, the failed real server immediately transitions to the Operational state. • When you configure this field and then increase the value, the real server remains in the failed state for the duration of the previously-configured value. The new value takes effect the next time the real server transitions to the failed state. • When you configure this field and then decrease the value, the failed real server immediately transitions to the Operational state. • When you configure this field with an integer between 30 and 3,600 and then reset it to the default of 0, the real server remains in the failed state for the duration of the previously-configured value. The default setting takes effect the next time the real server transitions to the failed state. Then the real server remains in the failed state until you manually suspend and then reactivate it. • When you change this field within the reset-time interval the real server in the OPERATIONAL with several connection failures, the new threshold interval takes effect the next time that a connection error occurs, even if it occurs within the current reset-time interval. Partial-Threshold Percentage Field that appears only for host server farms. Enter the minimum percentage of real servers in the primary server farm that must remain active for the server farm to stay up. If the percentage of active real servers falls below this threshold, the ACE takes the server farm out of service. Valid entries are from 0 to 99. The default is 0. Back Inservice Field that appears only for host server farms. Enter the percentage of real servers in the primary server farm that must be active again for the ACE to place the server farm back into service. Valid entries are from 0 to 99. The value in this field should be larger than the value in the Partial Threshold Percentage field. The default is 0. Table 8-7 Server Farm Attributes (continued) Field Description 8-36 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Step 5 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The window refreshes with additional configuration options: – To add real servers to the server farm, see the “Adding Real Servers to a Server Farm” section on page 8-37. – To specify a predictor method for the server farm, see the “Configuring the Predictor Method for Server Farms” section on page 8-39. – To configure return code checking, see the “Configuring Server Farm HTTP Return Error-Code Checking” section on page 8-46. • Click Cancel to exit the procedure without saving your entries and to return to the Server Farms table. • Click Next to deploy your entries and to configure another server farm. Step 6 (Optional) To display statistics and status information for an existing server farm, choose a server farm from the Server Farms table, and click Details. The show serverfarm name detail CLI command output appears. See the “Displaying Server Farm Statistics and Status Information” section on page 8-48 for details. Probes Field that appears only as follows: • For all host server farms. The Available probe list contains all probe types. • For redirect server farms configured on ACE devices that use the following software versions: – ACE module: A2(3.x) and later releases – ACE appliance: A3(x) and later releases The redirect server farm Available probe list contains only probes of the type Is Routed, which means that the ACE routes the probe address according to the ACE internal routing table (see the “Configuring Health Monitoring for Real Servers” section on page 8-51). In the Available Items list, choose the probes to use for health monitoring, and click Add. The selected probes appear in the Selected Items list. Note You can associate both IPv6 and IPv4 probes to a server farm. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Note The list of available probes does not include VM health monitoring probes. To choose a VM probe for monitoring local VM usage, see the Dynamic Workload Scaling field. To remove probes that you do not want to use for health monitoring, select them in the Selected Items list, and click Remove. The selected probes appear in the Available Items list. Table 8-7 Server Farm Attributes (continued) Field Description 8-37 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Related Topics • Configuring Health Monitoring for Real Servers, page 8-51 • Configuring Real Servers, page 8-5 • Configuring Sticky Groups, page 9-7 • Configuring the Predictor Method for Server Farms, page 8-39 • Configuring Server Farm HTTP Return Error-Code Checking, page 8-46 • Configuring Dynamic Workload Scaling, page 8-26 Adding Real Servers to a Server Farm You can add real servers to a server farm. After adding a server farm (see the “Configuring Server Farms” section on page 8-30), you can associate real servers with it and configure predictors and retcode maps. The options for these attributes appear after you have successfully added a new server farm. Assumptions This topic assumes the following: • A server farm has been added to ANM (see the “Configuring Server Farms” section on page 8-30). • At least one real server exists. Consideration A server farm can support a mix of IPv6 and IPv4 real servers. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Server Farms. The Server Farms table appears. Step 2 In the Server Farms table, choose the server farm that you want to associate with real servers. The Real Servers table appears. Step 3 In the Real Servers table, click Add to add a new entry, or select an existing server and click Edit to modify it. The Real Servers configuration pane appears. Step 4 In the Real Servers configuration pane, configure the real server using the information in Table 8-8. Table 8-8 Real Server Configuration Attributes Field Description Name Server that you want to associate with the server farm. Port Port number to be used for server port address translation (PAT). Valid entries are from 1 to 65535. Backup Server Name Server that is to act as the backup server for the server farm. Leave this field blank to indicate that there is no designated backup server for the server farm. Backup Server Port Server port number. If you select a backup server, enter the backup server port number. Valid entries are from 1 to 65535. 8-38 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Fail-On-All Field that appears only for real servers identified as host servers. By default, real servers with multiple probes configured for them have an OR logic associated with them. This means that if one of the real server probes fails, the real server fails and enters the PROBE-FAILED state. Check this checkbox to configure a real server to remain in the OPERATIONAL state unless all probes associated with it fail (AND logic). The Fail-On-All function is applicable to all probe types. State State of this server as follows: • In Service—The server is in service. • In Service Standby—The server is a backup server and remains inactive unless the primary server fails. If the primary server fails, the backup server becomes active and starts accepting connections. • Out Of Service—The server is out of service. Min. Connections Minimum number of connections that the number of connections must fall below before the ACE resumes sending connections to the server after it has exceeded the number in the Max. Connections field. The number in this field must be less than or equal to the number in the Max. Connections field. For ACE appliances, valid entries are from 2 to 4294967295. For ACE modules, valid entries are from 2 to 4000000. Max. Connections Maximum number of active connections that can be sent to the server. When the number of connections exceeds this number, the ACE stops sending connections to the server until the number of connections falls below the number specified in the Min. Connections field. For ACE appliances, valid entries are from 2 to 4294967295. For ACE modules, valid entries are from 2 to 4000000. Weight Weight to assign to the server. Valid entries are from 1 to 100. The default is 8. Probes Probes to apply to the server. Choose the probes in the Available Items list that you want to apply to this server, and click Add. The selected probes appear in the Selected Items list. To remove probes that you do not want to use, choose the probes in the Selected Items list, and click Remove. The selected probes appear in the Available Items list. Note The VM probe type does not display in the Available Items list even if you have one configured. Rate Bandwidth Bandwidth rate, which is the number of bytes per second and applies to the network traffic exchanged between the ACE and the real server in both directions. Specify the bandwidth limit in bytes per second. Valid entries are from 2 to 300000000. The default is 300000000. Rate Connection Connection rate, which is the number of connections per second received by the ACE and applies only to new connections destined to a real server. Specify the limit for connections per second. Valid entries are from 2 to 350000. The default is 350000. Table 8-8 Real Server Configuration Attributes (continued) Field Description 8-39 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Step 5 When you finish configuring this server for this server farm, do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Real Servers table. • Click Cancel to exit this procedure without saving your entries and to return to the Real Servers table. • Click Next to deploy your entries and to add another real server for this server farm. Related Topics • Configuring Health Monitoring for Real Servers, page 8-51 • Configuring Real Servers, page 8-5 • Configuring Sticky Groups, page 9-7 • Configuring the Predictor Method for Server Farms, page 8-39 • Configuring Server Farm HTTP Return Error-Code Checking, page 8-46 • Configuring Dynamic Workload Scaling, page 8-26 Configuring the Predictor Method for Server Farms You can configure the predictor method for a server farm. The predictor method specifies how the ACE is to select a server in the server farm when it receives a client request for a service. After adding a server farm (see the “Configuring Server Farms” section on page 8-30), you can associate real servers with it and configure the predictor method and retcode maps. The options for these attributes appear after you have successfully added a new server farm. Note You can configure only one predictor method per server farm. Assumptions This topic assumes the following: • A server farm has been added to ANM (see the “Configuring Server Farms” section on page 8-30.) • At least one real server exists. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Server Farms. The Server Farms table appears. Step 2 In the Server Farms table, choose the server farm that you want to configure the predictor method for, and click the Predictor tab. The Predictor configuration pane appears. Step 3 In the Type field of the Predictor configuration pane, choose the method that the ACE is to use to select a server in this server farm when it receives a client request (see Table 8-9). Step 4 Enter the required information for the selected predictor method (see Table 8-9). 8-40 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Table 8-9 Predictor Method Attributes Predictor Method Description / Action Hash Address Server selection method that uses a hash value based on the source or destination IP address. To configure the hash address predictor method, do the following: a. In the Mask Type field, indicate whether server selection is based on source IP address or the destination IP address as follows: – N/A—This option is not defined. – Destination—The server is selected based on the destination IP address. – Source—The server is selected based on the source IP address. Note If you configure the server farm with IPv6 and IPv4 Hash Address predictors at the same time, both predictors must have the same mask type. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. b. In the IP Netmask field, choose the subnet mask to apply to the address. If none is specified, the default is 255.255.255.255. c. In the IPv6 Prefix-Length field, enter the IPv6 prefix length. If none is specified, the default is 128. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later. 8-41 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Hash Content Server selection method that uses a hash value based on the specified content string of the HTTP packet body. Do the following: a. In the Begin Pattern field, enter the beginning pattern of the content string and the pattern string to match before hashing. If you do not specify a beginning pattern, the ACE starts parsing the HTTP body immediate following the offset byte. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. b. In the End Pattern field, enter the pattern that marks the end of hashing. If you do not specify either a length or an end pattern, the ACE continues to parse the data until it reaches the end of the field or the end of the packet, or until it reaches the maximum body parse length. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. c. In the Length (Bytes) field, enter the length in bytes of the portion of the content (starting with the byte after the offset value) that the ACE uses for sticking the client to the server. Valid entries are from 1 to 1000 bytes. The offset and length can vary from 0 to 1000 bytes. If the payload is longer than the offset but shorter than the offset plus the length of the payload, the ACE sticks the connection based on that portion of the payload starting with the byte after the offset value and ending with the byte specified by the offset plus the length. The total of the offset and the length cannot exceed 1000. Note You cannot specify both the length and the end-pattern options for a Hash Content predictor. d. In the HTTP Content Offset (Bytes) field, enter the portion of the content that the ACE uses to stick the client on a particular server by indicating the bytes to ignore starting with the first byte of the payload. Valid entries are integers from 0 to 999 bytes. The default is 0, which indicates that the ACE does not exclude any portion of the content. Hash Cookie Server selection method that uses a hash value based on the cookie name. In the Cookie Name field, enter a cookie name in the form of an unquoted text string with no spaces and a maximum of 64 characters. Hash Header Server selection method that uses a hash value based on the header name. In the Header Name field, choose the HTTP header to be used for server selection as follows: • To specify an HTTP header that is not one of the standard HTTP headers, click the first radio button and enter the HTTP header name in the Header Name field. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. • To specify one of the standard HTTP headers, click the second radio button, and then choose one of the HTTP headers from the list. Table 8-9 Predictor Method Attributes (continued) Predictor Method Description / Action 8-42 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Hash Layer4 Layer 4 generic protocol load-balancing method. Use this predictor to load balance packets from protocols that are not explicitly supported by the ACE. a. In the Begin Pattern field, enter the beginning pattern of the Layer 4 payload and the pattern string to match before hashing. If you do not specify a beginning pattern, the ACE starts parsing the HTTP body immediate following the offset byte. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. b. In the End Pattern field, enter the pattern that marks the end of hashing. If you do not specify either a length or an end pattern, the ACE continues to parse the data until it reaches the end of the field or the end of the packet, or until it reaches the maximum body parse length. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. c. In the Length (Bytes) field, enter the length in bytes of the portion of the payload (starting with the byte after the offset value) that the ACE uses for sticking the client to the server. Valid entries are from 1 to 1000 bytes. The offset and length can vary from 0 to 1000 bytes. If the payload is longer than the offset but shorter than the offset plus the length of the payload, the ACE sticks the connection based on that portion of the payload starting with the byte after the offset value and ending with the byte specified by the offset plus the length. The total of the offset and the length cannot exceed 1000. Note You cannot specify both the length and end-pattern options for a Hash Layer 4 predictor. d. In the HTTP Content Offset (Bytes) field, enter the portion of the content that the ACE uses to stick the client on a particular server by indicating the bytes to ignore starting with the first byte of the payload. Valid entries are from 0 to 999 bytes. The default is 0, which indicates that the ACE does not exclude any portion of the content. Hash URL Server selection method that uses a hash value based on the URL. Use this method to load balance firewalls. Enter values in one or both of the pattern fields as follows: • In the URL Begin Pattern field, enter the beginning pattern of the URL and the pattern string to parse. • In the URL End Pattern field, enter the ending pattern of the URL and the pattern string to parse. Valid entries for these fields are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters for each pattern that you configure. The following special characters are also allowed: @ # $ Table 8-9 Predictor Method Attributes (continued) Predictor Method Description / Action 8-43 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Least Bandwidth Server with the least amount of network traffic over a specified sampling period. Do the following: a. In the Assess Time (Seconds) field, enter the number of seconds for which the ACE is to collect traffic information. Valid entries are from 1 to 10 seconds. b. In the Least Bandwidth Samples field, enter the number of samples over which you want to weight and average the results of the probe query to calculate the final load value. Valid entries are 1, 2, 4, 8, and 16 (values from 1 to 16 that are also a power of 2). Least Connections Server with the fewest number of connections. In the Slow Start Duration (Seconds) field, enter the slow-start value to be applied to this predictor method. Valid entries are from 1 to 65535, where 1 is the slowest ramp-up value. The slow-start mechanism is used to avoid sending a high rate of new connections to servers that you have just put into service. Table 8-9 Predictor Method Attributes (continued) Predictor Method Description / Action 8-44 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Least Loaded Least loaded server based on information from SNMP probes. Do the following: a. In the SNMP Probe Name field, choose the name of the SNMP probe to use. b. In the Auto Adjust field, configure the autoadjust feature to instruct the ACE to apply the maximum load of 16000 to a real server whose load reaches zero or override the default behavior. By default, the ACE applies the average load of the server farm to a real server whose load is zero. The ACE periodically adjusts this load value based on feedback from the server SNMP probe and other configured options. Options include the following: – Average—Instructs the ACE to apply the average load of the server farm to a real server whose load is zero. This setting allows the server to participate in load balancing, while preventing it from being flooded by new connections. This is the default setting. – Maxload—Instructs the ACE to apply the maximum load of the server farm to a real server whose load reaches zero. The maxload option requires the following ACE software versions: - ACE appliance—A3(2.7) or A4(1.0) or later - ACE module—A2(2.4), A2(3.2), or A4(1.0) or later If you choose the maxload option and the ACE does not support the option, ANM issues a command parse error message. – Off—Instructs the ACE to send all new connections to the server that has a load of zero until the next load update arrives from the SNMP probe for this server. There may be times when you want the ACE to send all new connections to a real server whose load is zero. c. In the Weight Connection field, check the check box to instruct the ACE to use the current connection count in the final load calculation for a real server. When you configure this option, the ACE includes the current connection count in the total load calculation for each real server in a server farm. Uncheck the check box to reset the behavior of the ACE to the default of excluding the current connection count from the load calculation. To instruct the ACE to select the server with the lowest load, use the predictor least-loaded command in server farm host or redirect configuration mode. With this predictor, the ACE uses SNMP probes to query the real servers for load parameter values (for example, CPU utilization or memory utilization). This predictor is considered adaptive because the ACE continuously provides feedback to the load-balancing algorithm based on the behavior of the real server. To use this predictor, you must associate an SNMP probe with it. The ACE queries user-specified OIDs periodically based on a configurable time interval. The ACE uses the retrieved SNMP load value to determine the server with the lowest load. The syntax of this predictor command is as follows: predictor least-loaded probe name The name argument specifies the identifier of the existing SNMP probe that you want the ACE to use to query the server. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters. Table 8-9 Predictor Method Attributes (continued) Predictor Method Description / Action 8-45 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Step 5 Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. Related Topics • Configuring Health Monitoring for Real Servers, page 8-51 • Configuring Real Servers, page 8-5 • Configuring Sticky Groups, page 9-7 • Adding Real Servers to a Server Farm, page 8-37 • Configuring Dynamic Workload Scaling, page 8-26 Least Loaded (continued) For example, to configure the ACE to select the real server with the lowest load based on feedback from an SNMP probe called PROBE_SNMP, enter the following commands: host1/Admin(config)# serverfarm SF1 host1/Admin(config-sfarm-host)# predictor least-loaded probe PROBE_SNMP host1/Admin(config-sfarm-host-predictor)# To reset the predictor method to the default of round-robin, enter the following command: host1/Admin(config-sfarm-host)# no predictor Response Server selection method based on the lowest response time for a requested response-time measurement. a. In the Response Type field, select the type of measurement to use as follows: – App-Req-To-Resp—The response time from when the ACE sends an HTTP request to a server to the time that the ACE receives a response from the server for that request. – Syn-To-Close—The response time from when the ACE sends a TCP SYN to a server to the time that the ACE receives a CLOSE from the server. – Syn-To-Synack—The response time from when the ACE sends a TCP SYN to a server to the time that the ACE receives a SYN-ACK from the server. b. In the Response Samples field, enter the number of samples over which you want to average the results of the response-time measurement. Valid entries are 1, 2, 4, 8, and 16 (values from 1 to 16 that are also a power of 2). c. In the Weight Connection field, check the check box to instruct the ACE to use the current connection count in the final load calculation for a real server. When you configure this option, the ACE includes the current connection count in the total load calculation for each real server in a server farm. Uncheck the check box to reset the behavior of the ACE to the default of excluding the current connection count from the load calculation. Round Robin Server selection method in which The ACE selects the next server in the list of servers based on server weight. This method is the default predictor. Table 8-9 Predictor Method Attributes (continued) Predictor Method Description / Action 8-46 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Configuring Server Farm HTTP Return Error-Code Checking Note This feature is available only for server farms configured as hosts. It is not available for server farms configured with the type Redirect. You can configure HTTP return error-code checking (retcode map) for a server farm. After adding a server farm (see the “Configuring Server Farms” section on page 8-30), you can associate real servers with it and configure the predictor method and retcode maps. These options appear after you have successfully added a server farm. Assumption A host type server farm has been added to ANM (see the “Configuring Server Farms” section on page 8-30). Procedure Step 1 Choose Config > Devices > context > Load Balancing > Server Farms. The Server Farms table appears. Step 2 In the Server Farms table, choose the server farm that you want to configure for return error-code checking, and click the Retcode Map tab. The Retcode Map table appears. Step 3 In the Retcode Map table, click Add to add a new entry to the table. The Retcode Map configuration pane appears. Note You cannot modify an entry in the Retcode Map table. Instead, delete the existing entry, then add a new one. Step 4 In the Lowest Retcode field of the Retcode Map configuration pane, enter the minimum value for an HTTP return error code. Valid entries are from 100 to 599. This number must be less than or equal to the number in the Highest Retcode field. Step 5 In the Highest Retcode field, enter the maximum number for an HTTP return error code. Valid entries are from 100 to 599. This number must be greater than or equal to the number in the Lowest Retcode field. Step 6 In the Type field, specify the action to be taken and related options using the information in Table 8-10. Note For ACE appliances, the only available option is Count. Table 8-10 Return-Code Type Configuration Options Option Description Count Total number of return codes received for each return code number that you specify. 8-47 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Step 7 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Retcode Map table. • Click Next to deploy your entries and to add another retcode map. Log Syslog error message generated when the number of events reaches a specified threshold. a. In the Threshold field, enter the number of events that the ACE is to receive before generating a syslog error message. Valid entries are as follows: – ACE appliance (all) and ACE module pre A4(1.0)—1 to 4294967295. – ACE module A4(1.0)—4 to 4294967295. b. In the Reset (Seconds) field, enter the time interval in seconds for which the ACE checks for the return code. Valid entries are as follows: – ACE appliance or module pre A4(1.0)—1 to 4294967295 – ACE appliance or module A4(1.0) and later—1 to 2147483647 Remove The ACE generates a syslog error message when the number of events reaches a specified threshold and then removes the server from service. a. In the Threshold field, enter the number of events that the ACE is to receive before generating a syslog error message and removing the server from service. Valid entries are from 1 to 4294967295. b. In the Reset (Seconds) field, enter the time interval in seconds for which the ACE checks for the return code. Valid entries are from 1 to 4294967295 seconds. c. In the Resume Service (Seconds) field, enter the number of seconds that the ACE waits before it resumes service for the real server automatically after taking the real server out of service. Valid entries are 30 to 3600 seconds. The default is 0 seconds. The setting of this field affects the behavior of the real server in the failed state, as follows: – When this field is not configured and has the default setting of 0, the real server remains in the failed state until you manually remove it from service and read it. – When this field is not configured and has the default setting of 0 and then you configure it with an integer between 30 and 3,600, the failed real server immediately transitions to the Operational state. – When you configure this field and then increase the value, the real server remains in the failed state for the duration of the previously-configured value. The new value takes effect the next time the real server transitions to the failed state. – When you configure this field and then decrease the value, the failed real server immediately transitions to the Operational state. – When you configure this field with an integer between 30 and 3,600 and then reset it to the default of 0, the real server remains in the failed state for the duration of the previously-configured value. The default setting takes effect the next time the real server transitions to the failed state. Then the real server remains in the failed state until you manually remove it from service and read it. Table 8-10 Return-Code Type Configuration Options (continued) Option Description 8-48 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Server Farms Related Topics • Information About Virtual Contexts, page 6-2 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Real Servers, page 8-5 • Configuring Sticky Groups, page 9-7 • Configuring Dynamic Workload Scaling, page 8-26 Displaying All Server Farms You can display all server farms associated with a virtual context. Procedure Step 1 Choose Config > Devices. The Virtual Contexts table appears. Step 2 In the Virtual Contexts table, choose the virtual context with the server farms you want to display, and click Load Balancing > Server Farms. The Server Farms table appears with the following information: • Server farm name • Server farm type (either host or redirect) • Description • Number of real servers associated with the server farm • Number of predictor methods for the server farm • Number of entries in the HTTP retcode map table You can click on any of the entries in the last three columns to view specific information about those entries. Related Topics • Displaying Server Farm Statistics and Status Information, page 8-48 • Configuring Server Farms, page 8-30 • Adding Real Servers to a Server Farm, page 8-37 • Configuring the Predictor Method for Server Farms, page 8-39 • Configuring Server Farm HTTP Return Error-Code Checking, page 8-46 • Configuring Dynamic Workload Scaling, page 8-26 Displaying Server Farm Statistics and Status Information You can display statistics and status information for a particular server farm. 8-49 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring Procedure Step 1 Choose Config > Devices > context > Load Balancing > Server Farms. The Server Farms table appears. Step 2 In the Server Farms table, choose a server farm from the Server Farms table, and click Details. The show serverfarm name detail CLI command output appears. For details about the displayed output fields, see the Cisco ACE Module Server Load-Balancing Configuration Guide or the Cisco ACE 4700 Series Appliance Server Load-Balancing Configuration Guide, Chapter 2, Configuring Real Servers and Server Farms. Step 3 Click Update Details to refresh the output for the show serverfarm name detail CLI command. The new information appears in a separate panel with a new timestamp; both the old and the new server farm statistics and status information appear side-by-side to avoid overwriting the last updated information. Step 4 Click Close to return to the Server Farms table. Related Topics • Displaying All Server Farms, page 8-48 • Configuring Server Farms, page 8-30 • Adding Real Servers to a Server Farm, page 8-37 • Configuring the Predictor Method for Server Farms, page 8-39 • Configuring Server Farm HTTP Return Error-Code Checking, page 8-46 • Configuring Dynamic Workload Scaling, page 8-26 Configuring Health Monitoring You can instruct the ACE to check the health of servers and server farms by configuring health probes (sometimes referred to as keepalives). After you create a probe, you assign it to a real server or a server farm. A probe can be one of many types, including TCP, ICMP, Telnet, HTTP, and so on. You can also configure scripted probes using the TCL scripting language (see the “TCL Scripts” section on page 8-50). The ACE sends out probes periodically to determine the status of a server, verifies the server response, and checks for other network problems that may prevent a client from reaching a server. Based on the server response, the ACE can place the server in or out of service, and, based on the status of the servers in the server farm, it can make reliable load-balancing decisions. Health monitoring on the ACE tracks the state of a server by sending out probes. Also referred to as out-of-band health monitoring, the ACE verifies the server response or checks for any network problems that can prevent a client to reach a server. Based on the server response, the ACE can place the server in or out of service, and can make reliable load-balancing decisions. The ACE identifies the health of a server in the following categories: • Passed—The server returns a valid response. • Failed—The server fails to provide a valid response to the ACE or the ACE is unable to reach a server for a specified number of retries. 8-50 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring By configuring the ACE for health monitoring, the ACE sends active probes periodically to determine the server state. The ACE supports 4000 unique probe configurations which includes ICMP, TCP, HTTP, and other predefined health probes. The ACE also allows the opening of 1000 sockets simultaneously. This section includes the following topics: • “TCL Scripts” section on page 8-50 • “Configuring Health Monitoring for Real Servers” section on page 8-51 • “Configuring Probe Attributes” section on page 8-56 • “Configuring DNS Probe Expect Addresses” section on page 8-73 • “Configuring Headers for HTTP and HTTPS Probes” section on page 8-74 • “Configuring Health Monitoring Expect Status” section on page 8-74 • “Configuring an OID for SNMP Probes” section on page 8-76 • “Displaying Health Monitoring Statistics and Status Information” section on page 8-77 TCL Scripts The ACE supports several specific types of health probes (for example HTTP, TCP, or ICMP health probes) when you need to use a diverse set of applications and health probes to administer your network. The basic health probe types supported in the current ACE software release may not support the specific probing behavior that your network requires. To support a more flexible health-probing functionality, the ACE allows you to upload and execute Toolkit Command Language (TCL) scripts on the ACE. The TCL interpreter code in the ACE is based on Release 8.44 of the standard TCL distribution. You can create a script to configure health probes. Script probes operate similar to other health probes available in the ACE software. As part of a script probe, the ACE executes the script periodically, and the exit code that is returned by the executing script indicates the relative health and availability of specific real servers. For information on health probes, see the “Configuring Health Monitoring for Real Servers” section on page 8-51. For your convenience, the following sample scripts for the ACE are available to support the TCL feature and are supported by Cisco TAC: • ECHO_PROBE_SCRIPT • FINGER_PROBE_SCRIPT • FTP_PROBE_SCRIPT • HTTP_PROBE_SCRIPT • HTTPCONTENT_PROBE • HTTPHEADER_PROBE • HTTPPROXY_PROBE • IMAP_PROBE • LDAP_PROBE • MAIL_PROBE • POP3_PROBE • PROBENOTICE_PROBE 8-51 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring • RTSP_PROBE • SSL_PROBE_SCRIPT These scripts are located in the probe: directory and are accessible in both the Admin and user contexts. Note that the script files in the probe: directory are read-only, so you cannot copy or modify them. However, you can copy files from the probe: directory. For more information, see either the Cisco Application Control Engine Module Administration Guide or the Cisco 4700 Series Application Control Engine Appliance Administration Guide. To load a script into memory on the ACE and enable it for use, use the script file command. For detailed information on uploading and executing TCL scripts on the ACE, see either the Cisco ACE Module Server Load-Balancing Configuration Guide or the Cisco ACE 4700 Series Appliance Server Load-Balancing Configuration Guide. Configuring Health Monitoring for Real Servers You can establish monitoring of real servers to determine their viability in load-balancing decisions. To check the health and availability of a real server, the ACE periodically sends a probe to the real server. Depending on the server response, the ACE determines whether or not to include the server in its load-balancing decision. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Health Monitoring. The Health Monitoring table appears. Step 2 In the Health Monitoring table, click Add to add a new health monitoring probe, or choose an existing entry and click Edit to modify it. The Health Monitoring window appears. Step 3 In the Name field of the Health Monitoring window, enter a name that identifies the probe and that associates the probe with the real server. Valid entries are text strings with a maximum of 64 characters. Step 4 In the Type field, choose the type of probe that you want to use. The probe type determines what the probe sends to the real server. See Table 8-11 for the types of probes and their descriptions. Table 8-11 Probe Types Probe Type Description DNS Sends a request to a DNS server giving it a configured domain. To determine if the server is up, the ACE must receive the configured IP address for that domain. ECHO-TCP Sends a string to the server and compares the response with the original string. If the response string matches the original, the server is marked as passed. If not, the ACE retries as configured before the server is marked as failed. ECHO-UDP Sends a string to the server and compares the response with the original string. If the response string matches the original, the server is marked as passed. If not, the ACE retries as configured before the server is marked as failed. FINGER Sends a probe to the server to verify that a defined username is a username on the server. 8-52 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring FTP Initiates an FTP session. By default, this probe is for an anonymous login with the option of configuring a user ID and password. The ACE performs an FTP GET or LS to determine the outcome of the problem. This probe supports only active connections. HTTP Sets up a TCP connection and issues an HTTP request. Any valid HTTP response causes the probe to mark the real server as passed. HTTPS Similar to an HTTP probe, but this probe uses SSL to generate encrypted data. ICMP Sends an ICMP request and listens for a response. If the server returns a response, the ACE marks the real server as passed. If there is no response and times out, or an ICMP standard error occurs, such as DESTINATION_UNREACHABLE, the ACE marks the real server as failed. IMAP Initiates an IMAP session, using a configured user ID and password. Then, the probe attempts to retrieve email from the server and validates the result of the probe based on the return codes received from the server. POP Initiates a POP session, using a configured user ID and password. Then, the probe attempts to retrieve email from the server and validates the result of the probe based on the return codes received from the server. RADIUS Connects to a RADIUS server and logs into it to determine if the server is up. RTSP Establishes a TCP connection and sends a request packet to the server. The ACE compares the response with the configured response code to determine whether the probe succeeded. Scripted Executes probes from a configured script to perform health probing. This method allows you to author specific scripts with features not present in standard probes. For ACE appliances, the script probe filename must first be established on the device. SIP-TCP Establishes a TCP connection and sends an OPTIONS request packet to the user agent on the server. The ACE compares the response with the configured response code or expected string, or both, to determine whether the probe has succeeded. If you do not configure an expected status code, any response from the server is marked as failed. SIP-UDP Establishes a UDP connection and sends an OPTIONS request packet to the user agent on the server. The ACE compares the response with the configured response code or expected string, or both, to determine whether the probe has succeeded. If you do not configure an expected status code, any response from the server is marked as failed. SMTP Initiates an SMTP session by logging into the server. SNMP Establishes a UDP connection and sends a maximum of eight SMNP OID queries to probe the server. The ACE weighs and averages the load information that is retrieved and uses it as input to the least-loaded algorithm for load-balancing decisions. If the retrieved value is within the configured threshold, the server is marked as passed. If the threshold is exceeded, the server is marked as failed. TCP Initiates a TCP handshake and expects a response. By default, a successful response causes the probe to mark the server as passed. The probe then sends a FIN to end the session. If the response is not valid, or if there is no response, the probe marks the real server as failed. TELNET Establishes a connection to the real server and verifies that a greeting from the application was received. Table 8-11 Probe Types (continued) Probe Type Description 8-53 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring Step 5 Enter health monitoring general attributes (see Table 8-12). Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Note Click More Settings to access the additional general attributes for the selected probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. UDP Sends a UDP packet to a real server. The probe marks the server as failed only if an ICMP Port Unreachable messages is returned. VM This probe type requires the following: • The ACE appliance or module is using software Version A4(2.0) or a later release. • The ACE is configured with a VM Controller connection (see the “Configuring and Verifying a VM Controller Connection” section on page 8-29). Sends a probe to the VMware VM Controller to determine the average amount of both CPU and memory usage of its associated local VMs. The probe response determines whether the ACE load-balances traffic to the local VMs only or bursts traffic to the remote VMs due to high usage of the local VMs. Note You use a VM probe when you configure the ACE for Dynamic Workload Scaling (see the “Configuring Dynamic Workload Scaling” section on page 8-26). Table 8-11 Probe Types (continued) Probe Type Description Table 8-12 Health Monitoring General Attributes Field Action Description Description for this probe. Valid entries are unquoted alphanumeric text strings with no spaces and a maximum of 240 characters. Probe Interval (Seconds) Number of seconds that the ACE is to wait before sending another probe to a server marked as passed. Valid entries are from 2 to 65535 for all probe types except the VM probe, which has a range from 300 to 65535. The default values are as follows: • ACE appliance (all software versions)—Default is 15 seconds for all probe types except the VM probe, which has a default of 300 seconds. • ACE module: – Software Version A4(1.0) and later—Default is 15 seconds for all probe types except the VM probe, which has a default of 300 seconds. – All software versions before A4(1.0)—Default is 120 seconds. Note The VM probe type requires ACE software Version A4(2.0) or later on either device type. 8-54 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring Pass Detect Interval (Seconds) Number of seconds that the ACE is to wait before sending another probe to a server marked as failed. Valid entries are from 2 to 65535. The default values are as follows: • ACE appliance (all software versions)—Default is 60 seconds. • ACE module: – Software Version A4(1.0) and later—Default is 60 seconds. – All software versions before A4(1.0)—Default is 300 seconds. Note This field is not applicable for the VM probe type. Fail Detect Consecutive number of times that an ACE must detect that probes have failed to contact a server before marking the server as failed. Valid entries are from 1 to 65535. The default is 3. Note This field is not applicable for the VM probe type. More Settings (Not applicable for the VM probe type) Pass Detect Count Number of successful probe responses from the server before the server is marked as passed. Valid entries are from 1 to 65535. The default is 3. Receive Timeout (Seconds) Number of seconds that the ACE is to wait for a response from a server that has been probed before marking the server as failed. Valid entries are from 1 to 65535. The default is 10. Destination IPv4/IPv6 Address1 The IPv6 option requires ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. Preferred destination IP address. By default, the probe uses the IP address from the real or virtual server configuration for the destination IP address. To override the destination address that the probe uses, enter the preferred destination IP address in this field. Note The following probes support IPv6 destination addresses: DNS, HTTP, HTTPS, ICMP, TCP, and UDP. Note When you assign a probe to a real server, they must be configured with the same IP address type (IPv6 or IPv4). Is Routed 2 Check box that indicates that the destination IP address is routed according to the ACE internal routing table. Uncheck the check box to indicate that the destination IP address is not routed according to the ACE internal routing table. Port By default, the precedence in which the probe inherits the port number is as follows: • The port number that you configure for the probe. • The configured port number from the real server in server farm. • The configured port number from the VIP in a Layer 3 and Layer 4 class map. • The default port number. Table 8-13 lists the default port number for each probe type. If you explicitly configure a default port, the ACE always sends the probe to the default port. The probe does not dynamically inherit the port number from the real server in a server farm or from the VIP specified in the class map. Table 8-12 Health Monitoring General Attributes (continued) Field Action 8-55 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring Step 6 Enter the attributes for the specific probe type selected as follows: • For DNS probes, see Table 8-14. • For Echo-TCP probes, see Table 8-15. • For Echo-UDP probes, see Table 8-16. • For Finger probes, see Table 8-17. • For FTP probes, see Table 8-18. • For HTTP probes, see Table 8-19. • For HTTPS probes, see Table 8-20. • There are no specific attributes for ICMP probes. • For IMAP probes, see Table 8-21. • For POP probes, see Table 8-22. • For RADIUS probes, see Table 8-23. • For RTSP probes, see Table 8-24. 1. The Dest IP Address field is not applicable to the Scripted probe type. 2. The Is Routed field is not applicable to the RTSP, Scripted, SIP-TCP, and SIP-UDP probe types. Table 8-13 Default Port Numbers for Probe Types Probe Type Default Port Number DNS 53 Echo 7 Finger 79 FTP 21 HTTP 80 HTTPS 443 ICMP Not applicable IMAP 143 POP3 110 RADIUS 1812 RTSP 554 Scripted 1 SIP (both TCP and UDP) 5060 SMTP 25 SNMP 161 Telnet 23 TCP 80 UDP 53 VM 443 8-56 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring • For Scripted probes, see Table 8-25. • For SIP-TCP probes, see Table 8-26. • For SIP-UDP probes, see Table 8-27. • For SMTP probes, see Table 8-28. • For SNMP probes, see Table 8-29. • For TCP probes, see Table 8-30. • For Telnet probes, see Table 8-31. • For UDP probes, see Table 8-32. • For VM probes, see Table 8-33. Step 7 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Health Monitoring table. • Click Next to deploy your entries and to configure another probe. Step 8 (Optional) To display statistics and status information for a particular probe, choose the probe from the Health Monitoring table, and click Details. The show probe name detail CLI command output appears. See the “Displaying Health Monitoring Statistics and Status Information” section on page 8-77 for details. Related Topics • Configuring DNS Probe Expect Addresses, page 8-73 • Configuring Headers for HTTP and HTTPS Probes, page 8-74 • Configuring Health Monitoring Expect Status, page 8-74 • Displaying Health Monitoring Statistics and Status Information, page 8-77 • Configuring Real Servers, page 8-5 • Configuring Server Farms, page 8-30 • Configuring Sticky Groups, page 9-7 Configuring Probe Attributes You can configure health monitoring probe-specific attributes. This section includes the following topics: • DNS Probe Attributes, page 8-57 • Echo-TCP Probe Attributes, page 8-58 • Echo-UDP Probe Attributes, page 8-58 • Finger Probe Attributes, page 8-58 • FTP Probe Attributes, page 8-59 8-57 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring • HTTP Probe Attributes, page 8-60 • HTTPS Probe Attributes, page 8-61 • IMAP Probe Attributes, page 8-63 • POP Probe Attributes, page 8-64 • RADIUS Probe Attributes, page 8-65 • RTSP Probe Attributes, page 8-65 • Scripted Probe Attributes, page 8-66 • SIP-TCP Probe Attributes, page 8-67 • SIP-UDP Probe Attributes, page 8-68 • SMTP Probe Attributes, page 8-69 • SNMP Probe Attributes, page 8-69 • TCP Probe Attributes, page 8-70 • Telnet Probe Attributes, page 8-70 • UDP Probe Attributes, page 8-71 • VM Probe Attributes, page 8-72 Refer to the following topics for additional configuration options for health-monitoring probes: • Configuring DNS Probe Expect Addresses, page 8-73 • Configuring Headers for HTTP and HTTPS Probes, page 8-74 • Configuring Health Monitoring Expect Status, page 8-74 • Configuring an OID for SNMP Probes, page 8-76 • Displaying Health Monitoring Statistics and Status Information, page 8-77 DNS Probe Attributes Table 8-14 lists the DNS probe attributes. Note Click More Settings to access the additional attributes for the DNS probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. To configure expect addresses for DNS probes, see the “Configuring DNS Probe Expect Addresses” section on page 8-73. Table 8-14 DNS Probe Attributes Field Action Domain Name Domain name that the probe is to send to the DNS server. Valid entries are unquoted text strings with a maximum of 255 characters. More Settings Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. 8-58 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring Echo-TCP Probe Attributes Table 8-15 lists the Echo-TCP probe attributes. Note Click More Settings to access the additional attributes for the Echo-TCP probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. Echo-UDP Probe Attributes Table 8-16 lists the Echo-UDP probe attributes. Note Click More Settings to access the additional attributes for the Echo-UDP probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. Finger Probe Attributes Table 8-17 lists the Finger probe attributes. Note Click More Settings to access the additional attributes for the Finger probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. Table 8-15 Echo-TCP Probe Attributes Field Action Send Data ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters. More Settings TCP Connection Termination Check box that when checked, configures the ACE to terminate TCP connections gracefully by sending a FIN to the server. Uncheck the check box to configure the ACE to terminate a TCP connection by sending an RST. Open Timeout (Seconds) Number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535. The default is as follows: • For ACE module version A2(3.x) and earlier, the default is 10 seconds. • For ACE module version A4(1.0) and later or ACE appliance version A3(1.x) and later, the default is 1 second. Table 8-16 Echo-UDP Probe Attributes Field Action Send Data ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters. More Settings Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. 8-59 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring FTP Probe Attributes Table 8-18 lists the FTP probe attributes. Note Click More Settings to access the additional attributes for the FTP probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. To configure probe expect statuses for FTP probes, see the “Configuring Health Monitoring Expect Status” section on page 8-74. Table 8-17 Finger Probe Attributes Field Action Send Data ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters. More Settings Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. TCP Connection Termination Check box that when checked, configures the ACE to terminate TCP connections gracefully by sending a FIN to the server. Uncheck the check box to configure the ACE to terminate a TCP connection by sending an RST. Open Timeout (Seconds) Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows: • For ACE module version A2(3.x) and earlier, the default is 10 seconds. • For ACE module version A4(1.0) and later or ACE appliance version A3(1.x) and later, the default is 1 second. Table 8-18 FTP Probe Attributes Field Action More Settings Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. TCP Connection Termination Check box that when checked, configures the ACE to terminate TCP connections gracefully by sending a FIN to the server. Uncheck the check box to configure the ACE to terminate a TCP connection by sending an RST. Open Timeout (Seconds) Number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535. The default is as follows: • For ACE module version A2(3.x) and earlier, the default is 10 seconds. • For ACE module version A4(1.0) and later or ACE appliance version A3(1.x) and later, the default is 1 second. 8-60 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring HTTP Probe Attributes Table 8-19 lists the HTTP probe attributes. Note Click More Settings to access the additional attributes for the HTTP probe type. By default, ANM hides the probe attributes with default values and the probe attributes which are not commonly used. Table 8-19 HTTP Probe Attributes Field Action Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. Request Method Type Type of HTTP request method that is to be used for this probe. Choose one of the following: • N/A—This option is not defined. • Get—The HTTP request method is a GET with a URL of “/”. This request method directs the server to get the page, and the ACE calculates a hash value for the content of the page. If the page content information changes, the hash value no longer matches the original hash value and the ACE assumes the service is down. This is the default request method. • Head—The server is to only get the header for the page. Using this method can prevent the ACE from assuming that the service is down due to changed content and therefore changed hash values. Request HTTP URL Field that appears if you chose Head or Get in the Request Method Type field. Enter the URL path on the remote server. Valid entries are strings of up to 255 characters specifying the URL path. The default path is “/”. More Settings Append Port Host Tag Check box that when checked, configures the ACE to append port information in the HTTP Host header when you configure a nondefault destination port for an HTTP probe. By default, the check box is unchecked and the ACE does not append this information. Note This feature requires ACE module software Version A2(3.4) and ACE appliance software Version A3(2.7) or later releases. TCP Connection Termination Check box that when checked, configures the ACE to terminate TCP connections gracefully by sending a FIN to the server. Uncheck the check box to configure the ACE to terminate a TCP connection by sending an RST. Open Timeout (Seconds) Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows: • For ACE module software Version A2(3.x) and earlier, the default is 10 seconds. • For ACE module software Version A4(1.0) and later or ACE appliance software Version A3(1.x) and later, the default is 1 second. User Name User identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. 8-61 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring To configure probe headers and expect statuses for HTTP probes, see the following topics: • Configuring Headers for HTTP and HTTPS Probes, page 8-74 • Configuring Health Monitoring Expect Status, page 8-74 HTTPS Probe Attributes Table 8-20 lists the HTTPS probe attributes. Note Click More Settings to access the additional attributes for the HTTPS probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. Password Password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. Reenter the password in the Confirm field. Expect Regular Expression Expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters. Expect Regex Offset Number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Valid entries are from 1 to 4000. Hash Check box that when checked, configures the ACE to use an MD5 hash for an HTTP GET probe. Uncheck the check box to configure the ACE not to use an MD5 hash for an HTTP GET probe. Hash String Field that appears if the Hash check box is selected. Enter the 32-bit hash value that the ACE is to compare with the hash that is generated from the HTTP page sent by the server. If you do not provide this value, the ACE generates a value the first time it queries the server, stores this value, and matches this value with other responses from the server. A successful comparison causes the probe to maintain an Alive state. Enter the MD5 hash value as a quoted or unquoted hexadecimal string with 16 characters. Table 8-19 HTTP Probe Attributes (continued) Field Action 8-62 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring Table 8-20 HTTPS Probe Attributes Field Action Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. Request Method Type Type of HTTP request method that is to be used for this probe. Choose one of the following: • N/A—This option is not defined. • Get—The HTTP request method is a GET with a URL of “/”. This request method directs the server to get the page, and the ACE calculates a hash value for the content of the page. If the page content information changes, the hash value no longer matches the original hash value and the ACE assumes the service is down. This is the default request method. • Head—The server is to only get the header for the page. Using this method can prevent the ACE from assuming that the service is down due to changed content and as a result changed hash values. Request HTTP URL Field that appears if you chose Head or Get in the Request Method Type field. Enter the URL path on the remote server. Valid entries are strings of up to 255 characters specifying the URL path. The default path is “/’. Cipher Choose the cipher suite to be used with this HTTPS probe: • RSA_ANY—The HTTPS probe accepts all RSA-configured cipher suites and that no specific suite is configured. This is the default action. • RSA_EXPORT1024_WITH_DES_CBC_SHA • RSA_EXPORT1024_WITH_RC4_56_MD5 • RSA_EXPORT1024_WITH_RC4_56_SHA • RSA_EXPORT_WITH_DES40_CBC_SHA • RSA_EXPORT_WITH_RC4_40_MD5 • RSA_WITH_3DES_EDE_CBC_SHA • RSA_WITH_AES_128_CBC_SHA • RSA_WITH_AES_256_CBC_SHA • RSA_WITH_DES_CBC_SHA • RSA_WITH_RC4_128_MD5 • RSA_WITH_RC4_128_SHA SSL Version Version of SSL or TLS to be used in ClientHello messages sent to the server as follows: • All—The probe is to use all SSL versions. • SSLv3—The probe is to use SSL version 3. • TLSv1—The probe is to use TLS version 1. By default, the probe sends ClientHello messages with an SSL version 3 header and a TLS version 1 message. More Settings 8-63 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring To configure probe headers and expect statuses for HTTPS probes, see the following topics: • Configuring Headers for HTTP and HTTPS Probes, page 8-74 • Configuring Health Monitoring Expect Status, page 8-74 IMAP Probe Attributes Table 8-21 lists the IMAP probe attributes. Append Port Host Tag Check box that when checked, configures the ACE to append port information in the HTTPS Host header when you configure a nondefault destination port for an HTTPS probe. By default, the check box is unchecked and the ACE does not append this information. Note This feature requires ACE module software Version A2(3.4) and ACE appliance software Version A3(2.7) or later releases. TCP Connection Termination Check box that when checked, configures the ACE to terminate TCP connections gracefully by sending a FIN to the server. Uncheck the check box to configure the ACE to terminate a TCP connection by sending an RST. Open Timeout (Seconds) Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows: • For ACE module version A2(3.x) and earlier, the default is 10 seconds. • For ACE module version A4(1.0) and later or ACE appliance version A3(1.x) and later, the default is 1 second. User Name User identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. Password Password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. Reenter the password in the Confirm field. Expect Regular Expression Expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters. Expect Regex Offset Number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are from 1 to 4000. Hash Check box that when checked, configures the ACE to use an MD5 hash for an HTTP GET probe. Uncheck the check box to configure the ACE not to use an MD5 hash for an HTTP GET probe. Hash String Field that appears if the Hash check box is selected. Enter the 32-bit hash value that the ACE is to compare with the hash that is generated from the HTTP page sent by the server. If you do not provide this value, the ACE generates a value the first time it queries the server, stores this value, and matches this value with other responses from the server. A successful comparison causes the probe to maintain an Alive state. Enter the MD5 hash value as a quoted or unquoted hexadecimal string with 16 characters. Table 8-20 HTTPS Probe Attributes (continued) Field Action 8-64 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring Note Click More Settings to access the additional attributes for the IMAP probe type. By default, ANM hides the probe attributes with default values and the probe attributes are not commonly used. POP Probe Attributes Table 8-22 lists the POP probe attributes. Note Click More Settings to access the additional attributes for the POP probe type. By default, ANM hides the probe attributes with default values and the probe attributes which are not commonly used. Table 8-21 IMAP Probe Attributes Field Action User Name User identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. Password Password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. Reenter the password in the Confirm field. Mailbox Name User mailbox name from which to retrieve email for this IMAP probe. Valid entries are unquoted text strings with a maximum of 64 characters. Request Command Request method command for this probe. Valid entries are text strings with a maximum of 32 characters and no spaces. More Settings Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. TCP Connection Termination Check box that when checked, configures the ACE to terminate TCP connections gracefully by sending a FIN to the server. Uncheck the check box to configure the ACE to terminate a TCP connection by sending an RST. Open Timeout (Seconds) Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows: • For ACE module version A2(3.x) and earlier, the default is 10 seconds. • For ACE module version A4(1.0) and later or ACE appliance version A3(1.x) and later, the default is 1 second. Table 8-22 POP Probe Attributes Field Action User Name User identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. Password Password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. Reenter the password in the Confirm field. 8-65 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring RADIUS Probe Attributes Table 8-23 lists the RADIUS probe attributes. Note Click More Settings to access the additional attributes for the RADIUS probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. RTSP Probe Attributes Table 8-24 lists the RTSP probe attributes. Request Command Request method command for this probe. Valid entries are text strings with a maximum of 32 characters and no spaces. More Settings Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. TCP Connection Termination Check box that when checked, configures the ACE to terminate TCP connections gracefully by sending a FIN to the server. Uncheck the check box to configure the ACE to terminate a TCP connection by sending an RST. Open Timeout (seconds) Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows: • For ACE module version A2(3.x) and earlier, the default is 10 seconds. • For ACE module version A4(1.0) and later or ACE appliance version A3(1.x) and later, the default is 1 second. Table 8-22 POP Probe Attributes (continued) Field Action Table 8-23 RADIUS Probe Attributes Field Action User Secret Shared secret to be used to allow probe access to the RADIUS server. Valid entries are case-sensitive strings with no spaces and a maximum of 64 characters. User Name User identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. Password Password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. Reenter the password in the Confirm field. More Settings Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. NAS IP Address IP address of the Network Access Server (NAS) in dotted-decimal format, such as 192.168.11.1. 8-66 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring Note Click More Settings to access the additional attributes for the RTSP probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. To configure probe expect statuses for RTSP probes, see the “Configuring Health Monitoring Expect Status” section on page 8-74. Scripted Probe Attributes Table 8-25 lists the HTTP probe attributes. Note Click More Settings to access the additional attributes for the Scripted probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. Table 8-24 RTSP Probe Attributes Field Action Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. RTSP Require Header Value Require header for the probe. RTSP Proxy Require Header Value Proxy-Require header for the probe. RTSP Request Method Type Request method type: • N/A—No request method is selected. • Describe—Probe is to use the Describe request type. More Settings TCP Connection Termination Check box that when checked, configures the ACE to terminate TCP connections gracefully by sending a FIN to the server. Uncheck the check box to configure the ACE to terminate a TCP connection by sending an RST. Open Timeout (Seconds) Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows: • For ACE module version A2(3.x) and earlier, the default is 10 seconds. • For ACE module version A4(1.0) and later or ACE appliance version A3(1.x) and later, the default is 1 second. 8-67 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring SIP-TCP Probe Attributes Table 8-26 lists the SIP-TCP probe attributes. Note Click More Settings to access the additional attributes for the SIP-TCP probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. Table 8-25 Scripted Probe Attributes Field Action Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. Script Name Local name that you want to assign to this file on the ACE. This file can reside in the disk0: directory or the probe: directory (if the probe: directory exists). Note The script file must first be established on the ACE device and the name must be entered exactly as is appears on the device. See your ACE documentation for more details. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters. Script Arguments Valid arguments, which are unquoted text strings with no spaces; separate multiple arguments with a space. The field limit is 255 characters. More Settings Script Needs To Be Copied From Remote Location? Check box that indicates that the file needs to be copied from a remote server. Uncheck this check box to indicate that the script resides locally. Protocol Field that appears if the script is to be copied from a remote server. Choose the protocol to be used for copying the script: • FTP—The script is to be copied using FTP. • TFTP—The script is to be copied using TFTP. User Name Field that appears if FTP is selected in the Protocol field. Enter the name of the user account on the remote server. Password Field that appears if FTP is selected in the Protocol field. Enter the password for the user account on the remote server. Reenter the password in the Confirm field. Source File Name Field appears if the script is to be copied from a remote server. Enter the host IP address, path, and filename of the file on the remote server in the format host-ip/path/filename where: • host-ip represents the IP address of the remote server. • path represents the directory path of the file on the remote server. • filename represents the filename of the file on the remote server. For example, your entry might be 192.168.11.2/usr/bin/my-script.ext. 8-68 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring To configure probe expect statuses for SIP-TCP probes, see the “Configuring Health Monitoring Expect Status” section on page 8-74. SIP-UDP Probe Attributes Table 8-27 lists the SIP-UDP probe attributes. Note Click More Settings to access the additional attributes for the SIP-UDP probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. Table 8-26 SIP-TCP Probe Attributes Field Action More Settings Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. TCP Connection Termination Check box that when checked, configures the ACE to terminate TCP connections gracefully by sending a FIN to the server. Uncheck the check box to configure the ACE to terminate a TCP connection by sending an RST. Open Timeout (Seconds) Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows • For ACE module version A2(3.x) and earlier, the default is 10 seconds. • For ACE module version A4(1.0) and later or ACE appliance version A3(1.x) and later, the default is 1 second. Expect Regular Expression Expected response data from the probe destination. Valid entries are text strings with a maximum of 255 characters. This field accepts both single and double quotes. Double quotes are considered delimiters so they don't appear on the device. Single quotes will appear on the device. Expect Regex Offset Number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are from 1 to 4000. Table 8-27 SIP-UDP Probe Attributes Field Action More Settings Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. Expect Regular Expression Expected response data from the probe destination. Valid entries are text strings with a maximum of 255 characters. This field accepts both single and double quotes. Double quotes are considered delimiters so they don't appear on the device. Single quotes will appear on the device. Expect Regex Offset Number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are from 1 to 4000. 8-69 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring To configure probe expect statuses for SIP-UDP probes, see the “Configuring Health Monitoring Expect Status” section on page 8-74. SMTP Probe Attributes Table 8-28 lists the SMTP probe attributes. Note Click More Settings to access the additional attributes for the SMTP probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. To configure probe expect statuses for SMTP probes, see the “Configuring Health Monitoring Expect Status” section on page 8-74. SNMP Probe Attributes Table 8-29 lists the SNMP probe attributes. Note Click More Settings to access the additional attributes for the SNMP probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. Table 8-28 SMTP Probe Attributes Field Action More Settings Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. TCP Connection Termination Check box that when checked, configures the ACE to terminate TCP connections gracefully by sending a FIN to the server. Uncheck the check box to configure the ACE to terminate a TCP connection by sending an RST. Open Timeout (Seconds) Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows: • For ACE module version A2(3.x) and earlier, the default is 10 seconds. • For ACE module version A4(1.0) and later or ACE appliance version A3(1.x) and later, the default is 1 second. Table 8-29 SNMP Probe Attributes Field Action SNMP Community SNMP community string. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters. More Settings 8-70 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring To configure the SNMP OID for SNMP probes, see the “Configuring an OID for SNMP Probes” section on page 8-76. TCP Probe Attributes Table 8-30 lists the TCP probe attributes. Note Click More Settings to access the additional attributes for the TCP probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. Telnet Probe Attributes Table 8-31 lists the Telnet probe attributes. Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. SNMP Version SNMP version for the probe: • N/A—No version is selected. • SNMPv1—This probe is to use SNMP version 1. • SNMPv2c—This probe is to use SNMP version 2c. Table 8-29 SNMP Probe Attributes (continued) Field Action Table 8-30 TCP Probe Attributes Field Action Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. Send Data ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters. More Settings TCP Connection Termination Check box that when checked, configures the ACE to terminate TCP connections gracefully by sending a FIN to the server. Uncheck the check box to configure the ACE to terminate a TCP connection by sending an RST. Open Timeout (Seconds) Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows: • For ACE module version A2(3.x) and earlier, the default is 10 seconds. • For ACE module version A4(1.0) and later or ACE appliance version A3(1.x) and later, the default is 1 second. Expect Regular Expression Expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters. Expect Regex Offset Number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are from 1 to 4000. 8-71 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring Note Click More Settings to access the additional attributes for the Telnet probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. UDP Probe Attributes Table 8-32 lists the UDP probe attributes. Note Click More Settings to access the additional attributes for the UDP probe type. By default, ANM hides the probe attributes with default values and the probe attributes that are not commonly used. Table 8-31 Telnet Probe Attributes Field Action More Settings Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. TCP Connection Termination Check box that when checked, configures the ACE to terminate TCP connections gracefully by sending a FIN to the server. Uncheck the check box to configure the ACE to terminate a TCP connection by sending an RST. Open Timeout (Seconds) Enter the number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows: • For ACE module version A2(3.x) and earlier, the default is 10 seconds. • For ACE module version A4(1.0) and later or ACE appliance version A3(1.x) and later, the default is 1 second. Table 8-32 UDP Probe Attributes Field Action Port Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description. Send Data ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters. More Settings Expect Regular Expression Expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters. Expect Regex Offset Number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are from 1 to 4000. 8-72 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring VM Probe Attributes Note You use a VM probe when you configure the ACE for Dynamic Workload Scaling (see the “Configuring Dynamic Workload Scaling” section on page 8-26), which requires that the ACE appliance or module is using software Version A4(2.0) or a later release. You configure the VM probe attributes to control when the ACE bursts traffic to remote VMs based on an average of local VM CPU usage, memory usage, or both. The ACE obtains the usage information by sending the VM probe to the specified VM Controller associated with the local VMs (see Figure 1-1). It calculates the average aggregate load information for all local VMs as a percentage of CPU usage or memory usage and uses either or both percentages to determine when to burst traffic to the remote data center. If the server farm consists of both physical servers and VMs, the ACE considers load information only from the VMs. By default, the VM probe checks the percentage of usage for either the CPU or memory against the maximum threshold value. Whichever percentage reaches its maximum threshold value first causes the ACE to burst traffic to the remote data center. The default maximum burst threshold value of 99 percent instructs the ACE to always load balance traffic to the local VMs unless the load value is equal to 100 percent or the VMs are not in the Operational state. If you configure the maximum burst threshold value to 1 percent, the ACE always bursts traffic to the remote data center. When the usage percentage is less than the minimum threshold value, the ACE stops bursting traffic to the remote data center and continues to load balance traffic to the local VMs. Any active connections to the remote data center are allowed to complete. Table 8-33 lists the VM probe attributes. To associate the VM probe with a server farm, see the “Configuring Server Farms” section on page 8-30. Related Topics • Configuring Dynamic Workload Scaling, page 8-26 • Configuring Server Farms, page 8-30 • Dynamic Workload Scaling Overview, page 8-4 Table 8-33 VM Probe Attributes Field Action Max CPU Burst Threshold Percentage of CPU usage by the local VMs at which the ACE begins to burst traffic to the remote VMs. Enter a value from 1 to 99. The default is 99. Min CPU Burst Threshold Percentage of CPU usage by the local VMs below which the ACE stops bursting traffic to the remote VMs. Enter a value from 1 to 99. The default is 99. Max Memory Burst Threshold Percentage of memory usage by the local VMs at which the ACE begins to burst traffic to the remote VMs. Enter a value from 1 to 99. The default is 99. Min Memory Burst Threshold Percentage of memory usage by the local VMs below which the ACE stops bursting traffic to the remote VMs. Enter a value from 1 to 99. The default is 99. VM Controller Name Identifier of the VM Controller that is associated with the local VMs and that you configured in the “Configuring and Verifying a VM Controller Connection” section on page 8-29. Click the radio button for the VM Controller. 8-73 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring Configuring DNS Probe Expect Addresses You can specify the IP address that the ACE expects to receive in response to a DNS request. When a DNS probe sends a domain name resolve request to the server, it verifies the returned IP address by matching the received IP address with the configured addresses. Assumption A DNS probe has been configured. See the “Configuring Health Monitoring for Real Servers” section on page 8-51 for more information. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Health Monitoring. The Health Monitoring table appears. Step 2 In the Health Monitoring table, choose the DNS probe that you want to configure with an expected IP address. The Expect Addresses table appears. Step 3 In the Expect Addresses table, click Add to add an entry to the Expect Addresses table. The Expect Address configuration pane appears. Note You cannot modify an entry in the Expect Addresses table. Instead, delete the existing entry, then add a new one. Step 4 In the IPv4/IPv6 Address field, enter the IP address that the ACE appliance is to expect as a server response to a DNS request. You can enter multiple addresses in this field. However, you cannot mix IPv4 and IPv6 addresses. Note IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Step 5 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entry and to return to the Expect Addresses table. • Click Next to deploy your entry and to add another IP Address to the Expect Addresses table. Related Topics • Configuring Health Monitoring for Real Servers, page 8-51 • DNS Probe Attributes, page 8-57 • Displaying Health Monitoring Statistics and Status Information, page 8-77 8-74 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring Configuring Headers for HTTP and HTTPS Probes You can specify header fields for HTTP and HTTPS probes. Assumption An HTTP or HTTPS probe has been configured. See the “Configuring Health Monitoring for Real Servers” section on page 8-51 for more information. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Health Monitoring. The Health Monitoring table appears. Step 2 In the Health Monitoring table, choose the HTTP or HTTPS probe that you want to configure with a header. The Probe Headers table appears. Step 3 In the Probe Headers table, click Add to add an entry, or choose an existing entry and click Edit to modify it. The Probe Headers configuration pane appears. Step 4 In the Header Name field of the Probe Headers configuration pane, choose the HTTP header the probe is to use. Step 5 In the Header Value field, enter the string to assign to the header field. Valid entries are text strings with a maximum of 255 characters. If the string includes spaces, enclose the string with quotes. Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entry and to return to the Probe Headers table. • Click Next to deploy your entry and to add another header entry to the Probe Headers table. Related Topics • Configuring Health Monitoring for Real Servers, page 8-51 • HTTP Probe Attributes, page 8-60 • HTTPS Probe Attributes, page 8-61 • Displaying Health Monitoring Statistics and Status Information, page 8-77 Configuring Health Monitoring Expect Status You can configure a single or range of code responses that the ACE expects from the probe destination. When the ACE receives a response from the server, it expects a status code to mark a server as passed. By default, there are no status codes configured on the ACE. If you do not configure a status code, any response code from the server is marked as failed. 8-75 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring Expect status codes can be configured for FTP, HTTP, HTTPS, RTSP, SIP-TCP, SIP-UDP, and SMTP probes. Assumption An FTP, HTTP, HTTPS, RTSP, SIP-TCP, SIP-UDP or SMTP probe has been configured. See the “Configuring Health Monitoring for Real Servers” section on page 8-51 for more information. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Health Monitoring. The Health Monitoring table appears. Step 2 In the Health Monitoring table, choose the probe that you want to configure for expect status codes, and click the Expect Status tab. The Expect Status table appears. Step 3 In the Expect Status table, click Add to add an entry, or select an existing entry and click Edit to modify it. The Expect Status configuration pane appears. Step 4 In the Expect Status configuration pane, configure a single expect status code as follows: a. In the Min. Expect Status Code field, enter the expect status code for this probe. Valid entries are from 0 to 999. b. In the Max. Expect Status code, enter the same expect status code that you entered in the Min Expect Status Code field. Step 5 In the Expect Status configuration pane, configure a range of expect status codes as follows: a. In the Min. Expect Status Code, enter the lower limit of the range of status codes. Valid entries are from 0 to 999. b. In the Max. Expect Status Code, enter the upper limit of a range of status codes. Valid entries are from 0 to 999. The value in this field must be greater than or equal to the value in the Min Expect Status Code field. Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Expect Status table. • Click Next to deploy your entries and to add another expect status code to the Expect Status table. Related Topics • Configuring Health Monitoring for Real Servers, page 8-51 • FTP Probe Attributes, page 8-59 • HTTP Probe Attributes, page 8-60 • SMTP Probe Attributes, page 8-69 • Displaying Health Monitoring Statistics and Status Information, page 8-77 8-76 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Health Monitoring Configuring an OID for SNMP Probes You can configure OID queries to probe the server. When the ACE sends a probe with an SNMP OID query, the ACE uses the retrieved value as input to the least-loaded algorithm for load-balancing decisions. Least-loaded load balancing bases the server selection on the server with the lowest load value. If the retrieved value is within the configured threshold, the server is marked as passed. If the threshold is exceeded, the server is marked as failed. The ACE allows a maximum of eight OID queries to probe the server. Assumption An SNMP probe has been configured. See the “Configuring Health Monitoring for Real Servers” section on page 8-51 for more information. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Health Monitoring. The Health Monitoring table appears. Step 2 In the Health Monitoring table, choose the SNMP probe for which you want to specify an OID. The SNMP OID for Server Load Query table appears. Step 3 In the SNMP OID for Server Load Query table, click Add to add an entry, or choose an existing entry and click Edit to modify it. The SNMP OID configuration pane appears. Step 4 In the SNMP OID field of the SNMP OID configuration pane, enter the OID that the probe is to use to query the server for a value. Valid entries are unquoted strings with a maximum of 255 alphanumeric characters in dotted-decimal notation, such as .1.3.6.1.4.2021.10.1.3.1. The OID string is based on the server type. Step 5 In the Max. Absolute Server Load Value field, enter the OID value in the form of an integer and to indicate that the retrieved OID value is an absolute value instead of a percent. Valid entries are from 1 to 4294967295. When the ACE sends a probe with an SNMP OID query, the ACE uses the retrieved value as input to the least-loaded algorithm for load-balancing decisions. By default, the ACE assumes that the retrieved OID value is a percentile value. Use this option to specify that the retrieved OID value is an absolute value. Step 6 In the Server Load Threshold Value field, specify the threshold at which the server is to be taken out of service as follows: • When the OID value is based on a percent, valid entries are integers from 1 to 100. • When the OID is based on an absolute value, valid entries are from 1 to the value specified in the Maximum Absolute Server Load Value field. Step 7 In the Server Load Weighting field, enter the weight to assign to this OID for the SNMP probe. Valid entries are from 0 to 16000. Step 8 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the SNMP OID table. 8-77 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Secure KAL-AP • Click Next to deploy your entries and to add another item to the SNMP OID table. Related Topics • Configuring Health Monitoring for Real Servers, page 8-51 • SNMP Probe Attributes, page 8-69 • Displaying Health Monitoring Statistics and Status Information, page 8-77 Displaying Health Monitoring Statistics and Status Information You can display statistics and status information for a particular probe. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Health Monitoring. The Health Monitoring table appears. Step 2 In the Health Monitoring table, choose a probe from the Health Monitoring table, and click Details. The show probe name detail CLI command output appears. For details on the displayed output fields, see the Cisco ACE Module Server Load-Balancing Configuration Guide or the Cisco ACE 4700 Series Appliance Server Load-Balancing Configuration Guide, Chapter 4, Configuring Health Monitoring. Note For a DNS probe, the detailed probe results always identify a default DNS domain of www.Cisco.com. Step 3 Click Update Details to refresh the output for the show probe name detail CLI command. Step 4 Click Close to return to the Health Monitoring table. Related Topics • Configuring Health Monitoring for Real Servers, page 8-51 Configuring Secure KAL-AP You can configure a secure keepalive-appliance protocol (KAL-AP) associated with a virtual context. A KAL-AP on the ACE enables communication between the ACE and a Global Site Selector (GSS), which sends KAL-AP requests to report the server states and loads for global-server load-balancing (GSLB) decisions. The ACE uses KAL-AP through a UDP connection to calculate weights and provide information for server availability to the KAL-AP device. The ACE acts as a server and listens for KAL-AP requests. When KAL-AP is initialized on the ACE, the ACE listens on the standard 5002 port for any KAL-AP requests. You cannot configure any other port. The ACE supports secure KAL-AP for MD5 encryption of data between it and the GSS. For encryption, you must configure a shared secret as a key for authentication between the GSS and the ACE context. 8-78 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 8 Configuring Real Servers and Server Farms Configuring Secure KAL-AP Assumptions This topic assumes the following: • You have created a virtual context that specifies the Keepalive Appliance Protocol over UDP. • You have enabled KAL-AP on the ACE by configuring a management class map and policy map, and apply it to the appropriate interface. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Secure KAL-AP. The Secure KAL-AP table appears. Step 2 In the Secure KAL-AP table, click Add to configure secure KAL-AP for MD5 encryption of data. The Secure KAL-AP configuration window appears. Step 3 In the IP Address field of the Secure KAL-AP configuration window, enable secure KAL-AP by configuring the VIP address for the GSS. Enter the IP address in dotted-decimal notation (for example, 192.168.11.1). Step 4 In the Hash Key field, enter the MD5 encryption method shared secret between the KAL-AP device and the ACE. Enter the shared secret as a case-sensitive string with no spaces and a maximum of 31 alphanumeric characters. The ACE supports the following special characters in a shared secret: , . / = + - ^ @ ! % ~ # $ * ( ) Step 5 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The ACE validates the secure KAL-AP configuration and deploys it. • Click Cancel to exit this procedure without accepting your entries and to return to the Secure KAL-AP table. • Click Next to accept your entries. Related Topics • Creating Virtual Contexts, page 6-2 • Setting Match Conditions for Layer 3/Layer 4 Management Traffic Class Maps, page 14-12 CHAPTER 9-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 9 Configuring Stickiness Date: 3/28/12 This chapter describes how to configure stickiness on the Cisco Application Control Engine (ACE) using Cisco Application Networking Manager (ANM). Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • Information About Stickiness, page 9-1 • Sticky Types, page 9-2 • Sticky Groups, page 9-6 • Sticky Table, page 9-6 • Configuring Sticky Groups, page 9-7 Information About Stickiness When customers visit an e-commerce site, they usually start out browsing the site. The site may require that the client become “stuck” to one server once the connection is established, or once client starts to build a shopping cart. In either case, once the client adds items to the shopping cart, it is important that all of the client requests get directed to the same server so that all the items are contained in one shopping cart on one server. An instance of a customer’s shopping cart is typically local to a particular web server and is not duplicated across multiple servers. E-commerce applications are not the only types of applications that require stickiness. Any web application that maintains client information may require stickiness, such as banking applications or online trading. Other uses include FTP and HTTP file transfers. 9-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Sticky Types Stickiness allows the same client to maintain multiple simultaneous or subsequent TCP or IP connections with the same real server for the duration of a session. A session is series of transactions between a client and a server over some finite period of time (from several minutes to several hours). This feature is particularly useful for e-commerce applications where a client needs to maintain multiple connections with the same server while shopping online, especially while building a shopping cart and during the checkout process. Depending on the configured SLB policy, the ACE sticks a client to an appropriate server after the ACE has determined which load-balancing method to use. If the ACE determines that a client is already stuck to a particular server, then the ACE sends that client request to that server, regardless of the load-balancing criteria specified by the matched policy. If the ACE determines that the client is not stuck to a particular server, it applies the normal load-balancing rules to the content request. For information about stickiness, see the following topics: • Sticky Types, page 9-2 • Sticky Groups, page 9-6 • Sticky Table, page 9-6 Related Topics • Configuring Virtual Server Default Layer 7 Load Balancing, page 7-50 • Configuring Sticky Groups, page 9-7 Sticky Types All ACE devices support stickiness based on the following: • HTTP cookies • HTTP headers • IP addresses • HTTP content • Layer 4 payloads • RADIUS attributes • RTSP headers • SIP headers This section includes the following topics: • HTTP Content Stickiness, page 9-3 • HTTP Cookie Stickiness, page 9-3 • HTTP Header Stickiness, page 9-4 • IP Netmask and IPv6 Prefix Stickiness, page 9-4 • Layer 4 Payload Stickiness, page 9-4 • RADIUS Stickiness, page 9-5 • RTSP Header Stickiness, page 9-5 • SIP Header Stickiness, page 9-5 9-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Sticky Types HTTP Content Stickiness HTTP content stickiness allows you to stick a client to a server based on the content of an HTTP packet. You can specify a beginning pattern and ending pattern, the number of bytes to parse, and an offset that specifies how many bytes to ignore from the beginning of the data. Related Topics • Configuring Stickiness, page 9-1 • Sticky Types, page 9-2 • Sticky Groups, page 9-6 • Sticky Table, page 9-6 HTTP Cookie Stickiness Client cookies uniquely identify clients to the ACE and the servers that provide content. A cookie is a small data structure within the HTTP header that is used by a server to deliver data to a web client and request that the client store the information. In certain applications, the client returns the information to the server to maintain the connection state or persistence between the client and the server. When the ACE examines a request for content and determines through policy matching that the content is sticky, it examines any cookie or URL present in the content request. The ACE uses the information in the cookie or URL to direct the content request to the appropriate server. The ACE supports the following types of cookie stickiness: • Dynamic cookie learning You can configure the ACE to look for a specific cookie name and automatically learn its value either from the client request HTTP header or from the server Set-Cookie message in the server response. Dynamic cookie learning is useful when dealing with applications that store more than just the session ID or user ID within the same cookie. Only very specific bytes of the cookie value are relevant to stickiness. By default, the ACE learns the entire cookie value. You can optionally specify an offset and length to instruct the ACE to learn only a portion of the cookie value. Alternatively, you can specify a secondary cookie value that appears in the URL string in the HTTP request. This option instructs the ACE to search for (and eventually learn or stick to) the cookie information as part of the URL. URL learning is useful with applications that insert cookie information as part of the HTTP URL. In some cases, you can use this feature to work around clients that reject cookies. • Cookie insert The ACE inserts the cookie on behalf of the server upon the return request, so that the ACE can perform cookie stickiness even when the servers are not configured to set cookies. The cookie contains information that the ACE uses to ensure persistence to a specific real server. Related Topics • Configuring Stickiness, page 9-1 • Sticky Types, page 9-2 • Sticky Groups, page 9-6 • Sticky Table, page 9-6 9-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Sticky Types HTTP Header Stickiness You can use HTTP-header information to provide stickiness. With HTTP header stickiness, you can specify a header offset to provide stickiness based on a unique portion of the HTTP header. Related Topics • Configuring Stickiness, page 9-1 • Sticky Types, page 9-2 • Sticky Groups, page 9-6 • Sticky Table, page 9-6 IP Netmask and IPv6 Prefix Stickiness You can use the source IP address, the destination IP address, or both to uniquely identify individual clients and their requests for stickiness purposes based on their IP netmask or IPv6 prefix. However, if an enterprise or a service provider uses a megaproxy to establish client connections to the Internet, the source IP address no longer is a reliable indicator of the true source of the request. In this case, you can use cookies or one of the other sticky methods to ensure session persistence. Note IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Related Topics • Configuring Stickiness, page 9-1 • Sticky Types, page 9-2 • Sticky Groups, page 9-6 • Sticky Table, page 9-6 Layer 4 Payload Stickiness Layer 4 payload stickiness allows you to stick a client to a server based on the data in Layer 4 frames. You can specify a beginning pattern and ending pattern, the number of bytes to parse, and an offset that specifies how many bytes to ignore from the beginning of the data. Related Topics • Configuring Stickiness, page 9-1 • Sticky Types, page 9-2 • Sticky Groups, page 9-6 • Sticky Table, page 9-6 9-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Sticky Types RADIUS Stickiness RADIUS stickiness can be based on the following RADIUS attributes: • Calling Station ID • Username Related Topics • Configuring Stickiness, page 9-1 • Sticky Types, page 9-2 • Sticky Groups, page 9-6 • Sticky Table, page 9-6 RTSP Header Stickiness Real time streaming protocol (RTSP) stickiness is based on information in the RTSP session header. With RTSP header stickiness, you can specify a header offset to provide stickiness based on a unique portion of the RTSP header. Related Topics • Configuring Stickiness, page 9-1 • Sticky Types, page 9-2 • Sticky Groups, page 9-6 • Sticky Table, page 9-6 SIP Header Stickiness Session initiation protocol (SIP) header stickiness is based on the SIP Call-ID header field. SIP header stickiness requires the entire SIP header, so you cannot specify an offset. Related Topics • Configuring Stickiness, page 9-1 • Sticky Types, page 9-2 • Sticky Groups, page 9-6 • Sticky Table, page 9-6 9-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Sticky Groups Sticky Groups The ACE uses the concept of sticky groups to configure stickiness. A sticky group allows you to specify sticky attributes. After you configure a sticky group and its attributes, you associate the sticky group with a Layer 7 policy-map action in a Layer 7 server load balancing (SLB) policy map.You can create a maximum of 4096 sticky groups in each context. Each sticky group that you configure on the ACE contains a series of parameters that determine the following: • Sticky method • Timeout • Replication • Sticky method-specific attributes Note The context in which you configure a sticky group must be associated with a resource class that allocates a portion of ACE resources to stickiness. See the “Using Resource Classes” section on page 6-43 for information about configuring ACE resources. Related Topics • Configuring Stickiness, page 9-1 • Sticky Types, page 9-2 • Sticky Table, page 9-6 Sticky Table The ACE uses a sticky table to keep track of sticky connections. Table entries are as follows: • Sticky groups • Sticky methods • Sticky connections • Real servers The sticky table can hold a maximum of four million entries (four million simultaneous users). When the table reaches the maximum number of entries, additional sticky connections cause the table to wrap and the first users become unstuck from their respective servers. The ACE uses a configurable timeout mechanism to age out sticky table entries. When an entry times out, it becomes eligible for reuse. High connection rates may cause the premature aging out of sticky entries. In this case, the ACE reuses the entries that are closest to expiration first. Sticky entries can be either dynamic (generated by the ACE on demand) or static (user-configured). When you create a static sticky entry, the ACE places the entry in the sticky table immediately. Static entries remain in the sticky database until you remove them from the configuration. You can create a maximum of 4096 static sticky entries in each context. If the ACE takes a real server out of service for whatever reason (probe failure, no inservice command, or ARP timeout), the ACE removes from the database any sticky entries that are related to that server. 9-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Configuring Sticky Groups Related Topics • Configuring Stickiness, page 9-1 • Sticky Types, page 9-2 • Sticky Groups, page 9-6 Configuring Sticky Groups You can configure sticky groups. Stickiness (or session persistence) is a feature that allows the same client to maintain multiple simultaneous or subsequent TCP connections with the same real server for the duration of a session. A session is a series of transactions between a client and a server over some finite period of time (from several minutes to several hours). This feature is particularly useful for e-commerce applications where a client needs to maintain multiple TCP connections with the same server while shopping online, especially while building a shopping cart and during the checkout process. E-commerce applications are not the only types of applications that require stickiness. Any web application that maintains client information may require stickiness, such as banking applications or online trading. Other uses include FTP and HTTP file transfers. The ACE uses the concept of sticky groups to configure stickiness. A sticky group allows you to specify sticky attributes. After you configure a sticky group and its attributes, you associate the sticky group with a Layer 7 policy-map action in a Layer 7 SLB policy map. Note (Pre ACE version A4(1.0) module or appliance only) The context in which you configure a sticky group must be associated with a resource class that allocates a portion of ACE resources to stickiness. See the “Using Resource Classes” section on page 6-43 for information about configuring ACE resources. Assumption (Pre ACE version A4(1.0) module or appliance only) The context in which you are configuring a sticky group is associated with a resource class that allocates resources to stickiness. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Stickiness. The Sticky Groups table appears. Step 2 In the Sticky Groups table, click Add to add a new sticky group, or choose an existing sticky group that you want to modify and click Edit. Step 3 Configure the sticky group using the information in Table 9-1. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. 9-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Configuring Sticky Groups Table 9-1 Sticky Group Attributes Field Description Group Name Sticky group identifier. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Type Method to be used when establishing sticky connections and to configure any type-specific attributes. The choices are as follows: • HTTP Content—The ACE sticks client connections to the same real server based on a string in the data portion of the HTTP packet. See Table 9-2 for additional configuration options. • HTTP Cookie—The ACE either learns a cookie from the HTTP header of a client request or inserts a cookie in the Set-Cookie header of the response from the server to the client and then uses the learned cookie to provide stickiness between the client and server for the duration of the transaction. See Table 9-3 for additional configuration options. • HTTP Header—The ACE sticks client connections to the same real server based on HTTP headers. See Table 9-4 for additional configuration options. • IP Netmask—The ACE sticks a client to the same server for multiple subsequent connections as needed to complete a transaction using the client source IPv4 IP address, the destination IPv4 IP address, or both. You can optionally configure an IPv6 prefix length with this sticky type. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. See Table 9-5 for additional configuration options. Note If an organization uses a megaproxy to load balance client requests across multiple proxy servers when a client connects to the Internet, the source IP address is no longer a reliable indicator of the true source of the request. In this situation, you can use cookies or another sticky method to ensure session persistence. • V6 Prefix—(Option that appears only for ACE module and ACE appliance software Version A5(1.0) or later.) The ACE appliance sticks a client to the same server for multiple subsequent connections as needed to complete a transaction using the client source IP address, the destination IP address, or both based on their IPv6 prefix. You can optionally configure an IPv4 netmask with this sticky type. See Table 9-6 for additional configuration options. • Layer 4 Payload—The ACE sticks client connections to the same real server based on a string in the payload portion of the Layer 4 protocol packet. See Table 9-7 for additional configuration options. • RADIUS—The ACE sticks client connections to the same real server based on a RADIUS attribute. See Table 9-8 for additional configuration options. • RTSP Header—The ACE sticks client connections to the same real server based on the RTSP Session header field. See Table 9-9 for additional configuration options. • SIP Header—The ACE sticks client connections to the same real server based on the SIP Call-ID header field. Cookie Name This option appears for sticky type HTTP Cookie. Enter a unique identifier for the cookie. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. 9-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Configuring Sticky Groups Enable Insert This option appears only for sticky type HTTP Cookie. Check this check box if the ACE appliance is to insert a cookie in the Set-Cookie header of the response from the server to the client. This option is useful when you want to use a session cookie for persistence but the server is not currently setting the appropriate cookie. When selected, the ACE appliance selects a cookie value that identifies the original server from which the client received a response. For subsequent connections of the same transaction, the client uses the cookie to stick to the same server. Clear this check box to disable cookie insertion. Browser Expire This option appears for sticky type HTTP Cookie and you select Enable Insert. Check this check box to allow the client's browser to expire a cookie when the session ends. Clear this check box to disable browser expire. Offset (Bytes) This option appears for sticky types HTTP Cookie and HTTP Header. Enter the number of bytes the ACE appliance is to ignore starting with the first byte of the cookie. Valid entries are integers from 0 to 999. The default is 0 (zero), which indicates that the ACE appliance does not exclude any portion of the cookie. Length (Bytes) This option appears for sticky types HTTP Cookie and HTTP Header. Enter the length of the portion of the cookie (starting with the byte after the offset value) that the ACE appliance is to use for sticking the client to the server. Valid entries are integers from 1 to 1000. Secondary Name This option appears only for sticky type HTTP Cookie. Enter an alternate cookie name that is to appear in the URL string of the Web page on the server. The ACE appliance uses this cookie to maintain a sticky connection between a client and a server and adds a secondary entry in the sticky table. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. Header Name This option appears for sticky type HTTP Header. Select the HTTP header to use for sticking client connections. Netmask This option appears only for sticky type IP Netmask. Select the netmask to apply to the source IP address, the destination IP address, or both. IPv4 Netmask This option appears only for sticky type IP Netmask or IPv6 Prefix (IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later). This option is mandatory for the sticky type IP Netmask and optional for the sticky type IPv6 Prefix. Select the netmask to apply to the source IP address, the destination IP address, or both. IPv6 Prefix Length This option appears only for ACE module and ACE appliance software Version A5(1.0) or later and for sticky type IPv6 Prefix or IP Netmask. This option is mandatory for the sticky type IPv Prefix and optional for the sticky type IP Netmask. Enter the IPv6 prefix length to apply to the source IP address, the destination IP address, or both. Table 9-1 Sticky Group Attributes (continued) Field Description 9-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Configuring Sticky Groups Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. To configure sticky statics, see the “Configuring Sticky Statics” section on page 9-15. • Click Cancel to exit the procedure without saving your entries and to return to the Sticky Groups table. • Click Next to deploy your entries and to configure another sticky group. Related Topics • Configuring Sticky Statics, page 9-15 Address Type This option appears only for sticky type IP Netmask or IPv6 Prefix (IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later). Indicate whether this sticky type is to be applied to the client source IP address, the destination IP address, or both: • Both—Indicates that this sticky type is to be applied to both the source IP address and the destination IP address. • Destination—Indicates that this sticky type is to be applied to the destination IP address only. Source—Indicates that this sticky type is to be applied to the source IP address only. Sticky Server Farm Server farm that you want to associate with this sticky group. Backup Server Farm Backup server farm that is associated with this sticky group. If the primary server farm is down, the ACE uses the backup server farm. Aggregate State Field that appears when a server farm and backup server farm are selected. Check box that indicates that the state of the backup server farm is tied to the virtual server state. Uncheck this check box if the backup server farm is not tied to the virtual server state. Sticky Enabled On Backup Server Farm Field that appears when a server farm and backup server farm are selected. Check box that indicates that the backup server farm is sticky. Uncheck this check box if the backup server farm is not sticky. Replicate On HA Peer Check box that indicates that the ACE to replicate sticky table entries on the standby ACE. If a failover occurs and this option is selected, the new active ACE can maintain the existing sticky connections. Uncheck this check box to indicate that the ACE is not to replicate sticky table entries on the standby ACE. Timeout (Minutes) Number of minutes that the ACE keeps the sticky information for a client connection in the sticky table after the latest client connection terminates. Valid entries are from 1 to 65535; the default is 1440 minutes (24 hours). Timeout Active Connections Check box that specifies that the ACE is to time out sticky table entries even if active connections exist after the sticky timer expires. Uncheck this check box to specify that the ACE is not to time out sticky table entries even if active connections exist after the sticky timer expires. This behavior is the default. Table 9-1 Sticky Group Attributes (continued) Field Description 9-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Configuring Sticky Groups • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Real Servers, page 8-5 • Configuring Server Farms, page 8-30 Sticky Group Attribute Tables This section describes the different sticky group type-specific attributes. Note There are no specific sticky group type-specific attributes for SIP Header. This section includes the following topics: • HTTP Content Sticky Group Attributes, page 9-11 • HTTP Cookie Sticky Group Attributes, page 9-12 • HTTP Header Sticky Group Attributes, page 9-13 • IP Netmask Sticky Group Attributes, page 9-13 • V6 Prefix Sticky Group Attributes, page 9-13 • Layer 4 Payload Sticky Group Attributes, page 9-14 • RADIUS Sticky Group Attributes, page 9-14 • RTSP Header Sticky Group Attributes, page 9-15 HTTP Content Sticky Group Attributes Table 9-2 describes the HTTP content sticky group attributes. Table 9-2 HTTP Content Sticky Group Attributes Field Description HTTP Content Check box that instructs the ACE to use the constant portion of HTTP content to make persistent connections to a specific server. Uncheck the check box to identify specific content for stickiness in the Offset, Length, Begin Pattern, and End Pattern fields. HTTP content may change over time with only a portion remaining constant throughout a transaction between the client and a server. Offset Number of bytes that the virtual server is to ignore starting with the first byte of the cookie. Valid entries are from 0 to 999. The default is 0 (zero), which indicates that the virtual server does not exclude any portion of the cookie. Length (Bytes) Length of the portion of the cookie (starting with the byte after the offset value) that the ACE is to use for sticking the client to the server. Valid entries are from 1 to 1000. 9-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Configuring Sticky Groups HTTP Cookie Sticky Group Attributes Table 9-3 describes the HTTP cookie sticky group attributes. Begin Pattern Beginning pattern of the HTTP content payload and the pattern string to match before hashing. If you do not specify a beginning pattern, the ACE begins parsing immediately after the offset byte. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. You can enter a text string with spaces if you enclose the entire string in quotation marks ("). The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. End Pattern Pattern that marks the end of hashing. If you do not specify an end pattern or a length, the ACE continues to parse the data until it reaches the end of the field or packet, or until it reaches the maximum body parse length. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. You can enter a text string with spaces if you enclose the entire string in quotation marks ("). The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. Table 9-2 HTTP Content Sticky Group Attributes (continued) Field Description Table 9-3 HTTP Cookie Sticky Group Attributes Field Description Cookie Name Unique identifier for the cookie. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Enable Insert Check box that determines if the virtual server is to insert a cookie in the Set-Cookie header of the response from the server to the client. This option is useful when you want to use a session cookie for persistence but the server is not currently setting the appropriate cookie. When selected, the virtual server selects a cookie value that identifies the original server from which the client received a response. For subsequent connections of the same transaction, the client uses the cookie to stick to the same server. Uncheck the check box to disable cookie insertion. Offset Number of bytes that the virtual server is to ignore starting with the first byte of the cookie. Valid entries are from 0 to 999. The default is 0 (zero), which indicates that the virtual server does not exclude any portion of the cookie. Length (Bytes) Length of the portion of the cookie (starting with the byte after the offset value) that the ACE is to use for sticking the client to the server. Valid entries are from 1 to 1000. Secondary Name Alternate cookie name that is to appear in the URL string of the web page on the server. The virtual server uses this cookie to maintain a sticky connection between a client and a server and adds a secondary entry in the sticky table. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. 9-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Configuring Sticky Groups HTTP Header Sticky Group Attributes Table 9-4 describes the HTTP header sticky group attributes. IP Netmask Sticky Group Attributes Table 9-5 describes the IP netmask sticky group attributes. V6 Prefix Sticky Group Attributes Table 9-5 describes the V6 prefix sticky group attributes, which requires ACE module and ACE appliance software Version A5(1.0) or later. Table 9-4 HTTP Header Sticky Group Attributes Field Description Header Name HTTP header to use for sticking client connections. Offset Number of bytes the virtual server is to ignore starting with the first byte of the cookie. Valid entries are from 0 to 999. The default is 0 (zero), which indicates that the virtual server does not exclude any portion of the cookie. Length (Bytes) Length of the portion of the cookie (starting with the byte after the offset value) that the ACE is to use for sticking the client to the server. Valid entries are from 1 to 1000. Table 9-5 IP Netmask Sticky Group Attributes Field Description Netmask Netmask to apply to the source IP address, destination IP address, or both. IPv6 Prefix Length (Optional field that requires ACE module and ACE appliance software Version A5(1.0) or later) IPv6 prefix length to apply to the source IP address, destination IP address, or both. Address Type Address type that the sticky type is to be applied to as follows: • Both—Sticky type is applied to both the source IP address and the destination IP address. • Destination—Sticky type is applied to the destination IP address only. • Source—Sticky type applied to the source IP address only. Table 9-6 IV6 Prefix Sticky Group Attributes Field Description Prefix Length (Field that requires ACE module and ACE appliance software Version A5(1.0) or later) IPv6 prefix length to apply to the source IP address, destination IP address, or both. IPv4 Netmask (Optional) Netmask to apply to the source IP address, destination IP address, or both. Address Type Address type that the sticky type is to be applied to as follows: • Both—Sticky type is applied to both the source IP address and the destination IP address. • Destination—Sticky type is applied to the destination IP address only. • Source—Sticky type applied to the source IP address only. 9-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Configuring Sticky Groups Layer 4 Payload Sticky Group Attributes Table 9-7 describes the Layer 4 payload sticky group attributes. RADIUS Sticky Group Attributes Table 9-8 describes the RADIUS sticky group attributes. Table 9-7 Layer 4 Payload Sticky Group Attributes Field Description Offset Number of bytes the virtual server is to ignore starting with the first byte of the cookie. Valid entries are from 0 to 999. The default is 0 (zero), which indicates that the virtual server does not exclude any portion of the cookie. Length (Bytes) Length of the portion of the cookie (starting with the byte after the offset value) that the ACE is to use for sticking the client to the server. Valid entries are from 1 to 1000. The default is 1000. Begin Pattern Beginning pattern of the Layer 4 payload and the pattern string to match before hashing. If you do not specify a beginning pattern, the ACE begins parsing immediately after the offset byte. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. You can enter a text string with spaces provided that you enclose the entire string in quotation marks ("). The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. End Pattern Pattern that marks the end of hashing. If you do not specify an end pattern or a length, the ACE continues to parse the data until it reaches the end of the field or packet, or until it reaches the maximum body parse length. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. You can enter a text string with spaces provided that you enclose the entire string in quotation marks ("). The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. Enable Sticky For Response Check box that enables the ACE to parse server responses and perform sticky learning. The ACE uses a hash of the server response bytes to populate the sticky database. The next time that the ACE receives a client request with those same bytes, it sticks the client to the same server. Uncheck the check box to reset the behavior of the ACE to the default of not parsing server responses and performing sticky learning. Table 9-8 RADIUS Sticky Group Attributes Field Description RADIUS Types Choose the RADIUS attribute to use for sticking client connections: • N/A—This option is not configured. • RADIUS Calling ID—Stickiness is based on the RADIUS framed IP attribute and the calling station ID attribute. • RADIUS User Name—Stickiness is based on the RADIUS framed IP attribute and the username attribute. 9-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Displaying All Sticky Groups by Context RTSP Header Sticky Group Attributes Table 9-9 describes the RTSP header sticky group attributes. Displaying All Sticky Groups by Context You can display all sticky groups associated with a virtual context. Procedure Step 1 Choose Config > Devices. The Virtual Contexts table appears. Step 2 In the Virtual Contexts table, choose the virtual context with the sticky groups that you want to display, and choose Load Balancing > Stickiness. The Sticky Groups table appears, listing the sticky groups associated with the selected context. Related Topics • Configuring Sticky Groups, page 9-7 • Configuring Sticky Statics, page 9-15 Configuring Sticky Statics You can configure sticky statics. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Assumption A sticky group has been configured. See the “Configuring Sticky Groups” section on page 9-7 for more information. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Stickiness. Table 9-9 RTSP Header Sticky Group Attributes Field Description Offset Number of bytes that the virtual server is to ignore starting with the first byte of the cookie. Valid entries are from 0 to 999. The default is 0 (zero), which indicates that the virtual server does not exclude any portion of the cookie. Length (Bytes) Length of the portion of the cookie (starting with the byte after the offset value) that the ACE is to use for sticking the client to the server. Valid entries are from 1 to 1000. The default is 1000. 9-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Configuring Sticky Statics The Sticky Groups table and Sticky Statics tab appears. If you do not see the Sticky Statics tab beneath the Sticky Groups table, click the Switch between Configure and Browse Modes button. Step 2 From the Sticky Groups table, choose the sticky group that you want to configure for sticky statics Step 3 From the Sticky Statics tab, click Add to add a new entry to the table, or select an existing entry, then click Edit to modify it. The Sticky Statics configuration screen appears. Step 4 In the Sequence Number field, either accept the automatically incremented number for this entry or enter a new sequence number.The sequence number indicates the order in which multiple sticky static configurations are applied. The sequence number indicates the order in which multiple sticky static configurations are applied. Step 5 From the Type drop-down list, choose the sticky group type. The choices are as follows: • HTTP Content—The ACE sticks client connections to the same real server based on a string in the data portion of the HTTP packet. • HTTP Cookie—The ACE either learns a cookie from the HTTP header of a client request or inserts a cookie in the Set-Cookie header of the response from the server to the client, and then uses the learned cookie to provide stickiness between the client and server for the duration of the transaction. • HTTP Header—The ACE sticks client connections to the same real server based on HTTP headers. • IP Netmask—The ACE sticks a client to the same server for multiple subsequent connections as needed to complete a transaction using the client source IP address, the destination IP address, or both based on the IPv4 netmask. You can optionally configure an IPv6 prefix length with this sticky type. Note If an organization uses a megaproxy to load balance client requests across multiple proxy servers when a client connects to the Internet, the source IP address is no longer a reliable indicator of the true source of the request. In this situation, you can use cookies or another sticky method to ensure session persistence. • V6 Prefix—(Option that appears only for ACE module and ACE appliance software Version A5(1.0) or later) The ACE sticks a client to the same server for multiple subsequent connections as needed to complete a transaction using the client source IP address, the destination IP address, or both based on the IPv6 prefix length. You can optionally configure an IPv4 netmask with this sticky type. • Layer 4 Payload—The ACE sticks client connections to the same real server based on a string in the payload portion of the Layer 4 protocol packet. • RADIUS—The ACE sticks client connections to the same real server based on a RADIUS attribute. • RTSP Header—The ACE sticks client connections to the same real server based on the RTSP Session header field. • SIP Header—The ACE sticks client connections to the same real server based on the SIP Call-ID header field. Step 6 If you chose HTTP Cookie, HTTP, RTSP, or SIP Header for the sticky type, in the Static Value field, enter the cookie string value. Valid entries are unquoted text strings with a maximum of 255 alphanumeric characters. If the string includes spaces, enclose the string with quotes. 9-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Configuring Sticky Statics Step 7 If you chose IP Netmask or V6 Prefix for the sticky type, do the following: a. For the IP Address Type, select either IPv4 or IPv6. b. In the Static Source field, enter the source IP address of the client. c. In the Static Destination field, enter the destination IP address of the client. Step 8 In the Named Real Server field, choose the real server to associate with this static sticky entry. Step 9 In the Port field, enter the port number of the real server. Valid entries are from 1 to 65535. Step 10 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Sticky Statics table. • Click Next to deploy your entries and to configure another sticky static entry. Related Topics Configuring Sticky Groups, page 9-7 9-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 9 Configuring Stickiness Configuring Sticky Statics CHAPTER 10-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 10 Configuring Parameter Maps Date: 3/28/12 This chapter describes how to configure parameter maps on the Cisco Application Control Engine (ACE) using Cisco Application Networking Manager (ANM). Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • Information About Parameter Maps, page 10-1 • Configuring Connection Parameter Maps, page 10-3 • Configuring Generic Parameter Maps, page 10-8 • Configuring HTTP Parameter Maps, page 10-9 • Configuring Optimization Parameter Maps, page 10-12 • Configuring RTSP Parameter Maps, page 10-20 • Configuring SIP Parameter Maps, page 10-21 • Configuring Skinny Parameter Maps, page 10-23 • Configuring DNS Parameter Maps, page 10-25 • Supported MIME Types, page 10-26 Information About Parameter Maps Parameter maps allow you to perform actions on traffic that ingresses an ACE interface based on certain criteria, such as protocol or connection attributes. After you configure a parameter map, you associate it with a policy map to implement configured behavior. Table 10-1 describes the parameter maps that you can configure using ANM and the ACE devices that support them. 10-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Information About Parameter Maps Related Topics • Configuring Connection Parameter Maps, page 10-3 • Configuring Generic Parameter Maps, page 10-8 • Configuring HTTP Parameter Maps, page 10-9 • Configuring Optimization Parameter Maps, page 10-12 • Configuring RTSP Parameter Maps, page 10-20 • Configuring SIP Parameter Maps, page 10-21 • Configuring Skinny Parameter Maps, page 10-23 • Configuring Generic Parameter Maps, page 10-8 • Configuring Traffic Policies, page 14-1 • Configuring Parameter Maps, page 10-1 • Configuring Virtual Contexts, page 6-8 Table 10-1 Parameter Map Types and ACE Support Parameter Map Description ACE Device ACE Module ACE Appliance Connection Connection parameter maps combine all IP and TCP connection-related behaviors pertaining to: • TCP normalization, termination, and server reuse • IP normalization, fragmentation, and reassembly X X Generic Generic parameter maps combine related generic protocol actions for server load-balancing connections. X X HTTP HTTP parameter maps configure ACE behavior for HTTP load-balanced connections. X X Optimization Optimization parameter maps specify optimization-related commands that pertain to application acceleration and optimization functions performed by the ACE. X RTSP Real Time Streaming Protocol (RTSP) parameter maps configure advanced RTSP behavior for server load-balancing connections. X X SIP Session Initiation Protocol (SIP) parameter maps configure SIP deep packet inspection on the ACE. X X Skinny Skinny Client Control Protocol (SCCP) parameter maps configure SCCP packet inspection on the ACE. X X DNS Domain Name System (DNS) parameter maps configure DNS actions for DNS packet inspection. X X 10-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Connection Parameter Maps Configuring Connection Parameter Maps You can configure a connection parameter map for use with a Layer 3/Layer 4 policy map. Connection parameter maps combine all IP and TCP connection-related behaviors pertaining to the following: • TCP normalization, termination, and server reuse • IP normalization, fragmentation, and reassembly Procedure Step 1 Choose Config > Devices > context > Load Balancing > Parameter Maps > Connection Parameter Maps. The Connection Parameter Maps table appears. Step 2 In the Connection Parameter Maps table, click Add to add a new parameter map, or choose an existing parameter map and click Edit to modify it. The Connection Parameter Maps configuration window appears. Step 3 In the Connection Parameter Maps configuration window, configure the parameter map using the information in Table 10-2. Click More Settings to access the additional Connection Parameter Map configuration attributes. By default, ANM hides the default Connection Parameter Map configuration attributes and the attributes that are not commonly used. Table 10-2 Connection Parameter Map Attributes Field Description Parameter Name Unique name for the parameter map. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Description Field that appears for ACE module A2(1.5), ACE appliance A3(2.3), and later releases of either device type. If you attempt to use the Description feature with an ACE that is running an earlier software version, ANM displays an invalid command detected error message and does not deploy the parameter map. Brief description of the parameter map. Enter a text string with a maximum of 240 alphanumeric characters (A–Z, a–z, 0–9). Spaces and special characters are allowed. Double quotes must be entered as matching pairs. Inactivity Timeout (Seconds) Number of seconds that the ACE is to wait before disconnecting idle connections. Valid entries are from 0 to 3217203. A value of 0 indicates that the ACE is never to time out a TCP connection. 10-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Connection Parameter Maps More Settings Exceeds MSS Action that the ACE takes to handle segments that exceed the maximum segment size (MSS): • Allow—The ACE is to permit segments that exceed the configured MSS. • Drop—The ACE is to discard segments that exceed the configured MSS. Max. Connection Limit Maximum number of concurrent connections to allow for the parameter map. Valid entries are from 0 to 4000000. Nagle Check box that enables the Nagle algorithm, which instructs a sender to buffer any data to be sent until all outstanding data has been acknowledged or until there is a full segment of data to send. Enabling the Nagle algorithm increases throughput, but it can increase latency in your TCP connection. Uncheck the check box to disable the Nagle algorithm. Note Disable the Nagle algorithm when you observe unacceptable delays in TCP connections. Random Sequence Number Check box that enables the use of random TCP sequence numbers, which adds a measure of security to TCP connections by making it more difficult for a hacker to guess or predict the next sequence number in a TCP connection. Uncheck the check box to disable the use of random TCP sequence numbers. This option is enabled by default. Bandwidth Rate Limit Option that appears for ACE modules only. Enter the bandwidth-rate limit in bytes per second for the parameter map. Valid entries are from 0 to 300000000 bytes. Connection Rate Limit Connection-rate limit in connections per second. Valid entries are from 0 to350000. Reserved Bits Action that the ACE takes to handle segments with the reserved bits set in the TCP header: • Allow—Segments with the reserved bits are to be permitted. • Drop—Segments with the reserved bits are to be discarded. • Clear—Reserved bits in TCP headers are to be cleared and segments are to be allowed. Type-of-Service IP Header Type of service for an IP packet that determines how the network handles the packet and balances its precedence, throughput, delay, reliability, and cost. Enter the type-of-service value to be applied to IP packets. Valid entries are from 0 to 255. For more information about type of service, refer to RFCs 791, 1122, 1349, and 3168. ACK Delay Time (Milliseconds) Number of milliseconds that the ACE is to wait before sending an acknowledgement from a client to a server. Valid entries are from 0 to 400. TCP Buffer Share (Bytes) Option that appears for only ACE modules. To improve throughput and overall performance, the ACE buffers the number of bytes you specify before processing received data or transmitting data. Use this option to increase the default buffer size and thereby realize improved network performance. Enter the maximum size of the TCP buffer in bytes. Valid entries are from 8192 to 262143 bytes. Default is 32768. Note If you enter a value in this field for an ACE device that does not support this option, an error message appears. Leave this field blank when creating or modifying a connection parameter map for devices that do not support this option. Table 10-2 Connection Parameter Map Attributes (continued) Field Description 10-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Connection Parameter Maps Smallest TCP MSS (Bytes) Size of the smallest segment of TCP data that the ACE is to accept. Valid entries are from 0 to 65535 bytes. The value 0 indicates that the ACE is not to set a minimum limit. Largest TCP MSS (Bytes) Size of the largest segment of TCP data that the ACE is to accept. Valid entries are from 0 to 65535 bytes. The value 0 indicates that the ACE is not to set a maximum limit. SYN Retries Number of attempts that the ACE is to make to transmit a TCP segment when initiating a Layer 7 connection. Valid entries are from 1 to 15. The default is 4. TCP WAN Optimization RTT Option that specifies how the ACE is to apply TCP optimizations to packets on a connection associated with a Layer 7 policy map using a round-trip time (RTT) value. The choices are as follows: • An entry of 0 (zero) indicates that the ACE is to apply TCP optimizations to packets for the life of a connection. • An entry of 65535 (the default) indicates that the ACE is to perform normal operations (that is, without optimizations) for the life of a connection. • Entries from 1 to 65534 indicate that the ACE is to use the following guidelines: • If the actual client RTT is less than the configured RTT, the ACE performs normal operations for the life of the connection. • If the actual client RTT is greater than or equal to the configured RTT, the ACE performs TCP optimizations on the packets for the life of a connection. Valid entries are from 0 to 65535. Timeout For Embryonic Connections (Seconds) Number of seconds that the ACE is to wait before timing out an embryonic connection, which is a TCP three-way handshake for a connection that does not complete for some reason. Valid entries are from 0 to 4294967295. The default is 5. A value of 0 indicates that the ACE is never to time out an embryonic connection. Half Closed Timeout (Seconds) Number of seconds the ACE is to wait before closing a half-closed connection, which is one in which the client or server sends a FIN and the server or client acknowledges the FIN without sending a FIN itself. Valid entries are from 0 to 4294967295. The default is 3600 (1 hour). A value of 0 indicates that the ACE is never to time out a half-closed connection. Slow Start Algorithm Check box that enables the slow start algorithm. When enabled, the slow start algorithm increases TCP window size as ACK handshakes arrive so that new segments are injected into the network at the rate at which acknowledgements are returned by the host at the other end of the connection. Uncheck the check box to disable the slow start algorithm. This option is disabled by default. SYN Segments With Data Action that the ACE takes to handle TCP SYN segments that contain data: • Allow—The ACE is to permit SYN segments that contain data and mark them for processing. • Drop—The ACE is to discard SYN segments that contain data. Table 10-2 Connection Parameter Map Attributes (continued) Field Description 10-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Connection Parameter Maps Urgent Pointer Policy Action that the ACE takes to handle urgent data as identified by the Urgent data control bit. Urgent data, as indicated by a control bit in the TCP header, indicates that urgent data is to be processed as soon as possible, even before normal data. The choices are as follows: • Allow—The ACE is to permit the status of the Urgent control bit. • Clear—The ACE is to set the Urgent control bit to 0 (zero) and thereby invalidate the Urgent Pointer which provides segment information. TCP Window Scale Factor TCP window scale factor. The TCP window scaling extension expands the definition of the TCP window to 32 bits and uses a scale factor to carry the 32-bit value in the 16-bit window of the TCP header. Increasing the window size improves TCP performance in network paths with large bandwidth, long-delay characteristics. Valid entries are from 0 to 14 (the maximum scale factor). For more information on TCP window scaling, refer to RFC 1323. Action For TCP Options Range Action that the ACE takes to handle the following TCP options: • Selective ACK • Timestamps • Action For TCP Window Scale Factor The choices are as follows: • N/A—This option is not set. • Allow—The ACE is to allow any segment with the specified option set. • Drop—The ACE is to discard any segment with the specified option set. Lower TCP Options Option that appears if you chose Allow or Drop for the Action For TCP Options Range. Enter the lower limit of the TCP option range. Valid entries are 6, 7, or a value from 9 to 255. See Table 10-3 for information on TCP options. Upper TCP Options Option that appears if you chose Allow or Drop for the Action For TCP Options Range. Enter the upper limit of the TCP option range. Valid entries are 6, 7, or a value from 9 to 255. See Table 10-3 for information on TCP options. Selective ACK Action that the ACE takes to handle the selective ACK option that is specified in SYN segments: • Allow—The ACE allows any segment with the specified option set. • Clear—The ACE clears the specified option from any segment that has it set and allow the segment. Table 10-2 Connection Parameter Map Attributes (continued) Field Description 10-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Connection Parameter Maps Table 10-3 lists the TCP options for connection parameter maps. Timestamps Action that the ACE takes to handle the time stamp option that is specified in SYN segments: • Allow—The ACE allows any segment with the specified option set. • Clear—The ACE clears the specified option from any segment that has it set and allow the segment. Action For TCP Window Scale Factor Action that the ACE takes to handle the TCP window scale factor option that is specified in SYN segments: • Allow—The ACE allows any segment with the specified option set. • Clear—The ACE clears the specified option from any segment that has it set and allow the segment. • Drop—The ACE discards any segment with the specified option set. Table 10-2 Connection Parameter Map Attributes (continued) Field Description Table 10-3 TCP Options for Connection Parameter Maps1 1. For more information about TCP options, see the Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide. Type Length Meaning 6 6 Echo (obsoleted by option 8) 7 6 Echo Reply (obsoleted by option 8) 9 2 Partial Order Connection Permitted 10 3 Partial Order Service Profile 11 CC 12 CC.NEW 13 CC.ECHO 14 3 TCP Alternate Checksum Request 15 N TCP Alternate Checksum Data 16 Skeeter 17 Bubba 18 3 Trailer Checksum Option 19 18 MD5 Signature Option 20 SCPS Capabilities 21 Selective Negative Acknowledgements (SNACK) 22 Record Boundaries 23 Corruption Experienced 24 SNAP 25 Unassigned (released 12/18/2000) 26 TCP Compression Filter 10-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Generic Parameter Maps Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without accepting your entries and to return to the Parameter Map table. • Click Next to accept your entries and to add another parameter map. Related Topics • Configuring Parameter Maps, page 10-1 • Configuring Traffic Policies, page 14-1 • Configuring Virtual Contexts, page 6-8 Configuring Generic Parameter Maps You configure a generic parameter map, which allows you to specify nonprotocol-specific behavior for data parsing. Generic parameter maps examine the payload and make decisions regardless of the protocol. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Parameter Maps > Generic Parameter Maps. The Generic Parameter Maps table appears. Step 2 In the Generic Parameter Maps table, click Add to add a new parameter map, or choose an existing parameter map and click Edit to modify it. The Parameter Maps configuration window appears. Step 3 In the Parameter Maps configuration window, configure the parameter map using the information in Table 10-4. Table 10-4 Generic Parameter Map Attributes Field Description Parameter Name Unique name for the parameter map. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Description Field that appears for ACE module A2(1.5), ACE appliance A3(2.3), and later releases of either device type. If you attempt to use the Description feature with an ACE that is running an earlier software version, ANM displays an invalid command detected error message and does not deploy the parameter map. Brief description of the parameter map. Enter a text string with a maximum of 240 alphanumeric characters (A–Z, a–z, 0–9). Spaces and special characters are allowed. Double quotes must be entered as matching pairs. 10-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring HTTP Parameter Maps Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Generic Parameter Maps table. • Click Next to deploy your entries and to configure another generic parameter map. Related Topics • Configuring Parameter Maps, page 10-1 • Configuring Traffic Policies, page 14-1 • Configuring Parameter Maps, page 10-1 • Configuring Virtual Contexts, page 6-8 Configuring HTTP Parameter Maps You can configure an HTTP parameter map for use with a Layer 3/Layer 4 policy map. HTTP parameter maps allow you to configure ACE behavior for HTTP load-balanced connections. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Parameter Maps > HTTP Parameter Maps. The HTTP Parameter Maps table appears. Step 2 In the HTTP Parameter Maps table, click Add to add a new parameter map, or choose an existing parameter map and click Edit to modify it. The HTTP Parameter Maps configuration window appears. Step 3 In the HTTP Parameter Maps configuration window, configure the parameter map using the information in Table 10-5. Case-Insensitive Check box that instructs the ACE to be case insensitive for the parameter map. Uncheck this check box to instruct the ACE to be case sensitive for this parameter map. Max. Parse Length (Bytes) Number of bytes to parse for the total length of all generic headers. Valid entries are from 1 to 65535. The default is 2048 bytes. Table 10-4 Generic Parameter Map Attributes (continued) Field Description 10-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring HTTP Parameter Maps Table 10-5 HTTP Parameter Map Attributes Field Description Parameter Name Unique name for the parameter map. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Description Field that appears for ACE module A2(1.5), ACE appliance A3(2.3), and later releases of either device type. If you attempt to use the Description feature with an ACE that is running an earlier software version, ANM displays an invalid command detected error message and does not deploy the parameter map. Brief description of the parameter map. Enter a text string with a maximum of 240 alphanumeric characters (A–Z, a–z, 0–9). Spaces and special characters are allowed. Double quotes must be entered as matching pairs. Case-Insensitive Check box that instructs the ACE to be case insensitive. Uncheck this check box to indicate that the ACE is to be case sensitive. This check box is cleared by default. Header Modify Per-Request Check box to require that SSL information is inserted for every HTTP GET request. Current functionality only requires that the information be inserted at the first GET request. Exceed Max. Parse Length Action that the ACE takes to handle cookies, HTTP headers, and URLs that exceed the maximum parse length. The choices are as follows: • Continue—The ACE is to continue load balancing. When this option is selected, the HTTP Persistence Rebalance option is disabled if the total length of all cookies, HTTP headers, and URLs exceeds the maximum parse value. • Drop—The ACE is to stop load balancing and to discard the packet. HTTP Persistence Rebalance Check box that instructs the ACE to do the following: • Separately load balance each subsequent HTTP request on the same TCP connection. • Insert the header and cookie for every request instead of only the first request. Uncheck this check box to indicate that this option is disabled. This option is enabled by default. TCP Server Connection Reuse Check box that instructs the ACE to reduce the number of open connections on a server by allowing connections to persist and be reused by multiple client connections. If you enable this feature, perform the following tasks: • Ensure that the ACE maximum segment size (MSS) is the same as the server maximum segment size. • Configure port address translation (PAT) on the interface that is connected to the real server. • Configure on the ACE the same TCP options that exist on the TCP server. • Ensure that each server farm is homogeneous (all real servers within a server farm have identical configurations). Uncheck this check box to disable this option. Content Max. Parse Length (Bytes) Maximum number of bytes to parse in HTTP content. Valid entries are from 1 to 65535. The default is 4096. Header Max. Parse Length (Bytes) Maximum number of bytes to parse for the total length of cookies, HTTP headers, and URLs. Valid entries are from 1 to 65535. The default is 4096. 10-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring HTTP Parameter Maps Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without accepting your entries and to return to the Parameter Map table. • Click Next to accept your entries and to add another parameter map. Related Topics • Configuring Parameter Maps, page 10-1 • Configuring Traffic Policies, page 14-1 • Configuring Parameter Maps, page 10-1 Secondary Cookie Delimiters ASCII-character delimiters to be used to separate cookies in a URL string. Valid entries are unquoted text strings with no spaces and a maximum of 4 characters. The default delimiters are /&#+. MIME Type To Compress Option that appears only for ACE appliances (all versions) and ACE modules version A4(1.0) and later. In the field on the left, enter the Multipurpose Internet Mail Extension (MIME) type to compress, and click Add. The MIME type appears in the column on the right. To remove or change a MIME type, choose it in the column on the right, and click Remove. The selected MIME type appears in the field on the left where you can modify or delete it. To specify the sequence in which compression is to be applied, choose MIME types in the column on the right, and click Up or Down to arrange the MIME types. The “Supported MIME Types” section on page 10-26 lists the supported MIME types. You can use an asterisk (*) to indicate a wildcard, such as text/*, which would include all text MIME types (text/html, text/plain, and so on). User Agent Not To Compress Option that appears only for ACE appliances (all versions) and ACE modules version A4(1.0) and later. A user agent is a client that initiates a request. Examples of user agents include browsers, editors, and other end-user tools. When you specify a user agent string in this field, the ACE does not compress the response to a request when the request contains the matching user agent string. In the field on the left, enter the user agent string to be matched, and click Add. The string appears in the column on the right. To remove or change a user agent string, choose it in the column on the right, and click Remove. The selected string appears in the field on the left where you can modify or delete it. To specify the sequence in which strings are to be matched, choose strings in the column on the right, and click Up or Down to arrange the strings in the desired sequence. Valid entries are 64 characters. Min. Size To Compress (Bytes) Option that appears only for ACE appliances (all versions) and ACE modules version A4(1.0) and later. Enter the threshold at which compression is to occur. The ACE compresses files that are the minimum size or larger. Valid entries are from 1 to 4096 bytes. Table 10-5 HTTP Parameter Map Attributes (continued) Field Description 10-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Optimization Parameter Maps • Configuring Virtual Contexts, page 6-8 Configuring Optimization Parameter Maps Note Optimization parameter maps are available for ACE appliances only. You can configure an optimization parameter map for use with a Layer 3/Layer 4 policy map. Optimization parameter maps specify optimization-related commands that pertain to application acceleration and optimization functions performed by the ACE. See the “Configuring Application Acceleration and Optimization” section on page 15-1 or the Cisco 4700 Series Application Control Engine Appliance Application Acceleration and Optimization Configuration Guide for more information about application acceleration and optimization. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Parameter Maps > Optimization Parameter Maps. The Optimization Parameter Maps table appears. Step 2 In the Optimization Parameter Maps table, click Add to add a new parameter map, or choose an existing parameter map and click Edit to modify it. The Optimization Parameter Maps configuration window appears. Step 3 In the Optimization Parameter Maps configuration window, configure the parameter map using the information in Table 10-6. Table 10-6 Optimization Parameter Map Attributes Field Description Parameter Name Unique name for the parameter map. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Description Field that appears for ACE module A2(1.5), ACE appliance A3(2.3), and later releases of either device type. If you attempt to use the Description feature with an ACE that is running an earlier software version, ANM displays an invalid command detected error message and does not deploy the parameter map. Brief description of the parameter map. Enter a text string with a maximum of 240 alphanumeric characters (A–Z, a–z, 0–9). Spaces and special characters are allowed. Double quotes must be entered as matching pairs. Set Browser Freshness Period Method that the ACE uses to determine the freshness of objects in the client’s browser: • N/A—This option is not configured. • Disable Browser Object Freshness Control—Browser freshness control is not used. • Set Freshness Similar To Flash Forward Objects—The ACE sets freshness similar to that used for FlashForwarded objects and to use the values specified in the Maximum Time for Cache Time-To-Live and Minimum Time for Cache Time-To-Live fields. 10-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Optimization Parameter Maps Duration For Browser Freshness (Seconds) Field that appears if the Set Browser Freshness Period option is not configured. Enter the number of seconds that objects in the client’s browser are considered fresh. Valid entries are 0 to 2147483647 seconds. Response Codes To Ignore (Comma Separated) Comma-separated list of HTTP response codes for which the response body must not be read. For example, an entry of 302 indicates that the ACE is to ignore the response body of a 302 (redirect) response from the origin server. Valid entries are unquoted text strings with a maximum of 64 alphanumeric characters from 100 to 599, inclusive. Appscope Optimize Rate (%) Percentage of all requests or sessions to be sampled for performance with acceleration (or optimization) applied. All applicable optimizations for the class will be performed. Valid entries are from 0 to 100 percent. The default is 10 percent. The sum of this value and the value entered in the Passthru Rate Percent field must not exceed 100. Appscope Passthrough Rate (%) Percentage of all requests or sessions to be sampled for performance without optimization. No optimizations for the class will be performed. Valid entries are from 0 to 100. The default is 10 percent. The sum of this value and the value entered in the Optimize Rate Percent field must not exceed 100. Max. Number for Parameter Summary Log (Bytes) Maximum number of bytes that are to be logged for each parameter value in the parameter summary of a transaction log entry in the statistics log. If a parameter value exceeds this limit, it is truncated at the specified limit. Valid entries are from 0 to 10,000 bytes. Max. For Post Data to Scan for Logging (KBytes) Maximum number of kilobytes of POST data that the ACE is to scan for parameters for the purpose of logging transaction parameters in the statistics log. Valid entries are from 0 to 1000 KB. String For Grouping Requests String that the ACE uses to sort requests for AppScope reporting. The string can contain a URL regular expression that defines a set of URLs in which URLs that differ only by their query parameters are to be treated as separate URLs in AppScope reports. For example, to define a string that is used to identify the URLs http://server/catalog.asp?region=asia and http://server/catalog.asp?region=america as two separate reporting categories, you would enter http_query_param(region). Valid entries are from 1 to 255 characters and can contain the parameter expander functions listed in Table 10-7. Base File Anonymous Level Base file anonymous level. Information that is common to a large set of users is generally not confidential or user-specific. Conversely, information that is unique to a specific user or a small set of users is generally confidential or user-specific. The anonymous base file feature enables the ACE to create and deliver condensed base files that contain only information that is common to a large set of users. No information unique to a particular user, or across a very small subset of users, is included in anonymous base files. Enter the value for base file anonymity for the all-user condensation method. Valid entries are from 0 to 50. The default is 0, which disables the base file anonymity feature. Table 10-6 Optimization Parameter Map Attributes (continued) Field Description 10-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Optimization Parameter Maps Cache-Key Modifier Expression Cache key modifier expression. A cache object key is a unique identifier that is used to identify a cached object to be served to a client, replacing a trip to the origin server. The cache key modifier feature allows you to modify the canonical form of a URL; that is, the portion before “?” in a URL. For example, the canonical URL of http://www.xyz.com/somepage.asp?action=browse&level=2 is http://www.xyz.com/somepage.asp. Enter a regular expression containing embedded variables as described in Table 10-7. The ACE transforms URLs specified in class maps for this virtual server with the expression and variable entered here. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. If the string includes spaces, enclose the string with quotation marks (“). Min. Time For Cache Time-To-Live (Seconds) Minimum number of seconds that an object without an explicit expiration time should be considered fresh in the ACE cache. This value specifies the minimum time that content can be cached. If the ACE is configured for FlashForward optimization, this value should normally be 0. If the ACE is configured for dynamic caching, this value should indicate how long the ACE should cache the page. (See Table 7-17 for information about these configuration options.) Valid entries are from 0 to 2147483647 seconds. Max. Time For Cache Time-To-Live (Seconds) Maximum number of seconds that an object without an explicit expiration time should be considered fresh in the ACE cache. Valid entries are from 0 to 2147483647 seconds. Cache Time-To-Live Duration (%) Percentage of an object’s age at which an embedded object without an explicit expiration time is considered fresh. Valid entries are from 0 to 100 percent. Expression To Modify Cache Key Query Parameter Regular expression that contains embedded variables as described in Table 10-7. The ACE transforms URLs specified in class maps for this virtual server with the expression and variable entered here. The cache parameter feature allows you to modify the query parameter of a URL; that is, the portion after “?” in a URL. For example, the query parameter portion of http://www.xyz.com/somepage.asp?action=browse&level=2 is action=browse&level=2. If no string is specified, the query parameter portion of the URL is used as the default value for this portion of the cache key. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. Canonical URL Expressions (Comma Separated) Comma-separated list of parameter expander functions as defined in Table 10-7 to identify the URLs to associate with this parameter map. The ACE uses the canonical URL feature to eliminate the “?” and any characters that follow to identify the general part of the URL. This general URL is then used to create the base file. In this way, the ACE maps multiple URLs to a single canonical URL. Valid entries are unquoted text strings with a maximum of 255 alphanumeric characters. Enable Cacheable Content Optimization Check box that enables delta optimization of content that can be cached. This feature allows the ACE to detect content that can be cached and perform delta optimization on it. Uncheck the check box to disable this feature. Table 10-6 Optimization Parameter Map Attributes (continued) Field Description 10-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Optimization Parameter Maps Enable Delta Optimization On First Visit To Web Page Check box that enables condensation on the first visit to a web page. Uncheck the check box to disable this feature. Min. Page Size For Delta Optimization (Bytes) Minimum page size, in bytes, that can be condensed. Valid entries are from 1 to 250000 bytes. Max. Page Size For Delta Optimization (Bytes) Maximum page size, in bytes, that can be condensed. Valid entries are from 1 to 250000 bytes. Set Default Client Script Scripting language that the ACE recognizes on condensed content pages: • N/A—This option is not configured. • Javascript—The default scripting language is JavaScript. • Visual Basic Script—The default scripting language is Visual Basic. Exclude Iframes From Delta Optimization Check box that specifies that delta optimization is not to be applied to IFrames (inline frames). Uncheck the check box to indicate that delta optimization is to be applied to IFrames. Exclude Non-ASCII Data From Delta Optimization Check box that specifies that delta optimization is not to be applied to non-ASCII data. Uncheck the check box to indicate that delta optimization is to be applied to non-ASCII data. Exclude JavaScripts From Delta Optimization Check box that specifies that delta optimization is not to be applied to JavaScript. Clear the check box to indicate that delta optimization is to be applied to JavaScript. MIME Types To Exclude From Delta Optimization Mime types to exclude from delta optimization. Do the following: 1. In the first field, enter a comma-separated list of the MIME (Multipurpose Internet Mail Extension) type messages that are not to have delta optimization applied, such as image/Jpeg, text/html, application/msword, or audio/mpeg. See the “Supported MIME Types” section on page 10-26 for a list of supported MIME types. 2. Click Add to add the entry to the list box on the right. You can position the entries in the list box by using the Up and Down buttons. Remove HTML META Elements From Documents Check box that specifies that HTML META elements are to be removed from documents to prevent them from being condensed. Uncheck the check box to indicate that HTML META elements are not to be removed from documents. Set Flash Forward Refresh Policy Method the ACE is to use to refresh stale embedded objects: • N/A—This option is not configured. • Allow Flash Forward To Indirect Refresh Of Objects—The ACE uses FlashForward to indirectly refresh embedded objects. • Bypass Flash Forward To Direct Refresh Of Objects—The ACE bypasses FlashForward for stale embedded objects so that they are refreshed directly. Rebase Delta Optimization Threshold (%) Delta threshold, expressed as a percent, when rebasing is to be triggered. This entry represents the size of a page delta relative to total page size, expressed as a percent. This entry triggers rebasing when the delta response size exceeds the threshold as a percentage of base file size. Valid entries are from 0 to 10000 percent. Table 10-6 Optimization Parameter Map Attributes (continued) Field Description 10-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Optimization Parameter Maps Rebase Flash Forward Threshold (%) Threshold, expressed as a percent, when rebasing is to be triggered based on the percent of FlashForwarded URLs in the response. This entry triggers rebasing when the difference between the percentages of FlashForwarded URLs in the delta response and the base file exceeds the threshold. Valid entries are from 0 to 10000 percent. Rebase History Size (Pages) Number of pages to be stored before the ACE resets all rebase control parameters to zero and starts over. This option prevents the base file from becoming too rigid. Valid entries are from 10 to 2147483647. Rebase Modify Cool-Off Period (Seconds) Number of seconds after the last modification before performing a rebase. Valid entries are from 1 to 14400 seconds (4 hours). Rebase Reset Period (Seconds) Period of time, in seconds, for performing a meta data refresh. Valid entries are from 1 to 900 seconds (15 minutes). Override Client Request Headers Action that the ACE takes to handle client request headers (primarily for embedded objects): • N/A—This feature is not enabled. • All Cache Request Headers Are Ignored—The ACE ignores all cache request headers. • Overrides The Cache Control: No Cache HTTP Header From A Request—The ACE ignores cache control request headers that state no cache. Override Server Response Headers Action that the ACE takes to handle origin server response headers (primarily for embedded objects): • N/A—This feature is not enabled. • All Cache Request Headers Are Ignored—The ACE ignores all response headers. • Overrides The Cache Control: Private HTTP Header From A Response—The ACE ignores cache control response headers that state private. UTF-8 Character Set Threshold UTF-8 (8-bit Unicode Transformation Format) character set, which is an international standard that allows Web pages to display non-ASCII or non-English multibyte characters. It can represent any universal character in the Unicode standard and is backwards compatible with ASCII. Enter the number of UTF-8 characters that need to appear on a page to constitute a UTF-8 character set page. Valid entries are from 1 to 1,000,000. Server Load Threshold Trigger (%) Server load threshold trigger that indicates that the time-to-live (TTL) period for cached objects is to be based dynamically on server load. With this method, TTL periods increase if the current response time from the origin sever is greater than the average response time and decrease if the current response time from the origin server is less than the average response time when the difference in response times exceeds a specified threshold amount. Enter the threshold, expressed as a percent, at which the TTL for cached objects is to be changed. Valid entries are from 0 to 100 percent. Table 10-6 Optimization Parameter Map Attributes (continued) Field Description 10-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Optimization Parameter Maps Table 10-7 lists the parameter expander functions that you can use. Server Load Time-To-Live Change (%) Option that specifies the percentage by which the cache TTL is increased or decreased in response to a change in server load. For example, if this value is set to 20 and the current TTL for a response is 300 seconds. and if the current server response times exceeds the trigger threshold, the cache TTL for the response is raised to 360 seconds. Enter the percent by which the cache TTL is to be increased or decreased when the server load threshold trigger is met. Valid entries are from 0 to 100 percent. Delta Optimization Mode Method by which delta optimization is to be implemented. The choices are as follows: • N/A—This option is not configured. • Enable The All-User Mode For Delta Optimization—The ACE is to generate the delta against a single base file that is shared by all users of the URL. This option is usable in most cases if the structure of a page is common across all users, and the disk space overhead is minimal. • Enable The Per-User Mode For Delta Optimization—The ACE is to generate the delta against a base file that is created specifically for that user. This option is useful when page contents, including layout elements, are different for each user, and delivers the highest level of condensation. However, this increases disk space requirements because a copy of the base page that is delivered to each user is cached. This option is useful when privacy is required because base pages are not shared among users. String To Be Used For Server HTTP Header Option that defines a string that is to be sent in the server header for an HTTP response. This option provides you with a method for uniquely tagging the context or URL match statement by setting the server header value to a particular string. The server header string can be used when a particular URL is not being transmitted to the correct target context or match statement. Enter the string that is to appear in the server header. Valid entries are quoted text strings with a maximum of 64 alphanumeric characters. Table 10-6 Optimization Parameter Map Attributes (continued) Field Description 10-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Optimization Parameter Maps Table 10-7 Parameter Expander Functions Variable Description $(number) Expands to the corresponding matching subexpression (by number) in the URL pattern. Subexpressions are marked in a URL pattern using parentheses (). The numbering of the subexpressions begins with 1 and is the number of the left-parenthesis “(“ counting from the left. You can specify any positive integer for the number. $(0) matches the entire URL. For example, if the URL pattern is ((http://server/.*)/(.*)/)a.jsp, and the URL that matches it is http://server/main/sub/a.jsp?category=shoes&session=99999, then the following are correct: $(0) = http://server/main/sub/a.jsp $(1) = http://server/main/sub/ $(2) = http://server/main $(3) = sub If the specified subexpression does not exist in the URL pattern, then the variable expands to the empty string. $http_query_string() Expands to the value of the whole query string in the URL. For example, if the URL is http://myhost/dothis?param1=value1¶m2=value2, then the following is correct: $http_query_string() = param1=value1¶m2=value2 This function applies to both GET and POST requests. $http_query_param(query-param-name) The obsolete syntax is also supported: $param(query-param-name) Expands to the value of the named query parameter (case sensitive). For example, if the URL is http://server/main/sub/a.jsp?category=shoes&session=99999, then the following are correct: $http_query_param(category) = shoes $http_query_param(session) = 99999 If the specified parameter does not exist in the query, then the variable expands to the empty string. This function applies to both GET and POST requests. $http_cookie(cookie-name) Evaluates to the value of the named cookie. For example, $http_cookie(cookiexyz). The cookie name is case sensitive. $http_header(request-header-name) Evaluates to the value of the specified HTTP request header. In the case of multivalued headers, it is the single representation as specified in the HTTP specification. For example, $http_header(user-agent). The HTTP header name is not case sensitive. $http_method() Evaluates to the HTTP method used for the request, such as GET or POST. 10-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Optimization Parameter Maps Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The ACE validates the parameter map configuration and deploys it. • Click Cancel to exit this procedure without accepting your entries and to return to the Parameter Map table. • Click Next to accept your entries and to add another parameter map. Related Topics • Configuring Parameter Maps, page 10-1 • Configuring Traffic Policies, page 14-1 • Configuring Parameter Maps, page 10-1 • Configuring Virtual Contexts, page 6-8 Boolean Functions: $http_query_param_present(query-param-name) $http_query_param_notpresent(query-param-name) $http_cookie_present(cookie-name) $http_cookie_notpresent(cookie-name) $http_header_present(request-header-name) $http_header_notpresent(request-header-name) $http_method_present(method-name) $http_method_notpresent(method-name) Evaluates to a Boolean value: True or False, depending on the presence or absence of the element in the request. The elements are a specific query parameter (query-param-name), a specific cookie (cookie-name), a specific request header (request-header-name), or a specific HTTP method (method-name). All identifiers are case sensitive except for the HTTP request header name. $regex_match(param1, param2) Evaluates to a Boolean value: True if the two parameters match and False if they do not match. The two parameters can be any two expressions, including regular expressions, that evaluate to two strings. For example, this function: $regex_match($http_query_param(URL), .*Store\.asp.*) compares the query URL with the regular expression string .*Store\.asp.* If the URL matches this regular expression, this function evaluates to True. Table 10-7 Parameter Expander Functions (continued) Variable Description 10-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring RTSP Parameter Maps Configuring RTSP Parameter Maps You can configure a Real Time Streaming protocol (RTSP) parameter map, which allows you to configure advanced RTSP behavior for server load-balancing connections. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Parameter Maps > RTSP Parameter Maps. The RTSP Parameter Maps table appears. Step 2 In the RTSP Parameter Maps table, click Add to add a new parameter map, or choose an existing parameter map and click Edit to modify it. The Parameter Maps configuration window appears. Step 3 In the Parameter Maps configuration window, configure the parameter map using the information in Table 10-8. Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the RTSP Parameter Maps table. • Click Next to deploy your entries and to configure another RTSP parameter map. Related Topics • Configuring Parameter Maps, page 10-1 • Configuring Traffic Policies, page 14-1 • Configuring Parameter Maps, page 10-1 Table 10-8 RTSP Parameter Map Attributes Field Description Parameter Name Unique name for the parameter map. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Description Field that appears for ACE module A2(1.5), ACE appliance A3(2.3), and later releases of either device type. If you attempt to use the Description feature with an ACE that is running an earlier software version, ANM displays an invalid command detected error message and does not deploy the parameter map. Brief description of the parameter map. Enter a text string with a maximum of 240 alphanumeric characters (A–Z, a–z, 0–9). Spaces and special characters are allowed. Double quotes must be entered as matching pairs. Case-Insensitive Check box that instructs the ACE to be case insensitive. Uncheck the check box to instruct the ACE is to be case sensitive. Header Max. Parse Length (Bytes) Number of bytes to parse for the total length of RTSP headers. Valid entries are from 1 to 65535. The default is 2048 bytes. 10-21 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring SIP Parameter Maps • Configuring Virtual Contexts, page 6-8 Configuring SIP Parameter Maps You can configure Session Initiation Protocol (SIP) parameter maps, which allow you to configure SIP deep-packet inspection policy maps on the ACE. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Parameter Maps > SIP Parameter Maps. The SIP Parameter Maps table appears. Step 2 In the SIP Parameter Maps table, click Add to add a new parameter map, or choose an existing parameter map and click Edit to modify it. The Parameter Maps configuration window appears. Step 3 In the Parameter Maps configuration window, configure the parameter map using the information in Table 10-9. Table 10-9 SIP Parameter Map Attributes Field Description Parameter Name Unique name for the parameter map. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Description Field that appears for ACE module A2(1.5), ACE appliance A3(2.3), and later releases of either device type. If you attempt to use the Description feature with an ACE that is running an earlier software version, ANM displays an invalid command detected error message and does not deploy the parameter map. Brief description of the parameter map. Enter a text string with a maximum of 240 alphanumeric characters (A–Z, a–z, 0–9). Spaces and special characters are allowed. Double quotes must be entered as matching pairs. Instant Messaging Check box that enables instant messaging (IM) over SIP after it has been disabled. Uncheck this check box to disable this feature. Logging All Check box that appears only for ACE module and ACE appliance software Version A4(1.0) or later. Check this check box to enable logging of all received and transmitted SIP packets in the system log (syslog) in addition to the dropped packets, which by default are logged. The ACE allows all headers sent in the SIP packet, including proprietary headers. In the event of a failover for SIP sessions over UDP, the ACE continues to process SIP packets for established SIP sessions. Uncheck this check box to disable this feature. 10-22 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring SIP Parameter Maps Max. Forward Validation Option that allows you to configure the ACE to validate the value of the Max-Forward header field. Specify how the ACE is to handle the validation of Max-Forward header fields. The choices are as follows: • N/A—The ACE is not to validate Max-Forward header fields. • Drop—The ACE is to drop the SIP message if it does not pass Max-Forward header validation. • Deny—The ACE is to reset the SIP connection if it does not pass Max-Forward header validation. Log Max. Forward Validation Event Check box that instructs the ACE to log Max-Forward validation events. Uncheck the check box to disable this feature. Mask UA Software Version Check box that instructs the ACE to mask the user agent software version. If the software version of a user agent is exposed, that user agent might be vulnerable to attacks from hackers who exploit the security holes present in that particular software version. This option allows you to mask or log the user agent software version so that it is not exposed. Uncheck the check box to disable this feature. Log UA Software Version Check box that instructs the ACE to log the user agent software version. Uncheck the check box to disable this feature. Strict Header Validation Action that the ACE is to take to handle header validation. You can ensure the validity of SIP packet headers by configuring the ACE to check for the presence of the following mandatory SIP header fields: • From • To • Call-ID • CSeq • Via • Max-Forwards If one of the header fields is missing in a SIP packet, the ACE considers that packet invalid. The ACE also checks for forbidden header fields, according to RFC 3261. Specify how the ACE is to handle header validation. The choices are as follows: • N/A—The ACE does not to perform header validation. • Drop—The ACE drops the SIP message if the SIP packet does not pass header validation. • Reset—The ACE resets the connection if the SIP packet does not pass header validation. Log Strict Header Validation Check box that instructs the ACE to log header validation events. Uncheck the check box to disable this feature. Mask Non SIP URI Check box that instructs the ACE to mask non-SIP URIs in SIP messages. This option and the next enable the detection of non-SIP URIs in SIP messages. Uncheck the check box to disable this feature. Table 10-9 SIP Parameter Map Attributes (continued) Field Description 10-23 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Skinny Parameter Maps Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the SIP Parameter Maps table. • Click Next to deploy your entries and to configure another SIP parameter map. Related Topics • Configuring Parameter Maps, page 10-1 • Configuring Traffic Policies, page 14-1 • Configuring Parameter Maps, page 10-1 • Configuring Virtual Contexts, page 6-8 Configuring Skinny Parameter Maps You can configure Skinny Client Control Protocol (SCCP or Skinny) parameter maps, which allow you to configure SCCP packet inspection on the ACE. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Parameter Maps > Skinny Parameter Maps. The Skinny Parameter Maps table appears. Step 2 In the Skinny Parameter Maps table, click Add to add a new parameter map, or choose an existing parameter map and click Edit to modify it. The Parameter Maps configuration window appears. Log Non SIP URI Check box that instructs the ACE to log non-SIP URIs in SIP messages. Uncheck the check box to disable this feature. SIP Media Pinhole Timeout (Seconds) Timeout period for SIP media pinhole (secure port) connections in seconds. Valid entries are from 1 to 65535 seconds. The default is 5. Table 10-9 SIP Parameter Map Attributes (continued) Field Description 10-24 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring Skinny Parameter Maps Step 3 In the Parameter Maps configuration window, configure the parameter map using the information in Table 10-10. Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Skinny Parameter Maps table. • Click Next to deploy your entries and to configure another Skinny parameter map. Related Topics • Configuring Parameter Maps, page 10-1 Table 10-10 Skinny Parameter Map Attributes Field Description Parameter Name Unique name for the parameter map. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Description Field that appears for ACE module A2(1.5), ACE appliance A3(2.3), and later releases of either device type. If you attempt to use the Description feature with an ACE that is running an earlier software version, ANM displays an invalid command detected error message and does not deploy the parameter map. Brief description of the parameter map. Enter a text string with a maximum of 240 alphanumeric characters (A–Z, a–z, 0–9). Spaces and special characters are allowed. Double quotes must be entered as matching pairs. Enforce Registration Check box that enables Skinny registration enforcement. You can configure the ACE to allow only registered Skinny clients to make calls. To accomplish this task, the ACE maintains the state of each Skinny client. After a client registers with CCM, the ACE opens a secure port (pinhole) to allow that client to make a call. Uncheck the check box to disable this feature. Message Id Max Maximum value for the station message ID in hexadecimal that the ACE is to accept. Valid entries are hexadecimal values from 0x0 to 0x4000 with a default value of 0x181. If a packet arrives with a station message ID greater than the specified value, the ACE drops the packet and generates a syslog message. Note The Message Id Max. hexadecimal value should always start with 0x or 0X. Min. SCCP Prefix Length (Bytes) Minimum SCCP prefix length in bytes. By default, the ACE drops SCCP messages that have an SCCP Prefix length that is less than the message ID. The ACE drops Skinny message packets that fail this check and generates a syslog message. Valid entries are from 4 to 4000 bytes. Max. SCCP Prefix Length (Bytes) Maximum SCCP prefix length in bytes. This feature allows you to configure the ACE so that it checks the maximum SCCP prefix length. The ACE drops Skinny message packets that fail this check and generates a syslog message. Valid entries are from 4 to 4000 bytes. 10-25 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Configuring DNS Parameter Maps • Configuring Traffic Policies, page 14-1 • Configuring Virtual Contexts, page 6-8 Configuring DNS Parameter Maps You can configure Domain Name System (DNS) parameter maps, which allow you to configure DNS actions for DNS packet inspection. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Parameter Maps > DNS Parameter Maps. The DNS Parameter Maps table appears. Step 2 In the DNS Parameter Maps table, click Add to add a new parameter map, or choose an existing parameter map and click Edit to modify it. The DNS Parameter Maps configuration window appears. Step 3 In the DNS Parameter Maps configuration window, configure the parameter map using the information in Table 10-11. Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the DNS Parameter Maps table. • Click Next to deploy your entries and to configure another DNS parameter map. Related Topics • Configuring Parameter Maps, page 10-1 Table 10-11 DNS Parameter Map Attributes Field Description Parameter Name Unique name for the parameter map. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Description Field that appears for ACE module A2(1.5), ACE appliance A3(2.3), and later releases of either device type. If you attempt to use the Description feature with an ACE that is running an earlier software version, ANM displays an invalid command detected error message and does not deploy the parameter map. Brief description of the parameter map. Enter a text string with a maximum of 240 alphanumeric characters (A–Z, a–z, 0–9). Spaces and special characters are allowed. Double quotes must be entered as matching pairs. Timeout (Seconds) Amount of time in seconds that the ACE keeps the query entries without answers in the hash table before timing them out. Configure the ACE to time out DNS queries that have no matching server response. Specify the Enter an integer from 2 to 120 seconds. The default is 10 seconds. 10-26 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Supported MIME Types • Configuring Traffic Policies, page 14-1 • Configuring Virtual Contexts, page 6-1 Supported MIME Types The ACE supports the following MIME types: • application/msexcel • application/mspowerpoint • application/msword • application/octet-stream • application/pdf • application/postscript • application/\x-gzip • application/\x-java-archive • application/\x-java-vm • application/\x-messenger • application/\zip • audio/* • audio/basic • audio/midi • audio/mpeg • audio/x-adpcm • audio/x-aiff • audio/x-ogg • audio/x-wav • image/* • image/gif • image/jpeg • image/png • image/tiff • image/x-3ds • image/x-bitmap • image/x-niff • image/x-portable-bitmap • image/x-portable-greymap • image/x-xpm • text/* • text/css 10-27 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Supported MIME Types • text/html • text/plain • text/richtext • text/sgml • text/xmcd • text/xml • video/* • video/flc • video/mpeg • video/quicktime • video/sgi • video/x-fli 10-28 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 10 Configuring Parameter Maps Supported MIME Types CHAPTER 11-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 11 Configuring SSL Date: 3/28/12 This chapter describes how to configure Secure Sockets Layer (SSL) on the Cisco Application Control Engine (ACE) using Cisco Application Networking Manager (ANM). Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • SSL Overview, page 11-2 • SSL Configuration Prerequisites, page 11-2 • Summary of SSL Configuration Tasks, page 11-3 • SSL Setup Sequence, page 11-4 • Using SSL Certificates, page 11-5 • Using SSL Keys, page 11-10 • Configuring SSL Parameter Maps, page 11-18 • Configuring SSL Chain Group Parameters, page 11-23 • Configuring SSL CSR Parameters, page 11-24 • Generating CSRs, page 11-26 • Configuring SSL Proxy Service, page 11-27 • Configuring SSL OCSP Service, page 11-29 • Enabling Client Authentication, page 11-31 11-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL SSL Overview SSL Overview SSL is an application-level protocol that provides encryption technology for the Internet, ensuring secure transactions such as the transmission of credit card numbers for e-commerce websites. SSL initiation occurs when the ACE device (either an ACE module or an ACE appliance) acts as a client and initiates the SSL session between it and the SSL server. SSL termination occurs when the ACE, acting as an SSL server, terminates an SSL connection from a client and then establishes a TCP connection to an HTTP server. SSL provides the secure transaction of data between a client and a server through a combination of privacy, authentication, and data integrity. SSL relies upon certificates and private-public key exchange pairs for this level of security. Figure 11-1 shows the following network connections in which the ACE terminates the SSL connection with the client: • Client to ACE—SSL connection between a client and the ACE acting as an SSL proxy server • ACE to Server—TCP connection between the ACE and the HTTP server Figure 11-1 SSL Termination with Client The ACE uses parameter maps, SSL proxy services, and class maps to build the policy maps that determine the flow of information between the client, the ACE, and the server. SSL termination is a Layer 3 and Layer 4 application because it is based on the destination IP addresses of the inbound traffic flow from the client. For this type of application, you create a Layer 3 and Layer 4 policy map that the ACE applies to the inbound traffic. If you need to delete any of the SSL objects (authorization groups, chain groups, parameter maps, keys, CRLs, or certificates), you must remove the dependency from within the proxy service first before removing the SSL object. Before configuring the ACE for SSL, see the “SSL Configuration Prerequisites” section on page 11-2. SSL Configuration Prerequisites This SSL configuration prerequisites are as follows: • Your ACE hardware is configured for server load balancing (SLB). Note During the real server and server farm configuration process, when you associate a real server with a server farm, ensure that you assign an appropriate port number for the real server. The default behavior by the ACE is to automatically assign the same destination port that was used by the inbound connection to the outbound server connection if you do not specify a port. Client Front-end Back-end Ciphertext Clear Text SSL Termination (ACE as Server) SSL Termination with a Client Server 243313 11-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Summary of SSL Configuration Tasks • Your policy map is configured to define the SSL session parameters and client/server authentication tools, such as the certificate and RSA key pair. • Your class map is associated with the policy map to define the virtual SSL server IP address that the destination IP address of the inbound traffic must match. • You must import a digital certificate and its corresponding public and private key pair to the desired ACE context. • At least one SSL certificate is available. • If you do not have a certificate and corresponding key pair, you can generate an RSA key pair and a certificate signing request (CSR). Create a CSR when you need to apply for a certificate from a certificate authority (CA). The CA signs the CSR and returns the authorized digital certificate to you. Note You cannot generate a CSR in Building Blocks (Config > Global > All Building Blocks); SSL CSR generation is available only in virtual context configuration. Summary of SSL Configuration Tasks Table 11-1 describes the tasks for using SSL keys and certificates. Table 11-1 SSL Key and Certificate Procedure Overview Task Description Create an SSL parameter map. Create an SSL parameter map to specify the options that apply to SSL sessions such as the method to be used to close SSL connections, the cipher suite, and version of SSL or TSL. See the “Configuring SSL Parameter Maps” section on page 11-18. Create an SSL key pair file. Create an SSL RSA key pair file to generate a CSR, create a digital signature, and encrypt packet data during the SSL handshake with an SSL peer. See the “Generating SSL Key Pairs” section on page 11-14. Configure CSR parameters. Set CSR parameters to define the distinguished name attributes of a CSR. See the “Configuring SSL CSR Parameters” section on page 11-24. Create a CSR. Create a CSR to submit with the key pair file when you apply for an SSL certificate. See the “Generating CSRs” section on page 11-26. Copy and paste the CSR into the Certificate Authority (CA) web-based application or email the CSR to the CA. Using the SSL key pair and CSR, apply for an approved certificate from a Certificate Authority. Use the method specified by the CA for submitting your request. Save the approved certificate from the CA in its received format on an FTP, SFTP, or TFTP server. When you receive the approved certificate, save it in the format in which it was received on a network server accessible via FTP, SFTP, or TFTP. 11-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL SSL Setup Sequence For more information about using SSL with ACE, see the Cisco 4700 Series Application Control Engine Appliance SSL Configuration Guide or Cisco Application Control Engine Module SSL Configuration Guide. SSL Setup Sequence The SSL setup sequence provides detailed instructions with illustrations for configuring SSL on ACE devices from ANM (Figure 11-2). The purpose of this option is to provide a visual guide for performing typical SSL operations, such as SSL CSR generation, SSL proxy creation, and so on. This option does not replace any existing SSL functions or configuration windows already present in ANM. It is only intended as an additional guide for anyone unfamiliar or unclear with the SSL operations that need to be performed on the ACE device. From the SSL setup sequence, you are allowed to configure all SSL operations, without duplicating the edit/delete/table/view operations that the other SSL configuration windows provide. The tools and operations involved in typical SSL operations are as follows: • SSL Import/Create Keys • SSL Import Certificates • SSL CSR generation • SSL proxy creation Note The SSL Setup Sequence in ANM uses the terms SSL Policies and SSL Proxy Service interchangeably. Import the approved certificate and key pair into the desired virtual context. Import the approved certificate and the associated SSL key pair into the appropriate context using ANM. For more information, see following sections: • “Importing SSL Certificates” section on page 11-7 • “Importing SSL Key Pairs” section on page 11-11 Confirm that the public key in the key pair file matches the public key in the certificate file. Examine the contents of the files to confirm that the key pair information is the same in both the key pair file and the certificate file. Configure the virtual context for SSL. See the “Configuring Traffic Policies” section on page 14-1. Configure authorization group. Create a group of certificates that are trusted as certificate signers by creating an authentication group. See the “Configuring SSL Authentication Groups” section on page 11-31. Configure CRL. See the “Configuring CRLs for Client Authentication” section on page 11-33. Table 11-1 SSL Key and Certificate Procedure Overview (continued) Task Description 11-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Using SSL Certificates For more information on SSL configuration features, see the “Summary of SSL Configuration Tasks” section on page 11-3. Figure 11-2 SSL Setup Sequence Related Topics • Configuring SSL, page 11-1 • Importing SSL Certificates, page 11-7 • Importing SSL Key Pairs, page 11-11 • Configuring SSL Parameter Maps, page 11-18 • Configuring SSL Chain Group Parameters, page 11-23 • Configuring SSL Proxy Service, page 11-27 Using SSL Certificates Digital certificates and key pairs are a form of digital identification for user authentication. Certificate Authorities issue certificates that attest to the validity of the public keys they contain. A client or server certificate includes the following identification attributes: • Name of the Certificate Authority and Certificate Authority digital signature • Name of the client or server (the certificate subject) that the certificate authenticates • Issuer • Time stamps that indicate the certificate’s start date • Time stamps that indicate the certificate’s expiration date • CA certificate A Certificate Authority has one or more signing certificates that it uses for creating SSL certificates and certificate revocation lists (CRLs). Each signing certificate has a matching private key that is used to create the Certificate Authority signature. The Certificate Authority makes the signing certificates (with the public key embedded) available to the public, enabling anyone to access and use the signing certificates to verify that an SSL certificate or CRL was actually signed by a specific Certificate Authority. Note For the ACE module A2(3.0), ACE appliance A4(1.0), or later releases of either device type, the ACE supports a maximum of eight CRLs for any context. For earlier releases of either device type, the ACE supports a maximum of four CRLs for any context. 11-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Using SSL Certificates All certificates have an expiration date, usually one year after the certificate was issued. You can monitor certificate expiration status by going to Monitor > Devices > context > Dashboard. ANM issues a warning email daily before the certificate expiration date. You establish how many days before the expiration date that the warning email messages begin in the Threshold Groups settings window, which you can access using either of the following methods: • Choose Monitor > Alarm Notifications > Thresholds Groups. • Click the Configure Certificate Expiry Threshold Alarms button in the Certificates window (Config > Devices > context > SSL > Certificates). Note The Certificates window (Config > Devices > context > SSL > Certificates) contains the Expiry Date field, which displays the certificate expiration date. Due to a known issue with the ACE module and appliance, it is possible that this field displays either “Null” or characters that are unparseable or unreadable. When this issue occurs, ANM is unable to track the certificate expiration date. If the certificate is defined in a threshold group configured for certificate expiration alarm notifications and this issue occurs, ANM may not issue an expiration alarm when expected or it may issue a false alarm. If you encounter this issue, remove the certificate from the ACE, reimport it, and then verify that the correct expiration date displays in the Certificates window. For more information about configuring the certificate expiration alarm notification, see the “Configuring Alarm Notifications on ANM” section on page 17-57. The ACE requires certificates and corresponding key pairs for the following: • SSL Termination—The ACE acts as an SSL proxy server and terminates the SSL session between it and the client. For SSL termination, you must obtain a server certificate and corresponding key pair. • SSL Initiation—The ACE acts as a client and initiates the SSL session between it and the SSL server. For SSL initiation, you must obtain a client certificate and corresponding key pair. Note The ACE includes a preinstalled sample certificate and corresponding key pair. This feature is available only for the ACE module A2(3.0), ACE appliance A4(1.0), and later releases of either device type. The certificate is for demonstration purposes only and does not have a valid domain. It is a self-signed certificate with basic extensions named cisco-sample-cert. The key pair is an RSA 1024-bit key pair named cisco-sample-key. You can display the sample certificate and corresponding key pair files as follows: • To display the cisco-sample-cert file, choose Config > Devices > context > SSL > Certificates. • To display the cisco-sample-key file, choose Config > Devices > context > SSL > Keys. You can add these files to an SSL-proxy service (see the “Configuring SSL Proxy Service” section on page 11-27) and are available for use in any context with the filenames remaining the same in each context. The ACE allows you to export these files but does not allow you to import any files with these names. When you upgrade the ACE software, these files are overwritten with the files provided in the upgrade image. You cannot use the crypto delete CLI command to delete these files unless you downgrade the ACE software because a software downgrade preserves these files as if they were user-installed SSL files. 11-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Importing SSL Certificates Related Topics • Configuring SSL, page 11-1 • Exporting SSL Certificates, page 11-15 • Importing SSL Certificates, page 11-7 • Using SSL Keys, page 11-10 • Importing SSL Key Pairs, page 11-11 • Configuring SSL CSR Parameters, page 11-24 • Generating CSRs, page 11-26 • Configuring SSL Proxy Service, page 11-27 Importing SSL Certificates You can import SSL certificates from a remote server to the ACE, which can support the following number of certificates and key pairs depending on the installed software version: • ACE Module: – A2(3.x) and earlier—3800 certificates and 3800 key pairs – A4(1.0)— 4096 certificates and 4096 key pairs • ACE Appliance: – A3(1.x) and earlier—3800 certificates and 3800 key pairs – A3(2.x) and later (including A4(1.0))—4096 certificates and 4096 key pairs Assumptions This topic assumes the following: • You have configured the ACE for server load balancing. (See the “Information About Load Balancing” section on page 7-1.) • You have obtained an SSL certificate from a certificate authority (CA) and have placed it on a network server accessible by the ACE. Note You cannot import SSL certificates in Building Blocks (Config > Global > All Building Blocks); SSL certificate imports are available only in virtual context configuration. Procedure Step 1 To configure a virtual context, choose Config > Devices > context > SSL > Certificates. The Certificates table appears, listing any valid SSL certificates. The cisco-sample-cert certificate is included in the list only for the ACE module A2(3.0), ACE appliance A4(1.0), and later releases of either device type. For information on this sample certificate, see the “Using SSL Certificates” section on page 11-5. Step 2 In the Certificates table, do one of the following: • To import a single SSL certificate, click Import. The Import dialog box appears. • To import multiple SSL certificates, click Bulk Import. The Bulk Import dialog box appears. 11-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Importing SSL Certificates Note The SSL bulk import feature is available only for ACE module A2(2.0), ACE appliance A4(1.0), or later releases of either device type. If you attempt to use the bulk import feature with an ACE that is running an earlier software version, ANM displays an invalid command detected error message and does not deploy the bulk import configuration for the ACE. Note SSL bulk import can take longer based on the number of SSL certificates being imported. It will progress to completion on the ACE. To see the imported certificates in ANM, perform a CLI Sync for this context once the SSL bulk import has completed. For information on synchronizing contexts, see the “Synchronizing Virtual Context Configurations” section on page 6-105. Step 3 Enter the applicable information: • For the Import dialog box, see Table 11-2. • For the Bulk Import dialog box, see Table 11-3 (ACE module A2(2.0), ACE appliance A4(1.0), and later releases of either device type only). Table 11-2 SSL Certificate Management Import Attributes Field Description Protocol Method to use for accessing the network server: • FTP—FTP is to be used to access the network server when importing the SSL certificate. • SFTP—SFTP is to be used to access the network server when importing the SSL certificate. • TERMINAL—You will import the file using cut and paste by pasting the certificate information to the terminal display. You can use the terminal method to display only PEM files, which are in ASCII format. • TFTP—TFTP is to be used to access the network server when importing the SSL certificate. IP Address Field that appears for FTP, TFTP, and SFTP. Enter the IP address of the remote server on which the SSL certificate file resides. Remote File Name Field that appears for single-file SSL certificate importing and FTP, TFTP, and SFTP. Enter the directory and filename of the single certificate file on the network server. Local File Name Filename to use for the single SSL certificate file when it is imported to the ACE. User Name Field that appears for FTP and SFTP. Enter the name of the user account on the network server. Password Field that appears for FTP and SFTP. Enter the password for the user account on the network server. Confirm Field that appears for FTP and SFTP. Reenter the password. Passphrase Field that appears for FTP, TFTP, SFTP, and TERMINAL. Enter the passphrase that was created with the file. Without this phrase, you cannot use the file. Passphrases are used only with encrypted PEM and PKCS files. Confirm Field that appears for FTP, SFTP, and TERMINAL. Reenter the passphrase. 11-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Importing SSL Certificates Step 4 Do one of the following: • Click OK to accept your entries and to return to the Certificates table. ANM updates the Certificates table with the newly installed certificate. • Click Cancel to exit this procedure without saving your entries and to return to the Certificates table. Non-Exportable Check box that specifies that this certificate file cannot be exported from the ACE. The ability to export SSL certificates allows you to copy signed certificates to another server on your network so that you can then import them onto another ACE or Web server. Exporting is similar to copying in that the original files are not deleted. Import Text Field that appears for Terminal. Cut the certificate information from the remote server and paste it into this field. Table 11-3 SSL Certificate Management Bulk Import Attributes Field Description Protocol SFTP is to be used to access the network server when importing the SSL certificates. SFTP is the only supported protocol for bulk import. IP Address IP address of the remote server on which the SSL certificate files reside. Remote Path Path to the SSL certificate files that reside on the remote server. The ACE fetches only files specified by the path; it does not recursively fetch remote directories. Enter a filename path including wildcards (for example, /remote/path/*.pem). The ACE supports POSIX pattern matching notation, as specified in section 2.13 of the "Shell and Utilities" volume of IEEE Std 1003.1-2004. This notation includes the "*," "?" and "[" metacharacters. To fetch all files from a remote directory, specify a remote path that ends with a wildcard character (for example, /remote/path/*). Do not include spaces or the following special characters: ;<>\|`@$&() The ACE fetches all files on the remote server that matches the wildcard criteria. However, it imports only files with names that have a maximum of 40 characters. If the name of a file exceeds 40 characters, the ACE does not import the file and discards it. User Name Name of the user account on the network server. Password Password for the user account on the network server. Confirm Password confirmation. Passphrase Passphrase that was created with the file. Without this phrase, you cannot use the file. Passphrases are used only with encrypted PEM and PKCS files. Confirm Passphrase confirmation. Non-Exportable Check box to specify that this certificate file cannot be exported from the ACE. The ability to export SSL certificates allows you to copy signed certificates to another server on your network so that you can then import them onto another ACE or Web server. Exporting is similar to copying in that the original files are not deleted. Table 11-2 SSL Certificate Management Import Attributes (continued) Field Description 11-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Using SSL Keys Related Topics • Configuring SSL, page 11-1 • Using SSL Keys, page 11-10 • Importing SSL Key Pairs, page 11-11 • Configuring SSL Parameter Maps, page 11-18 • Configuring SSL Chain Group Parameters, page 11-23 • Configuring SSL CSR Parameters, page 11-24 • Configuring SSL Proxy Service, page 11-27 Using SSL Keys You can display options for working with SSL and SSL keys. The ACE and its peer use a public key cryptographic system named Rivest, Shamir, and Adelman Signatures (RSA) for authentication during the SSL handshake to establish an SSL session. The RSA system uses key pairs that consist of a public key and a corresponding private (secret) key. During the handshake, the RSA key pairs encrypt the session key that both devices will use to encrypt the data that follows the handshake. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > SSL > Keys. • To configure a building block, choose Config > Global > building_block > SSL > Keys. The Keys table appears. Step 2 In the Keys table, continue with one of the following options: • Generate a key pair—See Generating SSL Key Pairs, page 11-14. • Import a key pair—See Importing SSL Key Pairs, page 11-11. • Export a key pair—See Exporting SSL Key Pairs, page 11-16. • Generate a CSR—See Generating CSRs, page 11-26. Related Topics • Generating SSL Key Pairs, page 11-14 • Importing SSL Key Pairs, page 11-11 • Generating SSL Key Pairs, page 11-14 • Exporting SSL Key Pairs, page 11-16 • Configuring SSL, page 11-1 11-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Using SSL Keys Importing SSL Key Pairs You can import an SSL key pair file from a network server to an ACE, which can support the following number of certificates and key pairs depending on the installed software version: • ACE Module: – A2(3.x) and earlier—3800 certificates and 3800 key pairs – A4(1.0)— 4096 certificates and 4096 key pairs • ACE Appliance: – A3(1.x) and earlier—3800 certificates and 3800 key pairs – A3(2.x) and later (including A4(1.0))—4096 certificates and 4096 key pairs Assumptions This topic assumes the following: • You have configured the ACE for server load balancing. (See the “Information About Load Balancing” section on page 7-1.) • You have obtained an SSL key pair from a certificate authority (CA) and have placed the pair on a network server accessible by the ACE. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > SSL > Keys. • To configure a building block, choose Config > Global > building_block > SSL > Keys. The Keys table appears, listing existing SSL keys. For the ACE module A2(3.0), ACE appliance A4(1.0), and later releases of both either type, the cisco-sample-key key pair is included in the list. For information on this sample key pair, see the “Using SSL Certificates” section on page 11-5. Step 2 Do one of the following: • To import a single SSL key pair, in the Keys table, click Import. The Import dialog box appears. • To import multiple SSL key pairs, click Bulk Import. The Bulk Import dialog box appears. Note The SSL bulk import feature is available only for ACE module A2(2.0), ACE appliance A4(1.0), and later releases of either device type. If you attempt to use the bulk import feature with an ACE that is running an earlier software version, ANM displays an invalid command detected error message and does not deploy the bulk import configuration for the ACE. Note SSL bulk import can take longer based on the number of SSL keys being imported. It will progress to completion on the ACE. To see the imported keys in ANM, perform a CLI Sync for this context once the SSL bulk import has completed. For information on synchronizing contexts, see the “Synchronizing Virtual Context Configurations” section on page 6-105. Step 3 Enter the applicable information as follows: 11-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Using SSL Keys • For the Import dialog box, see Table 11-4. • For the Bulk Import dialog box, see Table 11-5 (ACE module A2(2.0), ACE appliance A4(1.0), and later releases of either device type only). Table 11-4 SSL Key Pair Import Attributes Field Description Protocol Method to use for accessing the network server: • FTP—FTP is to be used to access the network server when importing the SSL key pair file. • SFTP—SFTP is to be used to access the network server when importing the SSL key pair file. • TERMINAL—You will import the file using cut and paste by pasting the certificate and key pair information to the terminal display. You can use the terminal method to display only PEM files, which are in ASCII format. • TFTP—TFTP is to be used to access the network server when importing the SSL key pair file. IP Address Field that appears for FTP, TFTP, and SFTP. Enter the IP address of the remote server on which the SSL key pair file resides. Remote File Name Field that appears for single-file SSL key pair importing and FTP, TFTP, and SFTP. Enter the directory and filename of the single key pair file on the network server. Local File Name Filename to be used for the single SSL key pair file when it is imported to the ACE. User Name This field appears for FTP and SFTP. Enter the name of the user account on the network server. Password Field that appears for FTP and SFTP. Enter the password for the user account on the network server. Confirm Field that appears for FTP, SFTP, and TERMINAL. Reenter the password. Passphrase Field that appears for FTP, TFTP, SFTP, and TERMINAL. Enter the passphrase that was created with the file. Without this phrase, you cannot use the file. Passphrases are used only with encrypted PEM and PKCS files. Confirm Field that appears for FTP and SFTP. Reenter the passphrase. Non-Exportable Check box to specify that this key pair file cannot be exported from the ACE. The ability to export SSL key pair files allows you to copy key pair files to another server on your network so that you can then import them onto another ACE or Web server. Exporting is similar to copying in that the original files are not deleted. Uncheck the check box to indicate that this key pair file can be exported from the ACE. Import Text Field that appears for Terminal. Cut the key pair information from the remote server and paste it into this field. Table 11-5 SSL Key Pair Bulk Import Attributes Field Description Protocol SFTP is to be used to access the network server when importing the SSL key pairs. SFTP is the only supported protocol for bulk import. IP Address IP address of the remote server on which the SSL key pair files resides. 11-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Using SSL Keys Step 4 Do one of the following: • Click OK to accept your entries and to return to the Keys table. ANM updates the Keys table with the imported key pair file information. • Click Cancel to exit this procedure without saving your entries and to return to the Keys table. Related Topics • Configuring SSL, page 11-1 • Importing SSL Certificates, page 11-7 • Configuring SSL Parameter Maps, page 11-18 • Configuring SSL Chain Group Parameters, page 11-23 • Configuring SSL CSR Parameters, page 11-24 • Configuring SSL Proxy Service, page 11-27 Remote Path Path to the key pair files that reside on the remote server. The ACE fetches only files specified by the path; it does not recursively fetch remote directories. Enter a filename path including wildcards (for example, /remote/path/*.pem). The ACE module supports POSIX pattern matching notation, as specified in section 2.13 of the "Shell and Utilities" volume of IEEE Std 1003.1-2004. This notation includes the "*," "?" and "[" metacharacters. To fetch all files from a remote directory, specify a remote path that ends with a wildcard character (for example, /remote/path/*). Do not include spaces or the following special characters: ;<>\|`@$&() The ACE module fetches all files on the remote server that matches the wildcard criteria. However, it imports only files with names that have a maximum of 40 characters. If the name of a file exceeds 40 characters, the ACE module does not import the file and discards it. User Name Name of the user account on the network server. Password Password for the user account on the network server. Confirm Password confirmation. Passphrase Passphrase that was created with the file. Without this phrase, you cannot use the file. Passphrases are used only with encrypted PEM and PKCS files. Confirm Passphrase confirmation. Non-Exportable Check box to specify that this certificate file cannot be exported from the ACE. The ability to export SSL key pairs allows you to copy signed certificates to another server on your network so that you can then import them onto another ACE or Web server. Exporting is similar to copying in that the original files are not deleted. Table 11-5 SSL Key Pair Bulk Import Attributes (continued) Field Description 11-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Using SSL Keys Generating SSL Key Pairs The ACE can generate SSL RSA key pairs if you do not have any matching key pairs. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > SSL > Keys. • To configure a building block, choose Config > Global > building_block > SSL > Keys. The Keys table appears. For the ACE module A2(3.0), ACE appliance A4(1.0), and later releases of either device type, the cisco-sample-key key pair is included in the list. For information about this sample key pair, see the “Using SSL Certificates” section on page 11-5. Step 2 In the Keys table, click Add to add a new key pair. The Keys configuration window appears. Note You cannot modify an existing entry in the Keys table. Instead, delete the existing entry, then add a new one. Step 3 In the Keys configuration window, enter the information in Table 11-6. Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Keys table. Table 11-6 Key Attributes Field Description Name Name of the SSL key pair. Valid entries are alphanumeric strings up to 64 characters. Size (Bits) Key pair security strength. The number of bits in the key pair file defines the size of the RSA key pair used to secure Web transactions. Longer keys produce more secure implementations by increasing the strength of the RSA security policy. Options and their relative levels of security are as follows: • 512—Least security • 768—Normal security • 1024—High security, level 1 • 1536—High security, level 2 • 2048—High security, level 3 Type RSA is a public-key cryptographic system used for authentication. Exportable Key Check box that specifies that the key pair file can be exported. Uncheck the check box to indicate that the key pair file cannot be exported. 11-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Exporting SSL Certificates • Click Next to deploy your entries and to define another RSA key pair. After generating an RSA key pair, you can do the following: • Create a CSR parameter set. The CSR parameter set defines the distinguished name attributes for the ACE to use during the CSR-generating process. For details on defining a CSR parameter set, see the “Configuring SSL CSR Parameters” section on page 11-24. • Generate a CSR for the RSA key pair file and transfer the CSR request to the certificate authority for signing. This provides an added layer of security because the RSA private key originates directly within the ACE and does not have to be transported externally. Each generated key pair must be accompanied by a corresponding certificate to work. For details on generating a CSR, see the “Generating CSRs” section on page 11-26. Related Topics • Configuring SSL, page 11-1 • Importing SSL Certificates, page 11-7 • Importing SSL Key Pairs, page 11-11 • Configuring SSL Chain Group Parameters, page 11-23 • Configuring SSL CSR Parameters, page 11-24 • Configuring SSL Proxy Service, page 11-27 Exporting SSL Certificates You can export SSL certificates from the ACE to a remote server. The ability to export SSL certificates allows you copy signed certificates to another server on your network so that you can then import them onto another ACE or Web server. Exporting certificates is similar to copying in that the original certificates are not deleted. Assumption The SSL certificate can be exported (see the “Importing SSL Certificates” section on page 11-7). Note You can export an SSL certificate in Building Blocks (Config > Global > All Building Blocks); SSL certificate export is available only in virtual context configuration. Procedure Step 1 To configure a virtual context, choose Config > Devices > context > SSL > Certificates. The Certificates table appears, listing any valid SSL certificates. The cisco-sample-cert certificate is included in the list only for the ACE module A2(3.0), ACE appliance 4(1.0), and later releases of either device type. For information about this sample certificate, see the “Using SSL Certificates” section on page 11-5. Step 2 In the Certificates table, choose the certificate you want to export, and click Export. The Export dialog box appears. 11-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Exporting SSL Certificates Step 3 In the Export dialog box, enter the information in Table 11-7. Step 4 Do one of the following: • Click OK to export the certificate and to return to the Certificates table. • Click Cancel to exit this procedure without exporting the certificate and to return to the Certificates table. Related Topics • Configuring SSL, page 11-1 • Importing SSL Certificates, page 11-7 • Importing SSL Key Pairs, page 11-11 • Generating SSL Key Pairs, page 11-14 • Configuring SSL Chain Group Parameters, page 11-23 • Configuring SSL CSR Parameters, page 11-24 • Configuring SSL Proxy Service, page 11-27 Exporting SSL Key Pairs You can export SSL key pairs from the ACE to a remote server. The ability to export SSL key pairs allows you copy SSL key pair files to another server on your network so that you can then import them onto another ACE or Web server. Exporting key pair files is similar to copying in that the original key pairs are not deleted. Table 11-7 SSL Certificate Export Attributes Field Description Protocol Method to be used for exporting the SSL certificate: • FTP—FTP is to be used to access the network server when exporting the SSL certificate. • SFTP—SFTP is to be used to access the network server when exporting the SSL certificate. • TERMINAL—You will export the certificate using cut and paste by pasting the certificate and key pair information to the terminal display. You can use the terminal method to display only PEM files, which are in ASCII format. • TFTP—TFTP is to be used to access the network server when exporting the SSL certificate. IP Address Field that appears for FTP, TFTP, and SFTP. Enter the IP address of the remote server to which the SSL certificate file is to be exported. Remote File Name Field that appears for FTP, TFTP, and SFTP. Enter the directory and filename to be used for the SSL certificate file on the remote network server. User Name Field that appears for FTP and SFTP. Enter the name of the user account on the remote network server. Password Field that appears for FTP and SFTP. Enter the password for the user account on the remote network server. Confirm Field that appears for FTP and SFTP. Reenter the password. 11-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Exporting SSL Certificates Assumption The SSL key pair can be exported (see the “Generating SSL Key Pairs” section on page 11-14). Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > SSL > Keys. • To configure a building block, choose Config > Global > building_block > SSL > Keys. The Keys table appears. For the ACE module A2(3.0) and later releases only, the cisco-sample-key key pair is included in the list. For information about this sample key pair, see the “Using SSL Certificates” section on page 11-5. Step 2 In the Keys table, choose the key entry you want to export, and click Export. The Export dialog box appears. Step 3 In the Export dialog box, enter the information in Table 11-8. Step 4 Do one of the following: • Click OK to export the key pair and to return to the Keys table. • Click Cancel to exit this procedure without exporting the key pair and to return to the Keys table. Related Topics • Configuring SSL, page 11-1 • Importing SSL Certificates, page 11-7 Table 11-8 SSL Key Export Attributes Field Description Protocol Specify the method to be used for exporting the SSL key pair: • FTP—FTP is to be used to access the network server when exporting the SSL key pair. • SFTP—SFTP is to be used to access the network server when exporting the SSL key pair. • TERMINAL—You will export the key pair using cut and paste by pasting the key pair information to the terminal display. You can use the terminal method to display only PEM files, which are in ASCII format. • TFTP—TFTP is to be used to access the network server when exporting the SSL key pair. IP Address Field that appears for FTP, TFTP, and SFTP. Enter the IP address of the remote server to which the SSL key pair is to be exported. Remote File Name Field that appears for FTP, TFTP, and SFTP. Enter the directory and filename to be used for the SSL key pair file on the remote network server. User Name Field that appears for FTP and SFTP. Enter the name of the user account on the remote network server. Password Field that appears for FTP and SFTP. Enter the password for the user account on the remote network server. Confirm Field that appears for FTP and SFTP. Reenter the password. 11-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Configuring SSL Parameter Maps • Importing SSL Key Pairs, page 11-11 • Generating SSL Key Pairs, page 11-14 • Configuring SSL Chain Group Parameters, page 11-23 • Configuring SSL CSR Parameters, page 11-24 • Configuring SSL Proxy Service, page 11-27 Configuring SSL Parameter Maps You can create SSL parameter maps., which defines the SSL session parameters that the ACE applies to an SSL proxy service. SSL parameter maps let you apply the same SSL session parameters to different proxy services. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > SSL > Parameter Map. • To configure a building block, choose Config > Global > building_block > SSL > Parameter Map. The Parameter Map table appears. Step 2 In the Parameter Map table, click Add to add a new SSL parameter map, or choose an existing entry to modify and click Edit. The Parameter Map configuration window appears. Step 3 In the Parameter Map configuration window, enter the information in Table 11-9. Table 11-9 SSL Parameter Map Attributes Field Description Name Unique name for the parameter map. Valid entries are alphanumeric strings with a maximum of 64 characters. Description Field that appears for ACE module A2(1.5), ACE appliance A3(2.3), and later releases of either device type. If you attempt to use the Description feature with an ACE that is running an earlier software version, ANM displays an invalid command detected error message and does not deploy the parameter map. Brief description of the parameter map. Enter a text string with a maximum of 240 alphanumeric characters (A–Z, a–z, 0–9). Spaces and special characters are allowed. Double quotes must be entered as matching pairs. Queue Delay Timeout (Milliseconds) Time (in milliseconds) to wait before emptying the queued data for encryption. Valid entries are 0 to 10000 milliseconds. If disabled (set to 0), the ACE encrypts the data from the server as soon as it arrives and then sends the encrypted data to the client. Note The Queue Delay Timeout is only applied to data that the SSL module sends to the client. This avoids a potentially long delay in passing a small HTTP GET to the real server. 11-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Configuring SSL Parameter Maps Session Cache Timeout (Milliseconds) Timeout value of an SSL session ID to remain valid before the ACE requires the full SSL handshake to establish a new SSL session. This feature allows the ACE to reuse the master key on subsequent connections with the client, which can speed up the SSL negotiation process. Valid entries are 0 to 72000 milliseconds. Specifying a value of 0 causes the ACE to implement a least recently used (LRU) timeout policy. By disabling this option (with the no command), the full SSL handshake occurs for each new connection with the ACE module. Reject Expired CRL Certificates Check box that instructs the ACE to reject any certificates listed on an expired CRL. Uncheck the check box to instruct the ACE to accept certificates listed on an expired CRL, which is the default setting. Close Protocol Behavior Method that the ACE uses to close the SSL connection: • Disabled—The ACE sends a close-notify alert message to the SSL peer; however, the SSL peer does not expect a close-notify alert before removing the session. Whether the SSL peer sends a close-notify alert message or not, the session information is preserved, allowing session resumption for future SSL connections. • None—The ACE does not send a close-notify alert message to the SSL peer, nor does the ACE expect a close-notify alert message from the peer. The ACE preserves the session information so that SSL resumption can be used for future SSL connections. This is the default. Note Where ACE 1.0 is already configured with the Strict option, ANM interprets it as the option None. This is due to the change in ACE 1.0 configuration (which no longer allows the Strict option). SSL Version Version of SSL be to used during SSL communications: • All—The ACE uses both SSL v3 and TLS v1 in its communications with its SSL peer. • SSL3—The ACE uses only SSL v3 in its communications with its SSL peer. • TLS1—The ACE uses only TLS v1 in its communications with its SSL peer. Table 11-9 SSL Parameter Map Attributes (continued) Field Description 11-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Configuring SSL Parameter Maps Step 4 Click the Parameter Map Cipher tab and click Add to add a cipher, or choose an existing cipher and click Edit. Enter the information in Table 11-10. Ignore Authentication Failure Option that enables the ACE to ignore expired or invalid SSL certificates and continue setting up the connection as follows: • ACE module versions 3.0(0)A2(1.1) forward and ACE appliance version A3(1.0) only—If checked, this feature enables the ACE to ignore expired or invalid server certificates and to continue setting up the back-end connection in an SSL initiation configuration. This option allows the ACE to ignore the following nonfatal errors with respect to server certificates: – Certificate not yet valid – Certificate has expired – Certificate revoked – Unknown issuer • ACE module version A2(3.0) and later only—If checked, this feature enables the ACE to ignore expired or invalid client or server certificates and to continue setting up the SSL connection. This options allows the ACE to ignore the following nonfatal errors with respect to either client certificates for SSL termination configurations, or server certificates for SSL initiation configurations: – Certificate not yet valid (both) – Certificate has expired (both) – Certificate revoked (both) – Unknown issuer (both) – No client certificate (client certificate only) – CRL not available (client certificate only) – CRL has expired (client certificate only) – Certificate has signature failure (client certificate only) – Certificate other error (client certificate only) Table 11-9 SSL Parameter Map Attributes (continued) Field Description Table 11-10 SSL Parameter Map Cipher Configuration Attributes Field Description Cipher Name Cipher to use. For more information on the SSL cipher suites that ACE supports, see the Cisco 4700 Series Application Control Engine Appliance SSL Configuration Guide or the Cisco Application Control Engine Module SSL Configuration Guide. Cipher Priority Priority that you want to assign to this cipher suite. The priority indicates the cipher’s preference for use. Valid entries are from 1 to 10 with 1 indicating the least preferred and 10 indicating the most preferred. When determining which cipher suite to use, the ACE chooses the cipher suite with the highest priority. 11-21 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Configuring SSL Parameter Maps Step 5 In the Parameter Map Cipher table, do one of the following: • Click Deploy Now to deploy the Parameter Map Cipher on the ACE and save your entries to the running-configuration and startup-configuration files • Click Cancel to exit the procedure without saving your entries and to return to the Parameter Map Cipher table. • Click Next to deploy your entries and to add another entry to the Parameter Map Cipher table. Step 6 Click the Redirect Authentication Failure tab and click Add to add a redirect or choose an existing redirect, and click Edit. Note This option is available only for the ACE module A2(3.0), ACE appliance A4(1.0), and later releases of either device type. Enter the information in Table 11-11. Note The Redirect Authentication Failure feature is only for SSL termination configurations in which the ACE performs client authentication. The ACE ignores these attributes if you configure them for an SSL initiation configuration. Table 11-11 SSL Parameter Map Redirect Configuration Attributes Field Description Client Certificate Validation Type of certificate validation failure to redirect. From the drop-down list, choose the type to redirect: • Any—Associates any of the certificate failures with the redirect. You can configure the authentication-failure redirect any command with individual reasons for redirection. When you do, the ACE attempts to match one of the individual reasons before using the any reason. You cannot configure the authentication-failure redirect any command with the authentication-failure ignore command. • Cert-expired—Associates an expired certificate failure with a redirect. • Cert-has-signature-failure—Associates a certificate signature failure with a redirect. • Cert-not-yet-valid—Associates a certificate that is not yet valid failure with the redirect. • Cert-other-error—Associates a all other certificate failures with a redirect. • Cert-revoked—Associates a revoked certificate failure with a redirect. • CRL-has-expired—Associates an expired CRL failure with a redirect. • CRL-not-available—Associates a CRL that is not available failure with a redirect. • No-client-cert—Associates no client certificate failure with a redirect. • Unknown-issuer—Associates an unknown issuer certificate failure with a redirect. Redirect Type Redirect type to use: • Server Farm—Specifies a redirect server farm for the redirect. • URL—Specifies a static URL path for the redirect. 11-22 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Configuring SSL Parameter Maps Step 7 In the Redirect Authentication Failure table, do one of the following: • Click Deploy Now to deploy the Redirect Authentication Failure table on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Redirect Authentication Failure table. • Click Next to deploy your entries and to add another entry to the Redirect Authentication Failure table. Step 8 In the Parameter Map table, do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Parameter Map table. • Click Next to deploy your entries and to add another entry to the Parameter Map table. Related Topics • Configuring SSL, page 11-1 • Importing SSL Certificates, page 11-7 • Importing SSL Key Pairs, page 11-11 • Generating SSL Key Pairs, page 11-14 • Configuring SSL Chain Group Parameters, page 11-23 • Configuring SSL CSR Parameters, page 11-24 • Configuring SSL Proxy Service, page 11-27 Server Farm Name Field that appears when the Redirect Type is set to Server Farm. ANM displays the available server farms as follows: • ACE software Version A4(1.0) or later—ANM displays all configured host and redirect server farms. • All earlier ACE software versions—ANM displays only those server farms configured as redirect server farms. Choose one of the available server farm options or click Plus (+) to open the server farm configuration popup and configure a redirect server farm (see the “Configuring Server Farms” section on page 8-30). Redirect URL Field that appears when the Redirect Type is set to URL. Specifies the static URL path for the redirect. Enter a string with a maximum of 255 characters and no spaces. Redirect Code Field appears when the Redirect Type is set to URL. Enter the redirect code that is sent back to the client: • 301—Status code for a resource permanently moving to a new location. • 302—Status code for a resource temporarily moving to a new location. Table 11-11 SSL Parameter Map Redirect Configuration Attributes Field Description 11-23 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Configuring SSL Chain Group Parameters Configuring SSL Chain Group Parameters You can configure certificate chain groups for a virtual context. A chain group specifies the certificate chains that the ACE sends to its peer during the handshake process. A certificate chain is a hierarchal list of certificates that includes the ACE’s certificate, the root certificate authority certificate, and any intermediate certificate authority certificates. Using the information provided in a certificate chain, the certificate verifier searches for a trusted authority in the certificate hierarchal list up to and including the root certificate authority. If the verifier finds a trusted authority before reaching the root certificate authority certificate, it stops searching further. Assumption At least one SSL certificate is available. Procedure Step 1 Choose Config > Devices > context > SSL > Chain Group Parameters. The Chain Group Parameters table appears. Step 2 In the Chain Group Parameters table, click Add to add a new chain group, or choose an existing chain group, and click Edit to modify it. The Chain Group Parameters configuration window appears. Step 3 In the Name field of the Chain Group Parameters configuration window, enter a unique name for the chain group. Valid entries are alphanumeric strings with a maximum of 64 characters. Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The updated Chain Group Parameters window appears along with the Chain Group Certificates table. Continue with Step 5. • Click Cancel to exit the procedure without saving your entries and to return to the Chain Group Parameters table. • Click Next to deploy your entries and to add another entry to the Chain Group Parameters table. Step 5 In the Chain Group Certificates table, click Add to add an entry. The Chain Group Certificates configuration window appears. Note You cannot modify an existing entry in the Chain Group Certificates table. Instead, delete the entry, then add a new one. Step 6 In the Certificate Name field, choose the certificate to add to this chain group. Step 7 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. 11-24 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Configuring SSL CSR Parameters • Click Cancel to exit the procedure without saving your entries and to return to the Chain Group Certificates table. • Click Next to deploy your entries and to add another certificate to this chain group table. Related Topics • Configuring SSL, page 11-1 • Importing SSL Certificates, page 11-7 • Importing SSL Key Pairs, page 11-11 • Generating SSL Key Pairs, page 11-14 • Configuring SSL Parameter Maps, page 11-18 • Configuring SSL CSR Parameters, page 11-24 • Configuring SSL Proxy Service, page 11-27 Configuring SSL CSR Parameters A certificate signing request (CSR) is a message you send to a certificate authority such as VeriSign and Thawte to apply for a digital identity certificate. The CSR contains information that identifies the SSL site, such as location and a serial number, and a public key that you choose. A corresponding private key is not included in the CSR, but is used to digitally sign the request. The CSR may be accompanied by other credentials or proofs of identity required by the certificate authority, and the certificate authority may contact the applicant for more information. If the request is successful, the certificate authority returns a digitally signed (with the private key of the certificate authority) identity certificate. CSR parameters define the distinguished name attributes the ACE applies to the CSR during the CSR-generating process. These attributes provide the certificate authority with the information it needs to authenticate your site. Defining a CSR parameter set lets you to generate multiple CSRs with the same distinguished name attributes. Each context on the ACE can contain up to eight CSR parameter sets. Use this procedure to define the distinguished name attributes for SSL CSRs. Procedure Step 1 Choose the item to configure: • To configure a virtual context, choose Config > Devices > context > SSL > CSR Parameters. • To configure a building block, choose Config > Global > building_block > SSL > CSR Parameters. The CSR Parameters table appears. Step 2 In the CSR Parameters table, click Add to add new set of CSR attributes, or choose an existing entry to modify and click Edit. The CSR Parameters configuration window appears. 11-25 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Configuring SSL CSR Parameters Step 3 In the CSR Parameters configuration window, enter the information in Table 11-12. Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the CSR Parameters table. • Click Next to deploy your entries and to define another set of CSR attributes. Related Topics • Configuring SSL, page 11-1 • Importing SSL Certificates, page 11-7 • Importing SSL Key Pairs, page 11-11 • Configuring SSL Parameter Maps, page 11-18 • Configuring SSL Chain Group Parameters, page 11-23 • Configuring SSL Proxy Service, page 11-27 Table 11-12 SSL CSR Parameter Attributes Field Description Name Unique name for this parameter set. Valid entries are alphanumeric strings with a maximum of 64 characters. Country Name of the country where the SSL site resides. Valid entries are 2 alphabetic characters representing the country, such as US for the United States. The International Organization for Standardization (ISO) maintains the complete list of valid country codes on its Web site (www.iso.org). State Name of the state or province where the SSL site resides. Locality Name of the city where the SSL site resides. Common Name Name of the domain or host of the SSL site. Valid entries are strings with a maximum of 64 characters. Special characters are allowed. Serial Number Serial number to assign to the certificate. Valid entries are alphanumeric strings with a maximum of 16 characters. Organization Name Name of the organization to include in the certificate. Valid entries are alphanumeric strings with a maximum of 64 characters. Email Site email address. Valid entries are text strings, including alphanumeric and special characters (for example, @ symbol in email address) with a maximum of 40 characters. Organization Unit Name of the organization to include in the certificate. Valid entries are alphanumeric strings with a maximum of 64 characters. 11-26 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Configuring SSL CSR Parameters Generating CSRs You can generate an SSL certificate signing request (CSR), which is a message that you send to a certificate authority such as VeriSign and Thawte to apply for a digital identity certificate. Create a CSR when you need to apply for a certificate from a certificate authority. When the certificate authority approves a request, it signs the CSR and returns the authorized digital certificate to you. This certificate includes the private key of the certificate authority. When you receive the authorized certificate and key pair, you can import them for use (see the “Importing SSL Certificates” section on page 11-7 and the “Importing SSL Key Pairs” section on page 11-11). Note You cannot generate a CSR in Building Blocks (Config > Global > All Building Blocks); SSL CSR generation is available only in virtual context configuration. Assumption You have configured SSL CSR parameters (see the “Configuring SSL CSR Parameters” section on page 11-24). Procedure Step 1 Choose Config > Devices > context > SSL > Keys. The Keys table appears. Step 2 In the Keys table, choose a key and click Generate CSR. The Generate a Certificate Signing Request dialog box appears. Step 3 In the CSR Parameter field of the Generate a Certificate Signing Request dialog box, choose the CSR parameter to be used. Step 4 Do one of the following: • Click OK to generate the CSR. The CSR appears in a popup window which you can now submit to a certificate authority for approval. Work with your certificate authority to determine the method of submission, such as email or a Web-based application. Click Close to close the popup window and to return to the Keys table. • Click Cancel to exit this procedure without generating the CSR and to return to the Keys table. Related Topics • Configuring SSL, page 11-1 • Importing SSL Certificates, page 11-7 • Importing SSL Key Pairs, page 11-11 • Configuring SSL Parameter Maps, page 11-18 • Configuring SSL Chain Group Parameters, page 11-23 • Configuring SSL Proxy Service, page 11-27 11-27 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Configuring SSL Proxy Service Configuring SSL Proxy Service You can configure an SSL proxy service that defines the SSL parameter map, key pair, certificate, and chain group the ACE uses during SSL handshakes. By configuring an SSL proxy server service on the ACE, the ACE can act as an SSL server. Assumption You have configured at least one SSL key pair, certificate, chain group, or parameter map to apply to this proxy service. Procedure Step 1 Choose Config > Devices > context > SSL > Proxy Service. The Proxy Service table appears. Step 2 In the Proxy Service table, click Add to add a new proxy service, or choose an existing service and click Edit to modify it. The Proxy Service configuration window appears. Step 3 In the Proxy Service configuration window, enter the information in Table 11-13. Table 11-13 SSL Proxy Service Attributes Field Description Proxy Service Name Unique name for this proxy service. Valid entries are alphanumeric strings with a maximum of 40 to 65 characters, depending on your ACE and hardware version. Keys Key pair that the ACE is to use during the SSL handshake for data encryption. Caution When choosing the key pair from the drop-down list, be sure to choose the keys that correspond to the certificate that you choose. Note If you use SSL Setup Sequence to create the proxy service, ANM selects the keys that correspond to the certificate that you choose. If ANM cannot detect a corresponding key pair, you can select a key pair from the drop-down list and click Verify Key to have ANM verify that the keys correspond to the selected certificate. ANM displays a message to let you know that your key pair selection either matches or does not match the selected certificate. For more information about SSL Setup Sequence, see the “SSL Setup Sequence” section on page 11-4. The cisco-sample-key option is available for the ACE module A2(3.0) and later releases only. For information about this sample key pair, see the “Using SSL Certificates” section on page 11-5. 11-28 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Configuring SSL Proxy Service Certificates Certificate that the ACE is to use during the SSL handshake to prove its identity. Caution When choosing the certificate from the drop-down list, be sure to choose the certificate that corresponds to the keys that you choose. Note If you use SSL Setup Sequence to create the proxy service, ANM selects the keys that correspond to the certificate that you choose. If ANM cannot detect a corresponding key pair, you can select a key pair from the drop-down list and click Verify Key to have ANM verify that the keys correspond to the selected certificate. ANM displays a message to let you know that your key pair selection either matches or does not match the selected certificate. For more information about SSL Setup Sequence, see the “SSL Setup Sequence” section on page 11-4. The cisco-sample-cert option is available only for the ACE module A2(3.0), ACE appliance A4(1.0), and later releases of either device type. For information about this sample certificate, see the “Using SSL Certificates” section on page 11-5. Chain Groups Chain group that the ACE is to use during the SSL handshake. To create a chain group, see the “Configuring SSL Chain Group Parameters” section on page 11-23. Auth Groups Authorization group name that the ACE is to use during the SSL handshake. To create an authorization group, see the “Configuring SSL Authentication Groups” section on page 11-31. CRL Best-Effort Field that displays only when Auth Groups is selected. Allows ANM to search client certificates for the service to determine if it contains a CRL in the extension. ANM then retrieves the value, if it exists. CRL Name Field that displays only when Auth Groups is selected. Do one of the following: • Choose N/A when the CRL name is not applicable. • Choose the CRL name that the ACE used for authentication. OCSP Best-Effort Field that displays for ACE module or appliance software Version A5(1.0) or later, and when Auth Groups is selected. Check the OCSP Best-Effort checkbox to allow the ACE appliance to extract the extension to find the OCSP server information from the certificate itself where, from the revocation status, information about the certificate could be obtained. If this extension is missing from the certificate and the best effort OCSP server information is configured with the SSL proxy, the cert is considered revoked. Uncheck the checkbox to display the OCSP server field to choose the available OCSP server. OCSP Servers Field that displays for ACE module or appliance software Version A5(1.0) or later, and when the OCSP Best-Effort checkbox is unchecked. Choose the available OCSP server. Table 11-13 SSL Proxy Service Attributes (continued) Field Description 11-29 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Configuring SSL OCSP Service Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Proxy Service table. • Click Next to deploy your entries and to add another proxy service. • Click Delete to remove this configuration on the ACE. Note When an authorization group is deleted, the CRL Name object (if it exists) is deleted automatically. Related Topics • Configuring SSL, page 11-1 • Importing SSL Certificates, page 11-7 • Importing SSL Key Pairs, page 11-11 • Configuring SSL Parameter Maps, page 11-18 • Configuring SSL Chain Group Parameters, page 11-23 • Configuring SSL CSR Parameters, page 11-24 Configuring SSL OCSP Service Note The SSL Online Certificate Status Protocol feature requires ACE module and ACE appliance software Version A5(1.0) or later. SSL Online Certificate Status Protocol (OCSP) service defines the host server for certificate revocation checks using OCSP. The OCSP server, also known as the OCSP responder, maintains or obtains the information about the certificates issued by different CAs that are revoked and possibly non-revoked, Parameter Maps SSL parameter map to associate with this SSL proxy server service. Revocation Check Priority Order Field that displays for ACE module or appliance software Version A5(1.0) or later. Priority setting for the revocation check. Choose one of the following: • N/A—Indicates that this field is not applicable. • CRL-OCSP—The ACE uses the CRLs first to determine the revocation status, and then the OCSP servers. • OCSP-CRL—The ACE uses the OCSP servers first to determine the revocation status, and then the CRLs. Table 11-13 SSL Proxy Service Attributes (continued) Field Description 11-30 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Configuring SSL OCSP Service and provides this information when requested by OCSP clients. OCSP can provide latest information about the revocation status of the certificate. Use of OCSP removes the need to download and cache the CRLs which could be very large in sizes and impose large memory requirements on systems. You can configure a maximum of 64 OCSP server configurations system-wide on the ACE. You can configure all of these servers in a single or multiple contexts. Use this procedure to define the attributes that the ACE appliance is to use during SSL handshakes so that it can act as an SSL server. Assumption Configure OCSP on an associated proxy service. You can configure both OCSP and CRLs for authentication. Procedure Step 1 Select Config > Devices > context > SSL > OCSP Service. The OCSP Service table appears. Step 2 Click Add to add a new OCSP service, or select an existing service, then click Edit to modify it. The OCSP Service configuration screen appears. Step 3 In the Name field, enter a unique name for this OCSP service. Valid entries are alphanumeric strings with a maximum of 64 characters. This name is used when you apply this configuration to an SSL proxy service. Step 4 In the URL field, enter an HTTP based URL for the OCSP host name and optional port ID in the form of http://ocsp_hostname.com:port_id. If you do not specify a port ID, the ACE uses the default value of 2560. Step 5 Optionally, in the Request Signer’s Certificate field, you can select a filename for the signer certificate to sign the requests to the server. By default, the request is not signed. Step 6 Optionally, in the Response Signer’s Certificate field, you can select a filename for the signer certificate to verify the signature on the server responses. By default, the responses are not verified. Step 7 Check the Enable Nonce check box to enable the inclusion of the nonce in the requests to the server. By default, nonce is disabled. Clear the checkbox to disable the inclusion of the nonce in requests to the server. Step 8 In the TCP Connection Inactivity Timeout field, enter an integer from 2 to 3600 to specify the TCP connection inactivity timeout in seconds. The default is 300 seconds. Step 9 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE appliance. • Click Cancel to exit this procedure without saving your entries and to return to the OCSP Service table. • Click Next to save your entries and to add another proxy service. Related Topics • Configuring SSL, page 11-1 • Configuring SSL Proxy Service, page 11-27 11-31 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Enabling Client Authentication Enabling Client Authentication During the flow of a normal SSL handshake, the SSL server sends its certificate to the client. Then the client verifies the identity of the server through the certificate. However, the client does not send any identification of its own to the server. When you enable the client authentication feature on the ACE, it will require that the client send a certificate to the server. Then the server verifies the following information on the certificate: • A recognized CA issued the certificate. • The valid period of the certificate is still in effect. • The certificate signature is valid and not tampered. • The CA has not revoked the certificate. • At least one SSL certificate is available. Use the following procedures to enable or disable client authentication: • Configuring SSL Proxy Service, page 11-27 • Configuring SSL Authentication Groups, page 11-31 • Configuring CRLs for Client Authentication, page 11-33 Configuring SSL Authentication Groups You can specify the certificate authentication groups that the ACE uses during the SSL handshake and enable client authentication on this SSL-proxy service. The ACE includes the certificates configured in the group along with the certificate that you specified for the SSL proxy service. On the ACE, you can implement a group of certificates that are trusted as certificate signers by creating an authentication group. After creating the authentication group and assigning its certificates, then you can assign the authentication group to a proxy service in an SSL termination configuration to enable client authentication. For information on client authentication, see the “Enabling Client Authentication” section on page 11-31. For information on server authentication and assigning an authentication group, see the “Configuring SSL Proxy Service” section on page 11-27. Note You cannot create an authorization group in Building Blocks (Config > Global > All Building Blocks); You can only create SSL authentication groups while configuring virtual contexts in specific modules. Assumptions • At least one SSL certificate is available. • Your ACE supports authentication groups. See the Supported Devices Table for Cisco Application Networking Manager for details. Procedure Step 1 Choose Config > Devices > context > SSL > Auth Group Parameters. The Auth Group Parameters table appears. 11-32 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Enabling Client Authentication Step 2 In the Auth Group Parameters table, click Add to add an authentication group, or choose an existing authorization group and click Edit to modify it. The Auth Group Parameters configuration window appears. Step 3 In the Name field of the Auth Group Parameters configuration window, enter a unique name for the authorization group. Valid entries are alphanumeric strings with a maximum of 64 characters. Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The updated Auth Group Parameters window appears along with the Auth Group Certificates table. Continue with Step 5. • Click Cancel to exit the procedure without saving your entries and to return to the Auth Group Parameters table. • Click Next to deploy your entries and to add another entry to the Auth Group Parameters table. Step 5 In the Auth Group Certificate field, click Add to add an entry. The Auth Group Certificates configuration window appears. Note You cannot modify an existing entry in the Auth Group Certificates table. Instead, delete the entry, then add a new one. Step 6 In the Certificate Name field, choose the certificate to add to this authorization group. Step 7 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Auth Group Parameters table. • Click Next to deploy your entries and to add another entry to the Auth Group Parameters table. Step 8 You can repeat the previous step to add more certificates to the authorization group or click Deploy Now. Step 9 After you configure authorization group parameters, you can configure the SSL proxy service to use a CRL. See the “Configuring CRLs for Client Authentication” section on page 11-33. Note When you enable client authentication, a significant performance decrease may occur. Additional latency may occur when you configure CRL retrieval. Related Topics • Configuring SSL Chain Group Parameters, page 11-23 • Configuring CRLs for Client Authentication, page 11-33 11-33 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Enabling Client Authentication Configuring CRLs for Client Authentication You can configure the ACE to scan for CRLs and retrieve them. By default, ACE does not use certificate revocation lists (CRLs) during client authentication. You can configure the SSL proxy service to use a CRL by having the ACE scan each client certificate for the service to determine if it contains a CRL in the extension and then retrieve the value, if it exists. For more information about SSL termination on the ACE, see either the Cisco Application Control Engine Module SSL Configuration Guide or the Cisco ACE 4700 Series Appliance SSL Configuration Guide. Note The ACE supports the creation of a maximum of eight CRLs for any context. Note When you enable client authentication, a significant performance decrease may occur. Additional latency may occur when you configure CRL retrieval. Assumption A CRL cannot be configured on an SSL proxy without first configuring an authorization group. Procedure Step 1 Choose Config > Devices > context > SSL > Certificate Revocation Lists (CRLs). The Certificate Revocation Lists (CRLs) table appears. Step 2 In the Certificate Revocation Lists (CRLs) table, click Add to add a CRL, or choose an existing CRL and click Edit to modify it. The Certificate Revocation Lists (CRLs) window appears. Step 3 In the Certificate Revocation Lists (CRLs) window, enter the information in Table 11-14. Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The updated Certificate Revocation Lists (CRLs) table appears. • Click Cancel to exit the procedure without saving your entries and to return to the Certificate Revocation Lists (CRLs) table. • Click Next to deploy your entries and to add another entry to the Certificate Revocation Lists (CRLs) table. Table 11-14 SSL Certificate Revocation List Field Description Name CRL name. Valid entries are unquoted alphanumeric strings with a maximum of 64 characters. URL URL where the ACE retrieves the CRL. Valid entries are unquoted alphanumeric strings with a maximum of 255 characters. Only HTTP URLs are supported. ACE checks the URL and displays an error if it does not match. 11-34 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 11 Configuring SSL Enabling Client Authentication Related Topics • Configuring SSL Proxy Service, page 11-27 • Configuring SSL Authentication Groups, page 11-31 CHAPTER 12-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 12 Configuring Network Access Date: 3/28/12 This chapter describes how to configure network access using Cisco Application Networking Manager (ANM). Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • Information About VLANs, page 12-2 • Configuring VLANs Using Cisco IOS Software (ACE Module), page 12-3 • Configuring Virtual Context VLAN Interfaces, page 12-6 • Configuring Virtual Context BVI Interfaces, page 12-19 • Configuring VLAN Interface NAT Pools, page 12-26 • Configuring Virtual Context Static Routes, page 12-28 • Configuring Global IP DHCP, page 12-29 • Configuring Static VLANs for Over 8000 Static NAT Configurations, page 12-31 • Configuring Gigabit Ethernet Interfaces on the ACE Appliance, page 12-32 • Configuring Port-Channel Interfaces for the ACE Appliance, page 12-35 12-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Information About VLANs Information About VLANs This section provides an overview of how the ACE module and appliance use VLANs. This section includes the following topics: • ACE Module VLANs, page 12-2 • ACE Appliance VLANs, page 12-2 ACE Module VLANs The ACE module does not include any external physical interfaces to receive traffic from clients and servers. Instead, it uses internal VLAN interfaces. You assign VLANs from the supervisor engine to the ACE. After the VLANs are assigned to the ACE, you can configure the corresponding VLAN interfaces on the ACE as either routed or bridged for use. When you configure an IP address on an interface, the ACE automatically makes it a routed mode interface. Similarly, when you configure a bridge group on an interface VLAN, the ACE automatically makes it a bridged interface. Then, you associate a bridge-group virtual interface (BVI) with the bridge group. For more information on bridged groups and BVIs, see the “Configuring Virtual Context BVI Interfaces” section on page 12-19. The ACE also supports shared VLANS, which are multiple interfaces in different contexts on the same VLAN within the same subnet. Only routed interfaces can share VLANs. Note that there is no routing across contexts even when shared VLANs are configured. Related Topics • Configuring VLANs Using Cisco IOS Software (ACE Module), page 12-3 • Configuring Virtual Context VLAN Interfaces, page 12-6 • Configuring Virtual Context BVI Interfaces, page 12-19 • Configuring Virtual Context Static Routes, page 12-28 • Configuring Global IP DHCP, page 12-29 ACE Appliance VLANs The ACE appliance has four physical Ethernet interface ports. All VLANs are allocated to the physical ports. After the VLANs are assigned, you can configure the corresponding VLAN interfaces as either routed or bridged for use. When you configure an IP address on an interface, the ACE appliance automatically makes it a routed mode interface. Similarly, when you configure a bridge group on an interface VLAN, the ACE appliance automatically makes it a bridged interface. Then, you associate a BVI with the bridge group. The ACE appliance also supports shared VLANs, which are multiple interfaces in different contexts on the same VLAN within the same subnet. Only routed interfaces can share VLANs. Note that there is no routing across contexts even when shared VLANs are configured. In routed mode, the ACE is considered a router hop in the network. In the Admin or user contexts, the ACE supports static routes only. The ACE supports up to eight equal cost routes for load balancing. 12-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring VLANs Using Cisco IOS Software (ACE Module) Related Topics • Configuring Virtual Context VLAN Interfaces, page 12-6 • Configuring Virtual Context BVI Interfaces, page 12-19 • Configuring Gigabit Ethernet Interfaces on the ACE Appliance, page 12-32 • Configuring Port-Channel Interfaces for the ACE Appliance, page 12-35 Configuring VLANs Using Cisco IOS Software (ACE Module) To allow the ACE module to receive traffic from the supervisor engine in the Catalyst 6500 series switch or Cisco 7600 series router, you must create VLAN groups on the supervisor engine and then assign the groups to the ACE module. After the VLAN groups are assigned to the ACE module, you can configure the VLAN interfaces on the ACE module. By default, all VLANs are allocated to the Admin context on the ACE module. This section includes the following topics: • Creating VLAN Groups Using Cisco IOS Software • Assigning VLAN Groups to the ACE Module Through Cisco IOS Software • Adding Switched Virtual Interfaces to the MSFC Creating VLAN Groups Using Cisco IOS Software In Cisco IOS software, you can create one or more VLAN groups and then assign the groups to the ACE module. For example, you can assign all the VLANs to one group, create an inside group and an outside group, or create a group for each customer. You cannot assign the same VLAN to multiple groups; however, you can assign up to a maximum of 16 groups to an ACE. VLANs that you want to assign to multiple ACEs, for example, can reside in a separate group from VLANs that are unique to each ACE. To assign VLANs to a group using Cisco IOS software on the supervisor engine, use the svclc vlan-group command. The syntax of this command is as follows: svclc vlan-group group_number vlan_range The arguments are as follows: • group_number—Number of the VLAN group. • vlan_range—One or more VLANs (2 to 1000 and 1025 to 4094) identified in one of the following ways: – A single number (n) – A range (n-x) Separate numbers or ranges by commas, as shown in this example: 5,7-10,13,45-100 For example, to create three VLAN groups, 50 with a VLAN range of 55 to 57, 51 with a VLAN range of 75 to 86, and 52 with VLAN 100, enter: Router(config)# svclc vlan-group 50 55-57 Router(config)# svclc vlan-group 51 70-86 12-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring VLANs Using Cisco IOS Software (ACE Module) Router(config)# svclc vlan-group 52 100 Related Topics • Assigning VLAN Groups to the ACE Module Through Cisco IOS Software, page 12-4 • Adding Switched Virtual Interfaces to the MSFC, page 12-5 Assigning VLAN Groups to the ACE Module Through Cisco IOS Software The ACE module cannot receive traffic from the supervisor engine unless you assign VLAN groups to it. To assign the VLAN groups to the ACE module using Cisco IOS software on the supervisor engine, use the svc module command in configuration mode. The syntax of this command is as follows: svc module slot_number vlan-group group_number_range The arguments are as follows: • slot_number—Slot number where the ACE module resides. To display slot numbers and the devices in the chassis, use the show module command in Exec mode. The ACE module appears as the Application Control Engine Module in the Card Type field. • group_number_range—One or more group numbers that are identified in one of the following ways: – A single number (n) – A range (n-x) Separate numbers or ranges by commas, as shown in this example: 5,7-10 For example, to assign VLAN groups 50 and 52 to the ACE module in slot 5, and VLAN groups 51 and 52 to the ACE module in slot 8, enter the following commands: Router(config)# svc module 5 vlan-group 50,52 Router(config)# svc module 8 vlan-group 51,52 To view the group configuration for the ACE module and the associated VLANs, use the show svclc vlan-group command. For example, enter the following commands: Router(config)# exit Router# show svclc vlan-group To view VLAN group numbers for all devices, use the show svc module command. For example, enter the following command: Router# show svc module Note Enter the show vlans command in Exec mode from the Admin context to display the ACE module VLANs that are downloaded from the supervisor engine. Related Topics • Creating VLAN Groups Using Cisco IOS Software, page 12-3 • Adding Switched Virtual Interfaces to the MSFC, page 12-5 12-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring VLANs Using Cisco IOS Software (ACE Module) Adding Switched Virtual Interfaces to the MSFC A VLAN defined on the Multilayer Switch Feature Card (MSFC) is called a switched virtual interface (SVI). If you assign the VLAN used for the SVI to the ACE module, then the MSFC routes between the ACE module and other Layer 3 VLANs. By default, only one SVI can exist between the MSFC and the ACE. However, for multiple contexts, you may configure multiple SVIs for unique VLANs on each context. Procedure: Step 1 (Optional) If you need to add more than one SVI to the ACE module, enter the following command: Router(config)# svclc multiple-vlan-interfaces Step 2 Add a VLAN interface to the MSFC. For example, to add VLAN 55, enter the following command: Router(config)# interface vlan 55 Step 3 Set the IP address for this interface on the MSFC. For example, to set the address 10.1.1.1 255.255.255.0, enter the following command: Router(config-if)# ip address 10.1.1.1 255.255.255.0 Step 4 Enable the interface. For example, enter the following command: Router(config-if)# no shut Note To monitor any VLAN that is associated with more than two trunk ports, physical ports, or trunk-physical ports on the supervisor engine, enable the autostate feature by using the svclc autostate command. When you associate a VLAN to these ports, autostate declares that the VLAN is up. When a VLAN state change occurs on the supervisor engine, autostate sends a notification to the ACE module to bring the interface up or down. To view this SVI configuration, use the show interface vlan command. For example, enter the following command: Router# show int vlan 55 Related Topics • Creating VLAN Groups Using Cisco IOS Software, page 12-3 • Assigning VLAN Groups to the ACE Module Through Cisco IOS Software, page 12-4 12-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context VLAN Interfaces Configuring Virtual Context VLAN Interfaces You can configure VLAN interfaces for virtual contexts on the ACE. Note The options that appear when you choose Config > Devices > context depend on the device associated with the virtual context and the role associated with your account. Assumptions This topic assumes the following: • A Layer 3/Layer 4 or Management policy map has been configured for this virtual context. For more information, see the “Configuring Traffic Policies” section on page 14-1. • An access control list has been configured for this virtual context. Entering an ACL name does not configure the ACL; you must configure the ACL on the ACE appliance. For more information, see the “Configuring Security with ACLs” section on page 6-78. Procedure Step 1 Choose Config > Devices > context > Network > VLAN Interfaces. The VLAN Interface table appears. Step 2 In the VLAN Interface table, click Poll Now to instruct ANM to poll the devices and display the current values and click OK when prompted if you want to poll the devices for data now. Step 3 Click Add to add a new VLAN interface, or choose an existing VLAN interface and click Edit to modify it. Note If you click Edit, not all of the fields can be modified. Step 4 Enter the VLAN interface attributes (see Table 12-1). Click More Settings to access the additional VLAN interface attributes. By default, ANM hides the default VLAN interface attributes and the VLAN interface attributes that are not commonly used. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Note If you create a fault-tolerant VLAN, do not use it for any other network traffic. Table 12-1 VLAN Interface Attributes Field Description VLAN VLAN identifier. Either accept the automatically incremented entry or enter a different value. Valid entries are from 2 to 4094. Description Brief description for this interface. 12-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context VLAN Interfaces Interface Type Role of the virtual context in the network topology of the VLAN interface: • Routed—In a routed topology, the ACE virtual context acts as a router between the client-side network and the server-side network. In this topology, every real server for the application must be routed through the ACE virtual context, either by setting the default gateway on each real server to the virtual contexts server-side VLAN interface address, or by using a separate router with appropriate routes configured between the ACE virtual context and the real servers. Note A routed VLAN interface can support both IPv4 and IPv6 addresses at the same time. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. • Bridged—In a bridged topology, the ACE virtual context bridges two VLANs, a client-side VLAN and a real-server VLAN, on the same subnet using a bridged virtual interface (BVI). In this case, the real server routing does not change to accommodate the ACE virtual context. Instead, the ACE virtual context becomes a “bump in the wire” that transparently handles traffic to and from the real servers. • Unknown—Choose Unknown if you are unsure of the network topology of the VLAN interface. IP Address Field that appears for the Routed Interface Type. Enter the IPv4 address assigned to this interface. This address must be a unique IP address that is not used in another context. Duplicate IP addresses in different contexts are not supported. If this interface is only used for IPv6 traffic, entering an IPv4 address is optional. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Alias IP Address Field that appears for the Routed interface type. Enter the IPv4 address of the alias that this interface is associated with. Peer IP Address Field that appears for the Routed interface type. Enter the IPv4 address of the remote peer. Netmask Field that appears for the Routed interface type. Choose the subnet mask to be used. BVI Field that appears for the Bridged interface type. Enter the number of the bridge group to be configured on this VLAN. When you configure a bridge group on a VLAN, the ACE automatically makes it bridged. Valid entries are from 1 to 4094. Admin Status Administrative state of the interface. Specify whether you want the interface to be Up or Down. Enable MAC Sticky Check box that instructs the ACE to convert dynamic MAC addresses to sticky secure MAC addresses and to add this information to the running configuration. Uncheck the check box to indicate that the ACE is not to convert dynamic MAC addresses to sticky secure MAC addresses. Table 12-1 VLAN Interface Attributes (continued) Field Description 12-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context VLAN Interfaces Enable Normalization Check box that specifies that normalization is to be enabled on this interface. Uncheck the check box to indicate that normalization is to be disabled on this interface for IPv4, IPv6, or both. The IPv6 option requires ACE module and ACE appliance software Version A5(1.0) or later. Caution Disabling normalization may expose your ACE and network to potential security risks. Normalization protects your networking environment from attackers by enforcing strict security policies that are designed to examine traffic for malformed or malicious segments. Enable IPv6 Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later, and for the Routed interface type. Check the check box to enable IPv6 on this interface. By default, IPv6 is disabled. The interface cannot be in bridged mode. When you enable IPv6, the ACE automatically does the following: • Configures a link-local address (if not previously configured) • Performs duplicate address detection (DAD) Clear the check box to indicate that IPv6 is disabled on this interface. IPv6 Global Address Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later, and for the Routed interface type. A global address is an IPv6 unicast address that is used for general IPv6 communication. Each global address is unique across the entire Internet. Therefore, its scope is global. The low order 64 bits can be assigned in several ways, including autoconfiguration using the EUI-64 format. You can configure only one globally unique IPv6 address on an interface. When you configure a global IPv6 address on an interface, the ACE automatically does the following: • Configures a link-local address (if not previously configured) • Performs duplicate address detection (DAD) on both addresses IPv6 Address To configure an IPv6 global address on an interface, enter a complete IPv6 address with a prefix of 2000::/3 to 3fff::/3. For example, enter 2001:DB8:1::0. Check the EUI-64 box to specify that the low order 64 bits are automatically generated in the IEEE 64-bit Extended Unique Identifier (EUI-64) format specified in RFC 2373. To use EUI-64, the Prefix Length field must be less than or equal to 64 and the host segment must be all zeros. Alias IPv6 Address When you configure redundancy with active and standby ACEs, you can configure a VLAN interface that has an alias global IPv6 address that is shared between the active and standby ACEs. The alias IPv6 address serves as a shared gateway for the two ACEs in a redundant configuration. You can configure only one alias global IPv6 address on an interface. To configure an IPv6 alias global address, enter a complete IPv6 address with a prefix of 2000::/3 to 3fff::/3. For example, enter 2001:DB8:1::0. Note You must configure redundancy (fault tolerance) on the ACE for the alias global IPv6 address to work. Table 12-1 VLAN Interface Attributes (continued) Field Description 12-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context VLAN Interfaces Peer IPv6 Address To configure an IPv6 peer global address, enter a complete IPv6 address with a prefix of 2000::/3 to 3fff::/3. For example, enter 2001:DB8:1::0. Check the EUI-64 box to specify that the low order 64 bits are automatically generated in the IEEE 64-bit Extended Unique Identifier (EUI-64) format specified in RFC 2373. To use EUI-64, the Prefix Length field must be less than or equal to 64 and the host segment must be all zeros. Note The IPv6 peer global address must be unique across multiple contexts on a shared VLAN. Check the EUI-64 box to specify that the low order 64 bits are automatically generated in the IEEE 64-bit Extended Unique Identifier (EUI-64) format specified in RFC 2373. To use EUI-64, the Prefix Length field must be less than or equal to 64 and the host segment must be all zeros. Prefix Length Enter the prefix length for all global addresses to specify how many of the most significant bits (MSBs) are used for the network identifier. Enter an integer from 3 to 127. If you use the optional EUI-64 check box for the global and peer addresses, the prefix must be less than or equal to 64. IPv6 Unique-Local Address Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later, and for the Routed interface type. A unique local address is an optional IPv6 unicast address that is used for local communication within an organization and it is similar to a private IPv4 address (for example, 10.10.2.1). Unique local addresses have a global scope, but they are not routable on the internet, and they are assigned by a central authority. All unique local addresses have a predefined prefix of FC00::/7. You can configure only one IPv6 unique local address on an interface. IPv6 Address To configure a unique local address, enter a complete IPv6 address with an FC00::/7 prefix in the first field. In the second field after the /, enter the prefix length to specify how many of the most significant bits (MSBs) are used for the network identifier. Check the EUI-64 box to specify that the low order 64 bits are automatically generated in the IEEE 64-bit Extended Unique Identifier (EUI-64) format specified in RFC 2373. To use EUI-64, the Prefix Length field must be less than or equal to 64 and the host segment must be all zeros. Peer IPv6 Address In a redundant configuration, you can configure an IPv6 peer unique local address on the active that is synchronized to the standby ACE. You can configure only one peer unique local IPv6 address on an interface. To configure a peer unique local address, enter a complete IPv6 address with an FC00::/7 prefix in the first field. In the second field after the /, enter the prefix length to specify how many of the most significant bits (MSBs) are used for the network identifier. Note The IPv6 peer unique local address must be unique across multiple contexts on a shared VLAN. Check the EUI-64 box to specify that the low order 64 bits are automatically generated in the IEEE 64-bit Extended Unique Identifier (EUI-64) format specified in RFC 2373. To use EUI-64, the Prefix Length field must be less than or equal to 64 and the host segment must be all zeros. Prefix Length Enter the prefix length for all unique-local addresses to specify how many of the most significant bits (MSBs) are used for the network identifier. Enter an integer from 7 to 127. If you use the optional EUI-64 check box for the global and peer addresses, the prefix must be less than or equal to 64. Table 12-1 VLAN Interface Attributes (continued) Field Description 12-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context VLAN Interfaces IPv6 Link-Local Address Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later, and for the Routed interface type. By default, when you enable IPv6 or configure a global IPv6 address on an interface, the ACE automatically creates a link local address for it. Every link local address must have a predefined prefix of FE80::/10. You can configure only one IPv6 link local address on an interface. This address always has the prefix of 64. To manually configure the link local address, enter a complete IPv6 address with an FE80::/10 prefix in this field. For example, enter FE80:DB8:1::1. IPv6 Peer Link-Local Address Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later, and for the Routed interface type. In a redundant configuration, you can configure an IPv6 peer link local address for the standby ACE. You can configure only one peer link local address on an interface. To configure the peer link local address, enter a complete IPv6 address with an FE80::/10 prefix in this field. Note The IPv6 peer link local address must be unique across multiple contexts on a shared VLAN. Table 12-1 VLAN Interface Attributes (continued) Field Description 12-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context VLAN Interfaces More Settings Enable ICMP Guard For ACE module and ACE appliance software versions earlier than A5(1.0), this field does not include the IP version number check boxes and is for enabling the IPv4 version only. Check the IPv4, IPv6, or both check boxes to indicate that ICMP Guard is to be enabled on the ACE. Clear the check boxes to indicate that ICMP Guard is not to be enabled on ACE. Caution Disabling ICMP security checks may expose your ACE and network to potential security risks. When you disable ICMP Guard, the ACE appliance no longer performs NAT translations on the ICMP header and payload in error packets, which can potentially reveal real host IP addresses to attackers. Enable DHCP Relay For ACE module and ACE appliance software versions earlier than A5(1.0), this field does not include the IP version number check boxes and is for enabling the IPv4 version only. Check the IPv4, IPv6, or both check boxes to indicate that the ACE is to accept DHCP requests from clients on this interface and to enable the DHCP relay agent. For IPv6, link local address for the Clear the check boxes to indicate that the ACE is not to accept DHCP requests or enable the DHCP relay agent. Reverse Path Forwarding (RPF) For ACE module and ACE appliance software versions earlier than A5(1.0), this field does not include the IP version number check boxes and is for enabling the IPv4 version only. Check the IPv4, IPv6, or both check boxes to indicate that the ACE is to discard IP packets if no reverse route is found or if the route does not match the interface on which the packets arrived. Clear the check boxes to indicate that the ACE is not to filter or discard packets based on the ability to verify the source IP address. Reassembly Timeout (Seconds) Enter the number of seconds that the ACE appliance is to wait before it abandons the fragment reassembly process if it doesn’t receive any outstanding fragments for the current fragment chain (that is, fragments belonging to the same packet). • For IPv4, valid entries are 1 to 30 seconds. The default is 5. • For IPv6, valid entries are 1 to 60 seconds. The default is 60. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Max. Fragment Chains Allowed Enter the maximum number of fragments belonging to the same packet that the ACE appliance is to accept for reassembly. For IPv4 and IPv6, valid entries are integers from 1 to 256. The default is 24. Min. Fragment MTU Value Enter the minimum fragment size that the ACE appliance accepts for reassembly for a VLAN interface. • For IPv4, valid entries are 28 to 9216 bytes. The default is 576. • For IPv6, valid entries are 56 to 9216 bytes. The default is 1280. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Table 12-1 VLAN Interface Attributes (continued) Field Description 12-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context VLAN Interfaces Action For IP Header Options For ACE module and ACE appliance software versions earlier than A5(1.0), this field does not include the IP version number and is for IPv4 only. Choose the IPv4, IPv6, or both action the ACE appliance is to take when an IP option is set in a packet: • Allow—Indicates that the ACE appliance is to allow the IP packet with the IP options set. • Clear—Indicates that the ACE appliance is to clear all IP options from the packet and to allow the packet. • Clear-Invalid—Indicates that the ACE appliance is to clear the invalid IP options from the packet and then allow the packet. This action is the default for IPv4. • Drop—Indicates that the ACE appliance is to discard the packet regardless of any options that are set. This action is the default for IPv6. Enable MAC Address Autogenerate MAC address autogenerate option, which allows you to configure a different MAC address for the VLAN interface. Min. TTL IP Header Value Minimum number of hops that a packet is allowed to reach its destination. Valid entries are from 1 to 255. This field is applicable for IPv4 and IPv6 traffic. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Each router along the path decrements the TTL by one. If the packet TTL reaches zero before the packet reaches its destination, the packet is discarded. MTU Value Number of bytes for Maximum Transmission Units (MTUs). Valid entries are from 68 to 9216. The default is 1500. Enable Syn Cookie Threshold Value Field that is applicable for ACE module software Version A2(1.0) and later, and ACE appliance software Version A3(1.0) and later. Embryonic connection threshold above which the ACE applies SYN-cookie DoS protection. Valid entries are as follows: • 2 to 65535 for ACE module software versions earlier than A4(1.0). • 1 to 65535 for ACE module software Version A4(1.0) and later, and ACE appliance software Version A3(1.0) and later. Action For DF Bit Action that the ACE takes when a packet has its DF (Don’t Fragment) bit set in the IP header. Choose one of the following settings: • Allow—The ACE permits the packet with the DF bit set. If the packet is larger than the next-hop MTU, ACE discards the packet and sends an ICMP unreachable message to the source host. This is the default. • Clear—The ACE clears the DF bit and permit the packet. If the packet is larger than the next-hop MTU, the ACE fragments the packet. Table 12-1 VLAN Interface Attributes (continued) Field Description 12-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context VLAN Interfaces ARP Inspection Type Type of ARP inspection, which prevents malicious users from impersonating other hosts or routers, known as ARP spoofing. ARP spoofing can enable a “man-in-the-middle” attack. For example, a host sends an ARP request to the gateway router. The gateway router responds with the gateway router MAC address. By default, ARP inspection is disabled on all interfaces, allowing all ARP packets through the ACE. When you enable ARP inspection, the ACE appliance uses the IP address and interface ID (ifID) of an incoming ARP packet as an index into the ARP table. ARP inspection operates only on ingress bridged interfaces. Note If ARP inspection fails, then the ACE does not perform source MAC validation. Choices are as follows: • N/A—ARP inspection is disabled. • Flood—Enables ARP forwarding of nonmatching ARP packets. The ACE appliance forwards all ARP packets to all interfaces in the bridge group. This setting is the default. In the absence of a static ARP entry, this option bridges all packets. • No Flood—Disables ARP forwarding for the interface and drops nonmatching ARP packets. In the absence of a static ARP entry, this option does not bridge any packets. UDP Config Commands UDP boost command options: • N/A—Not applicable. • IP Destination Hash—Performs destination IP hash during connection. • IP Source Hash—Performs source IP hash during connection lookup. Table 12-1 VLAN Interface Attributes (continued) Field Description 12-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context VLAN Interfaces Secondary IP Groups Option that is available only for the ACE module A2(3.0), ACE appliance A4(1.0), and later releases of both device types. This option displays only when Interface Type is set to Routed. The number of secondary IP groups that you can enter for a VLAN depends on the ACE release as follows: • ACE module A2(3.0) and ACE appliance A4(1.0)—Up to 4 secondary IP groups. • ACE module A2(3.1) and later—Up to 15 secondary IP groups. The IP, alias IP, and peer IP addresses of each Secondary IP group should be in the same subnet. Note You cannot configure secondary IP addresses on FT VLANs. To create secondary IP groups for the VLAN, do the following: a. Define one or more of the following secondary IP address types: – IP—Secondary IP address assigned to this interface.The primary address must be active for the secondary address to be active. – AliasIP—Secondary IP address of the alias associated with this interface. – PeerIP—Secondary IP address of the remote peer. – Netmask—Secondary subnet mask to be used. The ACE has a system limit of 1,024 for each secondary IP address type. b. Click Add to selection (right arrow) to add the group to the group display area. c. Repeat the first two steps for each additional group. d. (Optional) Rearrange the order in which the groups are listed by selecting one of the group listings in the group display area and click either Move item up in list (up arrow) or Move item down in list (down arrow). Note that the ACE does not care what order the groups are in. e. (Optional) Edit a group or remove it from the list by selecting the desired group in the group display area and click Remove from selection (left arrow). Input Policies Policy map that is associated with this VLAN interface. From the Available list, double-click a policy map name or use the right arrow to move it to the Selected list. This policy map is to be applied to the inbound direction of the interface; that is, all traffic received by this interface. If you choose more than one policy map, use the Up and Down arrows to choose the priority of the policy map in the Selected list. These arrows modify the order of the policy maps for new VLANs only; they do not modify the policy map order when editing an existing policy map. Input Access Group ACL input access group to be associated with this VLAN interface. From the Available list, double-click an ACL name or use the right arrow to move it to the Selected list. Any ACL group listed in the Selected list specifies that this access group is to be applied to the inbound direction of the interface. Output Access Group ACL output access group that is associated with this VLAN interface. From the Available list, double-click an ACL name or use the right arrow to move it to the Selected list. Any ACL group listed in the Selected list specifies that this access group is to be applied to the outbound direction of the interface; that is, all traffic sent by this interface. Table 12-1 VLAN Interface Attributes (continued) Field Description 12-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context VLAN Interfaces Static ARP Entry (IP/MAC Address) Static ARP entry. Do the following: a. In the ARP IP Address field, enter the IP address. This field accepts IPv4 addresses only. b. In the ARP MAC Address field, enter the hardware MAC address for the ARP table entry (for example, 00.02.9a.3b.94.d9). c. When completed, use the right arrow to move the static ARP entry to the list box. Use the Up and Down arrows to choose the priority of the static ARP entry in the list box. These arrows modify the order of the static ARPs for new VLANs only; they do not modify the static ARP order when editing an existing policy map. DHCP Relay Configuration Enter the IPv4 address of the DHCP server to which the DHCP relay agent is to forward client requests. Enter the IP address in dotted-decimal notation, such as 192.168.11.2. IPv6 DHCP Forward Interface VLAN Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. Enter the VLAN to forward all received client requests with destination being the IPv6 DHCP address configured in the IPv6 DHCP Relay Configuration field. IPv6 DHCP Relay Configuration Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. Enter the IPv6 address for the DHCP server where the DHCP relay agent forwards client requests. Select the VLAN when the server address is a link local address. Note When you enter a DHCPv6 server global IPv6 address, a VLAN is not required. Managed-Config Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. Check box to indicate that the interface use the stateful autoconfiguration mechanism to configure IPv6 addresses. Uncheck the check box to indicate that the interface does not use the stateful autoconfiguration mechanism to configure IPv6 addresses. Other-Config Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. Check box to indicate that the interface use the stateful autoconfiguration mechanism to configure parameters other than IPv6 addresses. Uncheck the check box to indicate that the interface does not use the stateful autoconfiguration mechanism to configure parameters other than IPv6 addresses. NS Interval Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. The ACE sends neighbor solicitation messages through ICMPv6 on the local link to determine the IPv6 addresses of nearby nodes (hosts or routers). You can configure the rate at which the ACE sends these neighbor solicitation messages. By default, the interval at which the ACE sends NS messages for DAD default is 1000 milliseconds (msecs). To configure the interval, enter an integer from 1000 to 2147483647. NS Reachable Time Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. The neighbor solicitation reachable time is the time period in milliseconds during which a host considers the peer is reachable after a reachability confirmation from the peer. A reachability confirmation can include neighbor solicitation or advertisement, or any upper protocol traffic. By default, this time period is 0 milliseconds. To configure this time, enter an integer from 0 to 3600000. Table 12-1 VLAN Interface Attributes (continued) Field Description 12-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context VLAN Interfaces Retransmission time Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. By default, the advertised retransmission time is 0 milliseconds. To configure the retransmission time, enter an integer from 0 to 3600000. DAD Attempts Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. By default, the number of attempts for sending duplicate address detection (DAD) is 1. To configure the DAD attempts, enter an integer from 0 to 255. RA Hop Limit Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. By default, the hop limit that neighbors should use when originating IPv6 packets is 64. To configure the hop limit in the IPv6 header, enter an integer from 0 to 255. RA Lifetime Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. The router advertisement lifetime is the length of time that neighboring nodes should consider the ACE as the default router before they send RS messages again. By default, this length of time is 1800 seconds (30 minutes). To configure the RA lifetime, enter an integer from 0 to 9000. RA Interval Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. By default, the rate at which the ACE sends RA messages is 600 seconds. To configure the rate, enter an integer from 4 to 1800. Suppress RA Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. Check box to instruct the ACE to not respond to RS messages. The ACE also stops periodic unsolicited RAs that it sends at the RA interval. By default, the ACE automatically responds to RS messages that it receives from neighbors with RA messages that include, for example, the network prefix. You can instruct the ACE to not respond to RS messages. Uncheck the check box to reset the default behavior of automatically responding to RS messages. IPv6 Router Prefix Advertisement Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. Click the Add button to configure the IPv6 prefixes that the ACE advertises in RA messages on the local link. IPv6 Address/Prefix Length To configure IPv6 address advertised in the RA messages, enter a complete IPv6 address in the first field. In the second field after the /, enter the prefix length to specify how many of the most significant bits (MSBs) are used for the network identifier. No Advertisements Check the check box to indicate that the route prefix is not advertised. Clear the check box to indicate that the route prefix is advertised. Table 12-1 VLAN Interface Attributes (continued) Field Description 12-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context VLAN Interfaces Step 5 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click Cancel to exit this procedure without saving your entries and to return to the previous window. Step 6 (Optional) To display statistics and status information for a VLAN interface, choose the VLAN interface from the VLAN Interface table, then click Details. The show interface vlan CLI command output appears. See the “Displaying VLAN Interface Statistics and Status Information” section on page 12-18 for details. Related Topics • Configuring VLAN Interface NAT Pools, page 12-26 • Displaying All VLAN Interfaces, page 12-18 • Displaying VLAN Interface Statistics and Status Information, page 12-18 Lifetime Configure the prefix lifetime attributes as follows: • Lifetime Duration: – Valid Lifetime—By default, the prefix lifetime is 2592000 seconds (30 days). To configure the prefix lifetime in seconds, enter an integer from 0 to 2147183647. Select Infinite to indicate that the prefix never expires. – Preferred Lifetime—By default, the prefix lifetime is 604800 seconds (10 days).To configure how long an IPv6 address remains preferred in seconds, enter an integer from 0 to 2147183647. This lifetime must not exceed the Valid Lifetime. Select Infinite to indicate that the preferred lifetime never expires. • Lifetime Expiration Date: – Valid Month/Day/Year/Time—Valid lifetime expiration date and time. – Preferred Month/Day/Year/Time—Preferred lifetime expiration date and time. Use the drop-down lists to select a day, month, and year. To specify the time, use the hh:mm format. Off-link This option appears when you enter a Preferred Lifetime field. Check this check box to indicate that the route prefix is on a different subnet for a router to route to it. Clear the check box to indicate that the route prefix is on the same subnet for a router to route to it. No-autoconfig This option appears when you enter a Preferred Lifetime field. Check this check box to indicate to the host that it cannot use this prefix when creating an stateless IPv6 address. Clear the check box to indicate to the host that it can use this prefix when creating an stateless IPv6 address. Table 12-1 VLAN Interface Attributes (continued) Field Description 12-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context VLAN Interfaces Displaying All VLAN Interfaces You can display all of the VLAN interfaces associated with a specific virtual context by choosing Config > Devices > context > Network > VLAN Interfaces. The VLAN Interface table appears with the information shown in Table 12-2. Related Topics • Configuring Virtual Context VLAN Interfaces, page 12-6 • Configuring Virtual Context BVI Interfaces, page 12-19 • Displaying VLAN Interface Statistics and Status Information, page 12-18 Displaying VLAN Interface Statistics and Status Information You can display statistics and status information for a particular VLAN interface. Procedure Step 1 Choose Config > Devices > context > Network > VLAN Interfaces. The VLAN Interfaces table appears. Step 2 Choose a VLAN interface from the VLAN Interfaces table, and click Details. The show interface vlan, show ipv6 interface vlan, and show ipv6 neighbors CLI commands appears. The IPv6 commands require ACE module and ACE appliance software Version A5(1.0) or later. Click on the command to display its output. For details on the displayed output fields, see either the Cisco ACE Module Routing and Bridging Configuration Guide or the Cisco ACE 4700 Series Appliance Routing and Bridging Configuration Guide. Table 12-2 VLAN Interface Table Fields Field Description VLAN VLAN number. Description Description for this interface. Interface Type Role of the virtual context in the network topology of the VLAN interface. IP Address IP address assigned to this interface including the netmask for an IPv4 address or a prefix length for an IPv6 address. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. This table does not display the IPv6 link-local, unique-local, and multicast addresses for the interface. To display these addresses, click Details to display the output for the show ipv6 vlan command. IPv6 Config Status The status whether IPv6 is enabled or disabled on the interface. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Admin Status Status of the interface, which can be Up or Down. Operational Status Operational state of the device (Up or Down). Last Polled Date and time of the last time that ANM polled the device to display the current values. 12-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context BVI Interfaces Step 3 Click Update Details to refresh the output for the show interface vlan CLI command. Step 4 Click Close to return to the VLAN Interfaces table. Related Topics • Configuring Virtual Context VLAN Interfaces, page 12-6 • Displaying All VLAN Interfaces, page 12-18 Configuring Virtual Context BVI Interfaces You can configure Bridge-Group Virtual Interfaces (BVI) for virtual contexts. The ACE supports virtual contexts containing BVI interfaces. You can configure two interface VLANs into a group and bridge packets between them. All interfaces are in one broadcast domain and packets from one VLAN are switched to the other VLAN. The ACE bridge mode supports only two Layer 2 VLANs per bridge group. Note The options that appear when you choose Config > Devices > context depend on the device associated with the virtual context and the role associated with your account. This section includes the following topics: • Configuring BVI Interfaces for a Virtual Context, page 12-19 • Displaying All BVI Interfaces by Context, page 12-25 • Displaying BVI Interface Statistics and Status Information, page 12-26 Configuring BVI Interfaces for a Virtual Context You can configure BVI interfaces for a virtual context. Procedure Step 1 Choose Config > Devices > context > Network > BVI Interfaces. The BVI Interface configuration table appears. Step 2 Click Poll Now to instruct ANM to poll the devices and display the current values, and click OK when prompted if you want to poll the devices for data now. Step 3 Click Add to add a new BVI interface. Step 4 Enter the interface attributes (see Table 12-3). Note When you create or edit a virtual context BVI, if either of the two VLANs do not exist, ANM creates the VLAN and populates the BVI with the description specified in the BVI Interface window. If you delete the BVI and there are values specified in either of the two VLAN fields, ANM removes the BVI value from the VLAN. 12-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context BVI Interfaces Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Table 12-3 BVI Interface Attributes Field Description BVI BVI identifier. Either accept the automatically incremented entry or enter a different, unique value for the BVI. Valid entries are from 1 to 4094. Description Brief description for this interface. IP Address IPv4 address assigned to this interface. This address must be a unique IP address that is not used in another context. Duplicate IP addresses in different contexts are not supported. Note If this interface is only used for IPv6 traffic, entering an IPv4 address is optional. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. Alias IP Address IPv4 address of the alias that this interface is associated with. Peer IP Address IPv4 address of the remote peer. Netmask Subnet mask to be used. Admin Status Administrative state of the interface: Up or Down. Secondary IP Groups Option that is available only for the ACE module A2(3.0), ACE appliance A4(1.0), and later releases of either device type. The number of secondary IP groups that you can enter for a BVI depends on the ACE release as follows: • ACE module A2(3.0) and ACE appliance A4(1.0)—Up to 4 secondary IP groups. • ACE module A2(3.1) and later—Up to 15 secondary IP groups. To create secondary IP groups for this BVI, do the following: a. Define one or more of the following secondary IP address types: – IP—Secondary IP address assigned to this interface.The primary address must be active for the secondary address to be active. – AliasIP—Secondary IP address of the alias associated with this interface. – PeerIP—Secondary IP address of the remote peer. – Netmask—Secondary subnet mask to be used. The ACE has a system limit of 1,024 for each secondary IP address type. b. Click Add to selection (right arrow) to add the group to the group display area. c. Repeat the first two steps for each additional group. d. (Optional) Rearrange the order in which the groups are listed by selecting one of the group listings in the group display area and click either Move item up in list (up arrow) or Move item down in list (down arrow). Note that the ACE does not care what order the groups are in. e. (Optional) Edit a group or remove it from the list by selecting the desired group in the group display area and click Remove from selection (left arrow). First VLAN First VLAN whose bridge group is to be configured with this BVI. This VLAN can be the server or client VLAN. Valid entries are from 2 to 4094. 12-21 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context BVI Interfaces First VLAN Description Brief description for the first VLAN. Second VLAN Second VLAN whose bridge group is to be configured with this BVI. This VLAN can be the server or client VLAN. Valid entries are from 2 to 4094. Second VLAN Description Brief description for the second VLAN. Enable IPv6 Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. Check box to enable IPv6 on this interface. By default, IPv6 is disabled. The interface cannot be in bridged mode. When you enable IPv6, the ACE automatically does the following: • Configures a link-local address (if not previously configured) • Performs duplicate address detection (DAD) on both addresses Uncheck the check box to indicate that IPv6 is disabled on this interface. IPv6 Global Address Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. A global address is an IPv6 unicast address that is used for general IPv6 communication. Each global address is unique across the entire Internet. Therefore, its scope is global. The low order 64 bits can be assigned in several ways, including autoconfiguration using the EUI-64 format. You can configure only one globally unique IPv6 address on an interface. When you configure a global address, the ACE automatically does the following: • Configures a link-local address (if not previously configured) • Performs duplicate address detection (DAD) on both addresses IPv6 Address To configure an IPv6 global address on an interface, enter a complete IPv6 address with a prefix of 2000::/3 to 3fff::/3. For example, enter 2001:DB8:1::0. Check the EUI-64 check box to specify that the low order 64 bits are automatically generated in the IEEE 64-bit Extended Unique Identifier (EUI-64) format specified in RFC 2373. To use EUI-64, the Prefix Length field must be less than or equal to 64 and the host segment must be all zeros. Alias IPv6 Address When you configure redundancy with active and standby devices, you can configure a VLAN interface that has an alias global IPv6 address that is shared between the active and standby devices. The alias IPv6 address serves as a shared gateway for the two ACEs in a redundant configuration. You can configure only one alias global IPv6 address on an interface. To configure an IPv6 alias global address, enter a complete IPv6 address with a prefix of 2000::/3 to 3fff::/3. For example, enter 2001:DB8:1::0. Note You must configure redundancy (fault tolerance) on the ACE for the alias global IPv6 address to work. Table 12-3 BVI Interface Attributes (continued) Field Description 12-22 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context BVI Interfaces Peer IPv6 Address To configure an IPv6 peer global address, enter a complete IPv6 address with a prefix of 2000::/3 to 3fff::/3. For example, enter 2001:DB8:1::0. Check the EUI-64 box to specify that the low order 64 bits are automatically generated in the IEEE 64-bit Extended Unique Identifier (EUI-64) format specified in RFC 2373. To use EUI-64, the Prefix Length field must be less than or equal to 64 and the host segment must be all zeros. Note The IPv6 peer global address must be unique across multiple contexts on a shared VLAN. Prefix Length Enter the prefix length for all global addresses to specify how many of the most significant bits (MSBs) are used for the network identifier. Enter an integer from 1 to 128. If you use the optional EUI-64 check box for the global and peer addresses, the prefix must be less than or equal to 64. IPv6 Unique-Local Address Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. A unique local address is an optional IPv6 unicast address that is used for local communication within an organization and it is similar to a private IPv4 address (for example, 10.10.2.1). Unique local addresses have a global scope, but they are not routable on the internet, and they are assigned by a central authority. All unique local addresses have a predefined prefix of FC00::/7. You can configure only one IPv6 unique local address on an interface. IPv6 Address To configure a unique local address, enter a complete IPv6 address with an FC00::/7 prefix in the first field. In the second field after the /, enter the prefix length to specify how many of the most significant bits (MSBs) are used for the network identifier. Check the EUI-64 box to specify that the low order 64 bits are automatically generated in the IEEE 64-bit Extended Unique Identifier (EUI-64) format specified in RFC 2373. To use EUI-64, the Prefix Length field must be less than or equal to 64 and the host segment must be all zeros. Peer IPv6 Address In a redundant configuration, you can configure an IPv6 peer unique local address on the active that is synchronized to the standby ACE. You can configure only one peer unique local IPv6 address on an interface. To configure a peer unique local address, enter a complete IPv6 address with an FC00::/7 prefix in the first field. In the second field after the /, enter the prefix length to specify how many of the most significant bits (MSBs) are used for the network identifier. Note The IPv6 peer unique local address must be unique across multiple contexts on a shared VLAN. Check the EUI-64 box to specify that the low order 64 bits are automatically generated in the IEEE 64-bit Extended Unique Identifier (EUI-64) format specified in RFC 2373. To use EUI-64, the Prefix Length field must be less than or equal to 64 and the host segment must be all zeros. Prefix Length Enter the prefix length for all global addresses to specify how many of the most significant bits (MSBs) are used for the network identifier. Enter an integer from 1 to 128. If you use the optional EUI-64 check box for the global and peer addresses, the prefix must be less than or equal to 64. Table 12-3 BVI Interface Attributes (continued) Field Description 12-23 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context BVI Interfaces IPv6 Link-Local Address Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. By default, when you enable IPv6 or configure any other valid IPv6 address on an interface, the ACE automatically creates a link local address for it. Every link local address must have a predefined prefix of FE80::/10. You can configure only one IPv6 link local address on an interface. This address always has the prefix of 64. To manually configure the link local address, enter a complete IPv6 address with an FE80::/10 prefix in this field. For example, enter FE80:DB8:1::1 IPv6 Peer Link-Local Address Field that appears only for ACE module and ACE appliance software Version A5(1.0) or later. In a redundant configuration, you can configure an IPv6 peer link local address for the standby ACE. You can configure only one peer link local address on an interface. To configure the peer link local address, enter a complete IPv6 address with an FE80::/10 prefix in this field. Note The IPv6 peer link local address must be unique across multiple contexts on a shared VLAN. More Settings (The More Seetings option appears only for ACE module and ACE appliance software Version A5(1.0) or later.) Managed-Config Check box to indicate that the interface use the stateful autoconfiguration mechanism to configure IPv6 addresses. Uncheck the check box to indicate that the interface does not use the stateful autoconfiguration mechanism to configure IPv6 addresses. Other-Config Check box to indicate that the interface use the stateful autoconfiguration mechanism to configure parameters other than IPv6 addresses. Clear the check box to indicate that the interface does not use the stateful autoconfiguration mechanism to configure parameters other than IPv6 addresses. NS Interval The ACE sends neighbor solicitation messages through ICMPv6 on the local link to determine the IPv6 addresses of nearby nodes (hosts or routers). You can configure the rate at which the ACE sends these neighbor solicitation messages. By default, the interval at which the ACE sends NS messages for DAD default is 1000 milliseconds (msecs). To configure the interval, enter an integer from 1000 to 2147483647. NS Reachable Time The neighbor solicitation reachable time is the time period in milliseconds during which a host considers the peer is reachable after a reachability confirmation from the peer. A reachability confirmation can include neighbor solicitation or advertisement, or any upper protocol traffic. By default, this time period is 0 milliseconds. To configure this time, enter an integer from 0 to 3600000. Retransmission time By default, the advertised retransmission time is 0 milliseconds. To configure the retransmission time, enter an integer from 0 to 3600000. DAD Attempts By default, the number of attempts for sending duplicate address detection (DAD) is 1. To configure the DAD attempts, enter an integer from 0 to 255. RA Hop Limit By default, the hop limit that neighbors should use when originating IPv6 packets is 64. To configure the hop limit in the IPv6 header, enter an integer from 0 to 255. Table 12-3 BVI Interface Attributes (continued) Field Description 12-24 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context BVI Interfaces RA Lifetime The RA lifetime is the length of time that neighboring nodes should consider the ACE as the default router before they send RS messages again. By default, this length of time is 1800 seconds (30 minutes). To configure the RA lifetime, enter an integer from 0 to 9000. RA Interval By default, the rate at which the ACE sends RA messages is 600 seconds. To configure the rate, enter an integer from 4 to 1800. Suppress RA By default, the ACE automatically responds to RS messages that it receives from neighbors with RA messages that include, for example, the network prefix. You can instruct the ACE to not respond to RS messages. Check the check box to instruct the ACE to not respond to RS messages. Clear the check box to reset the default behavior of automatically responding to RS messages. IPv6 Router Advertisement Settings Click the Add button to configure the IPv6 prefixes that the ACE advertises in RA messages on the local link. IPv6 Address/Prefix Length To configure IPv6 address advertised in the RA messages, enter a complete IPv6 address in the first field. In the second field after the /, enter the prefix length to specify how many of the most significant bits (MSBs) are used for the network identifier. No Advertisements Check the check box to indicate that the route prefix is not advertised. Clear the check box to indicate that the route prefix is advertised. Lifetime Configure the prefix lifetime attributes as follows: • Lifetime Duration: – Valid Lifetime—By default, the prefix lifetime is 2592000 seconds (30 days). To configure the prefix lifetime in seconds, enter an integer from 0 to 2147183647. Select Infinite to indicate that the prefix never expires. – Preferred Lifetime—By default, the prefix lifetime is 604800 seconds (10 days).To configure how long an IPv6 address remains preferred in seconds, enter an integer from 0 to 2147183647. This lifetime must not exceed the Valid Lifetime. Select Infinite to indicate that the preferred lifetime never expires. • Lifetime Expiration Date: – Valid Month/Day/Year/Time—Valid lifetime expiration date and time. – Preferred Month/Day/Year/Time—Preferred lifetime expiration date and time. Use the drop-down lists to select a day, month, and year. To specify the time, use the hh:mm format. Table 12-3 BVI Interface Attributes (continued) Field Description 12-25 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context BVI Interfaces Step 5 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click Cancel to exit this procedure without saving your entries and to return to the previous table. Step 6 To display statistics and status information for a BVI interface, choose the BVI interface from the BVI Interface table, and click Details. The show interface bvi, show ipv6 interface bvi, and show ipv6 neighbors CLI command outputs appears. IPv6 commands requires ACE module and ACE appliance software Version A5(1.0) or later. See the “Displaying BVI Interface Statistics and Status Information” section on page 12-26 for details. Related Topics • Configuring Network Access, page 12-1 • Configuring Virtual Context Primary Attributes, page 6-14 Displaying All BVI Interfaces by Context You can display all of the BVI interfaces associated with a specific context by choosing Config > Devices > context > Network > BVI Interfaces. The BVI Interface table appears with the information shown in Table 12-4. Off-link This option appears when you enter a Preferred Lifetime field. Check this check box to indicate that the route prefix is on a different subnet for a router to route to it. Clear the check box to indicate that the route prefix is on the same subnet for a router to route to it. No-autoconfig This option appears when you enter a Preferred Lifetime field. Check this check box to indicate to the host that it cannot use this prefix when creating an stateless IPv6 address. Clear the check box to indicate to the host that it can use this prefix when creating an stateless IPv6 address. Table 12-3 BVI Interface Attributes (continued) Field Description Table 12-4 BVI Interface Fields Field Description BVI Name of the BVI interface. Description Description for the BVI interface. IP Address IP address assigned to this interface including the netmask for an IPv4 address or a prefix length for an IPv6 address. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. IPv6 Config Status The status whether IPv6 is enabled or disabled on the interface. IPv6 requires ACE module and ACE appliance software Version A5(1.0) or later. 12-26 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring VLAN Interface NAT Pools Related Topics • Displaying BVI Interface Statistics and Status Information, page 12-26 Displaying BVI Interface Statistics and Status Information You can display statistics and status information for a particular BVI interface by using the Details button. Procedure Step 1 Choose Config > Devices > context > Network > BVI Interfaces. The BVI Interface table appears. Step 2 In the BVI Interface table, choose a BVI interface from the BVI Interface table, and click Details. The show interface bvi, show ipv6 interface bvi, and show ipv6 neighbors CLI command outputs appear. The IPv6 commands require ACE module and ACE appliance software Version A5(1.0) or later. For details about the displayed output fields, see either the Cisco ACE Module Routing and Bridging Configuration Guide or the Cisco ACE 4700 Series Appliance Routing and Bridging Configuration Guide. Step 3 Click Update Details to refresh the command output. Step 4 Click Close to return to the BVI Interface table. Related Topics • Displaying All BVI Interfaces by Context, page 12-25 Configuring VLAN Interface NAT Pools You can configure Network Address Translation (NAT) pools for a VLAN interface. NAT is designed to simplify and conserve IP addresses. It allows private IP networks that use unregistered IP addresses to connect to the Internet. NAT operates on a router, usually connecting two networks, and translates the private (not globally unique) addresses in the internal network into legal addresses before the packets are forwarded to another network. The ACE allows you to configure NAT so that it advertises only one address for the entire network to the outside world. This feature, which effectively hides the entire internal network behind that address, offers both security and address conservation. Admin Status Status of the interface, which can be Up or Down. Operational Status Operational state of the device (Up or Down). Last Polled Date and time of the last time that ANM polled the device to display the current values. Table 12-4 BVI Interface Fields (continued) Field Description 12-27 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring VLAN Interface NAT Pools Several internal addresses can be translated to only one or a few external addresses by using Port Address Translation (PAT) in conjunction with NAT. With PAT, you can configure static address translations at the port level and use the remainder of the IP address for other translations. PAT effectively extends NAT from one-to-one to many-to-one by associating the source port with each flow. Note The options that appear when you choose Config > Devices > context depend on the device associated with the virtual context and the role associated with your account. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Note When server load balancing is IPv6 to IPv4 or IPv4 to IPv6, you must configure source NAT. Assumption You have successfully configured at least one VLAN interface (see the “Configuring Virtual Context VLAN Interfaces” section on page 12-6). Procedure Step 1 Choose Config > Devices > context > Network > NAT Pools. The NAT Pools table appears. Step 2 In the NAT Pools table, click Add to add a new NAT pool, or choose an existing NAT pool and click Edit to modify it. Note If you click Edit, not all of the fields can be modified. Step 3 Choose the VLAN interface that you want to configure a NAT pool for and click the NAT Pool tab. The NAT Pool configuration table appears. Step 4 In the NAT Pool configuration table, click Add to add a new entry. Step 5 In the VLAN ID field, from the drop-down list, choose a VLAN entry. Step 6 In the NAT Pool ID field, either accept the automatically incremented entry or enter a new number to uniquely identify this pool. Valid entries are from 1 to 2147483647. Step 7 In the IP Address Type field, choose either IPv4 or IPv6. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. Step 8 In the Start IP Address field, enter an IP address for the selected IP Address Type. This entry identifies either a single IP address or, if using a range of IP addresses, the first IP address in a range of global addresses for this NAT pool. Step 9 In the End IP Address field, enter the highest IP address in a range of global IP addresses for this NAT pool. 12-28 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Virtual Context Static Routes Enter the IP address for the selected IP Address Type. Leave this field blank if you want to identify only the single IP address in the Start IP Address field. Step 10 Depending on the IP address type that you chose, do one of the following: • For IPv4, in the Netmask field, choose the subnet mask for the global IP addresses in the NAT pool. • For IPv6, in the Prefix Length field, enter the prefix length for the global IP addresses in the NAT pool. Step 11 Check the PAT Enabled check box to instruct the ACE to perform port address translation (PAT) in addition to NAT. Uncheck the check box to indicate that the ACE is not to perform port address translation (PAT) in addition to NAT. Step 12 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click Cancel to exit this procedure without saving your entries and to return to the NAT Pools table. • Click Next to deploy your entries and to add another NAT Pool entry. Related Topics • Configuring Virtual Context VLAN Interfaces, page 12-6 • Configuring Virtual Context BVI Interfaces, page 12-19 Configuring Virtual Context Static Routes You can configure context static routes. Admin and user context modes do not support dynamic routing, therefore you must use static routes for any networks to which the ACE is not directly connected, such as when there is a router between a network and the ACE. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Procedure Step 1 Choose Config > Devices > context > Network > Static Routes. The Static Routes configuration table appears and displays the following information: • Destination prefix • Destination prefix mask • Next hop IP address Step 2 In the Static Routes configuration table, click Add to add a new static route. Note You cannot modify an existing static route. To make changes to an existing static route, you must delete the static route and then add it back. 12-29 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Global IP DHCP Step 3 In the IP Address Type, choose either IPv4 or IPv6 for the route. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 or IPv6. Step 4 In the Destination Prefix field, enter the IP address based on the address type (IPv4 or IPv6) for the route. The address that you specify for the static route is the address that is in the packet before entering the ACE and performing network address translation. Step 5 Depending on the IP address type that you chose, do one of the following: • For IPv4, in the Destination Prefix Mask field, choose the subnet to use for this route. • For IPv6, in the Destination Prefix-length field, enter the prefix length from 0 to 128 to use for this route. Step 6 (IPv6 IP address type only) For the Forward Interface Type, choose one of the following: • N/A (Not applicable) • VLAN • BVI If you select VLAN or BVI, select its number from the drop down menu. To configure an interface, click Plus. After configuring it, select its number from the drop down menu. Step 7 In the Next Hop field, enter the IP address of the gateway router based on the address type (IPv4 or IPv6) for this route. The gateway address must be in the same network as a VLAN interface for this context. Step 8 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click Cancel to exit this procedure without saving your entries and to return to the previous table. • Click Next to deploy your entries and to add another static route. Related Topics • Configuring Virtual Contexts, page 6-8 • Configuring Virtual Context Primary Attributes, page 6-14 Configuring Global IP DHCP You can configure the Dynamic Host Configuration (DHCP) relay agent at the context level so the configuration applies to all interfaces associated with the context. When you configure the ACE as a DHCP relay agent, it is responsible for forwarding the requests and responses that are negotiated between the DHCP clients and the server. By default, the DHCP relay agent is disabled. You must configure a DHCP server when you enable the DHCP relay agent. Note The options that appear when you choose Config > Devices > context depend on the device associated with the virtual context and the role associated with your account. 12-30 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Global IP DHCP Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Procedure Step 1 Choose Config > Devices > context > Network > Global IP DHCP. The Global IP DHCP configuration table appears. Step 2 From the Global IP DHCP configuration table, in the Enable DHCP Relay For The Context field, click IPv4, IPv6, or both to enable DHCP relay for the context and all interfaces associated with this context. For ACE module and ACE appliance software versions earlier than A5(1.0), this field does not include the IP version number and is for IPv4 only. Step 3 In the Relay Agent Information Reforwarding Policy field, choose a relay agent information forwarding policy: • N/A—Specifies to not configure the DHCP relay to identify what is to be performed if a forwarded message already contains relay information. • Keep—Specifies that existing information is left unchanged on the DHCP relay agent. • Replace—Specifies that existing information is overwritten on the DHCP relay agent. Step 4 In the IP DHCP Server field, choose the IP DHCP server to which the DHCP relay agent is to forward client requests. Step 5 In the IPv6 Forward Interface VLAN field, you can optionally enter the VLAN interface number that you configured in the IPv6 DHCP Forward Interface VLAN field on the interface where the multicast DHCP relay message is sent. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later. Step 6 In the IPv6 DHCP server, specify one or more IP DHCP servers and IPv6 addresses to which the DHCP relay agent is to forward client requests. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later. Step 7 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click Cancel to exit this procedure without saving your entries and to return to the previous table. • Click Next to deploy your entries and to add another DHCP relay entry. 12-31 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Static VLANs for Over 8000 Static NAT Configurations Configuring Static VLANs for Over 8000 Static NAT Configurations Note This feature applies to ACE modules only and was deprecated beginning with ACE software Version A5(1.0). You can create more than 8,000 static NAT configurations (one static NAT configuration with a netmask is counted as one configuration). In addition, follow these restrictions and guidelines when using this feature: • This feature is supported in routed mode only. • Only one mapped interface is allowed per virtual context. However, each static NAT configuration must have a different mapped IP address. • At any point, you can configure no more than one next-hop on the mapped interface. • Bidirectional NAT, or in other words, source-address as well as destination-address translation, for the same flow is not supported. • You must have fewer than 1,000 real IP addresses on the same subnet as the real interface. In addition, you must have fewer than 1,000 mapped IP address on the same subnet as the mapped interface. • If you use this feature, we recommended that you do not use MP-based NAT for the same virtual context. Procedure Step 1 Choose Config > Devices > context > Network > Static NAT Overwrite. The Static NAT Overwrite configuration table appears. Step 2 In the Static NAT Overwrite configuration table, click Add to add a new static NAT. Step 3 In the Mapped IP Address field, enter the IP address to which the real IP address is translated. In a context, the mapped IP address must be different in each static NAT configuration. Step 4 In the Real VLAN Number field, choose the VLAN number of the interface connected to the real IP address network. The list of available real VLANs includes routed mode VLANs only (for more information, see Interface Type). Step 5 In the Mapped VLAN Number field, choose the VLAN number of the interface connected to the mapped IP address network. The list of available mapped VLANs includes routed mode VLANs only (for more information, see Interface Type). In a context, the mapped interface must be the same in each static NAT configuration. Step 6 In the Real IP Address field, enter the real server IP address to be translated. In a context, you must configure a different address for configurations that have the same real server interface. Step 7 In the Real IP Netmask field, choose the subnet mask for the real server address. Step 8 Do one of the following: 12-32 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Gigabit Ethernet Interfaces on the ACE Appliance • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. This option appears for virtual contexts. • Click Cancel to exit this procedure without saving your entries and to return to the previous table. • Click Next to deploy your entries and to add another DHCP relay entry. Configuring Gigabit Ethernet Interfaces on the ACE Appliance Note This feature is for ACE appliances only. You can configure a Gigabit Ethernet interface on the ACE appliance, which provides physical Ethernet ports to connect servers, PCs, routers, and other devices to the ACE appliance. The ACE appliance supports four Layer 2 Ethernet ports for performing Layer 2 switching. You can configure the four Ethernet ports to provide an interface for connecting to 10-Mbps, 100-Mbps, or 1000-Mbps networks. Each Layer 2 Ethernet port supports autonegotiate, full-duplex, or half-duplex operation on an Ethernet LAN, and can carry traffic within a designated VLAN. A Layer 2 Ethernet port can be configured as follows: • Member of Port-Channel Group—The port is configured as a member of a port-channel group, which associates a physical port on the ACE appliance to a logical port to create a port-channel logical interface. The VLAN association is derived from port-channel configuration. The port is configured as a Layer 2 EtherChannel, where each EtherChannel bundles the individual physical Ethernet data ports into a single logical link that provides the aggregate bandwidth of up to four physical links on the ACE. • Access VLAN—The port is assigned to a single VLAN. This port is referred to as an access port and provides a connection for end users or node devices, such as a router or server. • Trunk port—The port is associated with IEEE 802.1Q encapsulation-based VLAN trunking to allocate VLANs to ports and to pass VLAN information (including VLAN identification) between switches for all Ethernet channels defined in a Layer 2 Ethernet data port or a Layer 2 EtherChannel (port-channel) group on the ACE appliance. This section includes the following topics: • Configuring Gigabit Ethernet Interfaces, page 12-32 • Displaying Gigabit Ethernet Interface Statistics and Status Information, page 12-35 Configuring Gigabit Ethernet Interfaces This section describes how to configure Gigabit Interfaces on the ACE. Procedure Step 1 Choose Config > Devices > context > Network > GigabitEthernet Interfaces. The GigabitEthernet Interfaces table appears. Step 2 In the GigabitEthernet Interfaces table, click Poll Now to instruct ANM to poll the devices and display the current values, and click OK when prompted to poll the devices for data. 12-33 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Gigabit Ethernet Interfaces on the ACE Appliance Step 3 Choose an existing gigabit Ethernet interface, and click Edit to modify it. Step 4 Enter the gigabit Ethernet physical interface attributes (see Table 12-5). Table 12-5 Physical Interface Attributes Field Description Interface Name Name of the Gigabit Ethernet interface, which is in the format slot_number/port_number where slot_number is the physical slot on the ACE for the specified port, and port_number is the physical Ethernet data port on the ACE for the specified port. Description Brief description for this interface. Admin Status Administrative state of the interface: Up or Down. Speed Port speed: • Auto—Autonegotiate with other devices • 10 Mbps • 100 Mbps • 1000 Mbps Duplex Interface duplex mode: • Auto—Resets the specified Ethernet port to automatically negotiate port speed and duplex of incoming signals. This is the default setting. • Full—Configures the specified Ethernet port for full-duplex operation, which allows data to travel in both directions at the same time. • Half—Configures the specified Ethernet port for half-duplex operation. A half-duplex setting ensures that data only travels in one direction at any given time. Port Operation Mode Port operation mode: • N/A—Specifies that this option is not to be used. • Channel Group—Specifies to map the port to a port channel. You must specify: • Port Channel Group Number—Specifies the port channel group number. • HA VLAN—Specifies the high availability (HA) VLAN used for communication between the members of the FT group. • Switch Port—Specifies the interface switch port type: • Access—Specifies that the port interface is an access port. You must specify a VLAN as an access port in the Access VLAN field. • Trunk—Specifies that the port interface is a trunk port. When you choose Trunk, you must complete one or both of the following fields: - Trunk Native VLAN—Identifies the 802.1Q native VLAN for a trunk. - Trunk Allowed VLANs—Selectively allocates individual VLANs to a trunk link. HA LAN High availability (HA) VLAN used for communication between the members of the FT group. 12-34 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Gigabit Ethernet Interfaces on the ACE Appliance Step 5 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your changes and to return to the Physical Interface table. • Click Next or Previous to go to the next or previous physical channel. • Click Delete to remove this entry from the Physical Interface table and to return to the table. Step 6 (Optional) To display statistics and status information for a particular Gigabit Ethernet interface, choose the interface from the GigabitEthernet Interfaces table, and click Details. The show interface gigabitEthernet CLI command output appears. See the “Displaying Gigabit Ethernet Interface Statistics and Status Information” section on page 12-35 for details. Related Topics • Configuring Virtual Context VLAN Interfaces, page 12-6 • Configuring Virtual Context BVI Interfaces, page 12-19 • Configuring Port-Channel Interfaces for the ACE Appliance, page 12-35 Carrier Delay Configurable delay at the physical port level to address any issues with transition time, based on the variety of peers. Valid values are from 0 to 120 seconds. The default is 0 (no carrier delay). Note If you connect an ACE to a Catalyst 6500 series switch, your configuration on the switch may include the Spanning-Tree Protocol (STP). However, the ACE does not support STP. In this case, you may find that the Layer 2 convergence time is much longer than the physical port up time. For example, the physical port would normally be up within 3 seconds, but STP moving to the forward state may need approximately 30 seconds. During this transitional time, although the ACE declares the port to be up, the traffic does not pass. In this case, you should specify a carrier delay. QoS Trust COS Quality of Service (QoS) for the physical Ethernet port. By default, QoS is disabled for each physical Ethernet port on the ACE. QoS for a configured physical Ethernet port is based on VLAN Class of Service (CoS) bits (priority bits that segment the traffic in eight different classes of service). When you enable QoS on a port (a trusted port), traffic is mapped into different ingress queues based on their VLAN CoS bits. If there are no VLAN CoS bits, or QoS is not enabled on the port (untrusted port), the traffic is then mapped into the lowest priority queue. You can enable QoS for an Ethernet port configured for fault tolerance. In this case, heartbeat packets are always tagged with CoS bits set to 7 (a weight of High). Note We recommend that you enable QoS on the FT VLAN port to provide higher priority for FT traffic. Table 12-5 Physical Interface Attributes (continued) Field Description 12-35 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Port-Channel Interfaces for the ACE Appliance Displaying Gigabit Ethernet Interface Statistics and Status Information You can display statistics and status information for a particular Gigabit Ethernet interface. Procedure Step 1 Choose Config > Devices > context > Network > GigabitEthernet Interfaces. The GigabitEthernet Interfaces table appears. Step 2 In the GigabitEthernet Interfaces table, choose a Gigabit Ethernet interface from the GigabitEthernet Interfaces table, and click Details. The show interface gigabitEthernet CLI command output appears. For details on the displayed output fields, see the Cisco ACE 4700 Series Appliance Routing and Bridging Configuration Guide. Step 3 (Optional) Click Update Details to refresh the display. Step 4 Click Close to return to the GigabitEthernet Interfaces table. Related Topics Configuring Gigabit Ethernet Interfaces on the ACE Appliance, page 12-32 Configuring Port-Channel Interfaces for the ACE Appliance This section discusses how to configure port channel interfaces for the ACE appliance. It consists of the following topics: • Why Use Port Channels?, page 12-35 • Configuring a Port-Channel Interface, page 12-36 • Configuring a Catalyst 6500 Series Switch for an ACE Appliance Port-Channel Interface Connection, page 12-38 • Displaying Port Channel Interface Statistics and Status Information, page 12-40 Why Use Port Channels? A port channel groups multiple physical ports into a single logical port. This is also called port aggregation or channel aggregation. A port channel containing multiple physical ports has several advantages: • Improves link reliability through physical redundancy. • Allows greater total throughput to the ACE appliance. For example, four 1-Gigabit Ethernet interfaces can be aggregated into a single 4-Gigabit channel. • Allows traffic capacity to be scaled up in the future, without network disruption at that time. A port channel can do everything a switched port can do, but a switched port cannot do everything a port channel can do. We recommend that you use a port channel. • Provides maximum flexibility of network configuration and focuses network configuration on VLANs rather than physical cabling. 12-36 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Port-Channel Interfaces for the ACE Appliance The disadvantage of a port channel is that it requires additional configuration on the switch the ACE is connected to, as well as the ACE itself. There are many methods of port aggregation implemented by different switches, and not every method works with ACE. For an example of how to configure a Cisco Catalyst 6500 switch to enable a port channel connection to ACE, see the “Configuring a Catalyst 6500 Series Switch for an ACE Appliance Port-Channel Interface Connection” section on page 12-38. Using a port channel also requires more detailed knowledge of your network's VLANs, because all “cabling” to and from the ACE will be handled over VLANs rather than using physical cables. Nonetheless, use of port channels is highly recommended, especially in a production deployment of ACE. Figure 12-1 illustrates a port channel interface. Figure 12-1 Example of a Port Channel Interface Related Topics Configuring a Port-Channel Interface, page 12-36 Displaying Port Channel Interface Statistics and Status Information, page 12-40 Configuring a Port-Channel Interface Note This feature is for ACE appliances only. You can group physical ports together on the ACE appliance to form a logical Layer 2 interface called the port channel. All the ports belonging to the same port channel must be configured with same values; for example, port parameters, VLAN membership, and trunk configuration. Only one port channel in a channel group is allowed, and a physical port can belong to a single port-channel interface only. Step 1 Choose Config > Devices > context > Network > Port Channel Interfaces. The Port Channel Interface table appears. Step 2 In the Port Channel Interface table, click Poll Now to instruct ANM to poll the devices and display the current values, and click OK when prompted to poll the devices for data. Step 3 Click Add to add a port channel interface, or choose an existing port channel interface and click Edit to modify it. 247843 Switch ACE Appliance Port Channel VLANs Ethernet Ports 12-37 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Port-Channel Interfaces for the ACE Appliance Note If you click Edit, not all of the fields can be modified. Step 4 Enter the port channel interface attributes (see Table 12-6). Step 5 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your changes and to return to the Port Channel Interface table. • Click Next to deploy your entries and to add another port-channel interface. Table 12-6 Port Channel Interface Attributes Field Description Interface Number Channel number for the port-channel interface, which can be from 1 to 255. Description Brief description for this interface. Fault Tolerant VLAN Fault tolerant (FT) VLAN used for communication between the members of the FT group. Admin Status Administrative state of the interface: Up or Down. Load Balancing Method Load balancing method: • Dst-IP—Loads distribution on the destination IP address. • Dst-MAC—Loads distribution on the destination MAC address. • Dst-Port—Loads distribution on the destination TCP or UDP port. • Src-Dst-IP—Loads distribution on the source or destination IP address. • Src-Dst-MAC—Loads distribution on the source or destination MAC address. • Src-Dst-Port—Loads distribution on the source or destination port. • Src-IP—Loads distribution on the source IP address. • Src-MAC—Loads distribution on the source MAC address. • Src-Port—Loads distribution on the TCP or UDP source port. Switch Port Type Interface switchport type: • N/A—Indicates that the switchport type is not specified. • Access—Specifies that the port interface is an access port. You must specify a VLAN as an access port in the Access VLAN field. • Trunk—Specifies that the port interface is a trunk port. When you choose Trunk, you must complete the following fields: – Trunk Native VLAN—Identifies the 802.1Q native VLAN for a trunk. – Trunk Allowed VLANs—Selectively allocate individual VLANs to a trunk link. 12-38 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Port-Channel Interfaces for the ACE Appliance Step 6 (Optional) To display statistics and status information for a particular port-channel interface, choose the interface from the Port Channel Interfaces table, and click Details. The show interface port-channel CLI command output appears. See the “Displaying Port Channel Interface Statistics and Status Information” section on page 12-40 for details. Related Topics • Configuring Port-Channel Interfaces for the ACE Appliance, page 12-35 • Configuring Port-Channel Interfaces for the ACE Appliance, page 12-35 • Displaying Port Channel Interface Statistics and Status Information, page 12-40 • Configuring Virtual Context VLAN Interfaces, page 12-6 Configuring a Catalyst 6500 Series Switch for an ACE Appliance Port-Channel Interface Connection This section provides information for you to configure a port-channel interface on a network device such as the Catalyst 6500 Series switch. After you configure the port channels for the ACE appliance through ANM and you physically connect the Gigabit Ethernet physical interfaces on the ACE appliance to the Catalyst 6500 Series switch ports, configure the port channels on the switch. The information outlined in this topic is intended as an example of configuring port channels on a switch. You can adapt this information for whatever switch the ACE appliance is connected to in your network. For specific details on configuring the Catalyst 6500 Series switch, see the documentation set on www.Cisco.com. This section includes the following topics: • Creating the Port Channel Interface on the Catalyst 6500 • Adding Interfaces to the Port Channel Creating the Port Channel Interface on the Catalyst 6500 This section contains and example in which a Catalyst 6500 Series switch is configured with a port channel using an 802.1q trunk that allows the associated VLANs. The native VLAN of the trunk is VLAN 10. Note Default VLAN 1 should not be used for the native VLAN because this VLAN is used internally on the ACE appliance. Port-channel load balancing is used to distribute the traffic load across each of the links in the port channel to ensure efficient utilization of each link. Port-channel load balancing on the Catalyst 6500 Series switch can use MAC addresses or IP addresses, Layer 4 port numbers, source addresses, destination addresses, or both source and destination addresses. By default, the ACE appliance uses Src-Dst-MAC to make a load balancing decision (see Table 12-6). We recommend that you use the source and destination Layer 4 port for the load-balancing decision. 12-39 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Port-Channel Interfaces for the ACE Appliance The following example illustrates the CLI commands used to configure a port channel interface for the Catalyst 6500 Series switch: Switch(config)# port-channel load-balance src-dst-port Switch(config)# interface port-channel 1 Switch(config-if)# description For Connection with ACE Appliance Switch(config-if)# switchport Switch(config-if)# switchport mode trunk Switch(config-if)# switchport trunk encapsulation dot1q Switch(config-if)# switchport trunk native vlan 10 Switch(config-if)# switchport trunk allowed vlan 10,20,30,31, 40,50 Switch(config-if)# switchport nonegotiate Switch(config-if)# mls qos trust cos After you configure the port channel on the Catalyst 6500 Series switch, you can then add it to the configuration of the four interfaces as described in the “Adding Interfaces to the Port Channel” section on page 12-39. Note The ACE appliance does not support Port Aggregation Protocol (PAgP) or Link Aggregate Control Protocol (LACP) so the port-channel interface is configured using mode on. Adding Interfaces to the Port Channel The following example illustrates the CLI commands used to configure the four switch ports 3/9 through 3/12 as members of the port channel on the Catalyst 6500 Series switch: Switch(config-if)# int range Gig 3/9 - 12 Switch(config-if-range)# channel-group 1 mode on Switch(config-if-range)# speed 1000 Switch(config-if-range)# spanning-tree portfast trunk Switch(config-if-range)# no shut On the ACE appliance, you can configure the Ethernet port speed for a setting of 10, 100, or 1000 Mbps by configuring the Speed field for a Gigabit Ethernet physical interface attributes (see Table 12-5). The default for the ACE appliance is the auto-negotiate interface speed. We recommend that you configure the speed to 1000 on both the Catalyst 6500 Series switch and the ACE appliance to avoid relying on auto negotiation of the interface speed. A speed setting of 1000 helps to avoid the possibility of the interface operating below the expected Gigabit speed and ensures that the port-channel interface reaches the maximum 4 Gbps throughput. The ACE appliance does not implement Spanning-Tree protocol and does not take part in Spanning-Tree root bridge election process. PortFast is configured on the Catalyst 6500 Series switch to reduce the time required for spanning tree to allow traffic on the port connected to the ACE interface by immediately moving to the forwarding state, bypassing the block, listening, and learning states. The average time for switch port moving into a forward state is approximately 30 seconds. Using PortFast reduces this time to approximately 5 seconds. Note In virtual partitions operating in bridge mode, the ACE offers an option to bridge Spanning-Tree BPDUs between two VLANs to prevent the possibility of a loop. Such a loop may occur when two partitions actively forward traffic. This should not happen during normal operation; however, the option to bridge BPDUs provides a safeguard against this condition. Upon detecting BPDUs, the switch connected to the ACE appliance immediately blocks the port/VLAN from which the loop originated from. We recommend that you configure an ethertype ACL that includes the BPDU protocol and apply the ACL to Layer 2 interfaces in bridge mode. 12-40 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 12 Configuring Network Access Configuring Port-Channel Interfaces for the ACE Appliance Displaying Port Channel Interface Statistics and Status Information You can display statistics and status information for a particular port-channel interface. Procedure Step 1 Choose Config > Devices > context > Network > Port Channel Interfaces. The Port Channel Interfaces table appears. Step 2 In the Port Channel Interfaces table, choose a port-channel interface from the Port Channel Interfaces table, and click Details. The show interface port-channel CLI command output appears. For details about the displayed output fields, see the Cisco ACE 4700 Series Appliance Routing and Bridging Configuration Guide. Step 3 (Optional) Click Update Details to refresh the display. Step 4 Click Close to return to the Port Channel Interfaces table. Related Topics Configuring Port-Channel Interfaces for the ACE Appliance, page 12-35 CHAPTER 13-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 13 Configuring High Availability Date: 3/28/12 This chapter describes how to configure high availability for ANM servers and ACE devices. Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • Understanding ANM High Availability, page 13-2 • Understanding ACE Redundancy, page 13-6 • Configuring ACE High Availability, page 13-14 • Configuring ACE High Availability Peers, page 13-15 • Clearing ACE High Availability Pairs, page 13-17 • Configuring ACE High Availability Groups, page 13-17 • Displaying High Availability Group Statistics and Status, page 13-21 • Switching Over an ACE High Availability Group, page 13-22 • Deleting ACE High Availability Groups, page 13-23 • ACE High Availability Tracking and Failure Detection Overview, page 13-23 • Tracking ACE VLAN Interfaces for High Availability, page 13-24 • Tracking Hosts for High Availability, page 13-25 • Configuring Host Tracking Probes, page 13-26 • Configuring ACE Peer Host Tracking Probes, page 13-28 • Configuring ACE HSRP Groups, page 13-29 • Synchronizing ACE High Availability Configurations, page 13-30 • Synchronizing SSL Certificate and Key Pairs on Both ACE Peers, page 13-32 13-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Understanding ANM High Availability Understanding ANM High Availability ANM high availability (or fault tolerance) ensures that your network services and applications are always available. High availability (HA) provides seamless switchover of flows in case an ANM server becomes unresponsive or a critical host or interface fails. High availability uses two ANM nodes, where one node is the active node and the other is the standby node. The ANM high availability features are as follows: • Automatic determination of node status, whether active or standby, using heartbeat counts. • Designation of the virtual IP address (VIP), which is associated with the active node. • Near real-time replication of ANM configuration and events after a failover occurs. • Automatic inspection of certificate/key presence on HA peer upon SSL certificate or key import. During normal operation, ANM high availability performs the following actions: • The two nodes constantly exchange heartbeat packets over both interfaces. • Database operations that occur on the active node’s database are replicated on the standby node’s database. • The monitor function ensures that the necessary processes are running on both the active and standby node. For example, not all processes necessarily run on the standby node, so after a node changes from active to standby, ANM high availability function stops certain processes on the standby node. When you log into ANM, you log in using a virtual IP address (VIP) that associates with the active node. The VIP is the only IP address you need to remember. If the current active node fails, the standby node takes over as the active node and the VIP automatically associates with the node that has just become active. When a failover occurs and the standby node becomes the active node, all existing web sessions are lost. In addition, there is a slight delay while the standby node takes over as the active node. After the switchover is complete and the ANM fully initializes, you can log into ANM using the same VIP. All ANM functions remain the same. ANM uses heartbeat counts to determine when a failover should occur. Because both nodes are constantly sending and receiving heartbeat packets, if heartbeat packets are no longer being received on a node, its peer node is determined to be dead. If this peer node was the active node, then the standby node takes over as the active node. The VIP automatically associates with the newly active node, and the monitoring process starts any necessary processes on the newly active node that were not already running. Similarly, if you manually issue a failover to cause the active node to become the standby node, the heartbeat process disassociates the VIP from the node and tells the monitoring function to stop processes that are not normally run on the standby node. Related Topics • Understanding ANM High Availability Processes, page 13-3 • Configuring ANM High Availability Overview, page 13-3 • CLI Commands for ANM High Availability Processes, page 13-4 • Recovering From an HA Database Replication Failure, page 13-6 13-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Understanding ANM High Availability Understanding ANM High Availability Processes During normal high availability operation, the active node runs all ANM processes required for normal operation of ANM. The standby node runs only a minimal set of processes. Table 13-1 lists the processes, their descriptions, and on which node they run. Note If you are running standalone ANM, all processes show in Table 13-1, with the exception of the heartbeat process, are constantly running. Related Topics • CLI Commands for ANM High Availability Processes, page 13-4 • Understanding ANM High Availability, page 13-2 • Configuring ACE High Availability, page 13-14 • Understanding ACE Redundancy, page 13-6 Configuring ANM High Availability Overview Configuring ANM high availabitly depends on whether you are using ANM Virtual Appliance or ANM server. ANM Vitual Appliance You can implement redundancy for ANM Virtual Appliance using the high availability feature of the underlying VMware vSphere platform. VMware HA (High Availability) detects faults in the operation of managed virtual machines and provides redundancy in case of a failure. You implement VMware HA for ANM Virtual Appliance in the same manner as for any VM-based application running on VMware infrastructure; that is, ANM Virtual Appliance does not impose any special requirements for implementing VMware HA. For additional information about installing ANM Virtual Appliance, see the Installation Guide for the Cisco Application Networking Manager 5.2 Virtual Appliance. Table 13-1 ANM High Availability Processes Process Description Node on Which Process Runs Monit Starts, stops, restarts, and monitors local ANM processes Active and standby Heartbeat Provides UDP-based heartbeat between nodes, helps determine active vs. standby states, and associates the VIP Active and standby Mysql Provides persistent storage and implements database replication between active and standby nodes Active and standby ANM Java process Active node only DAL Java process Active node only Ip-disc Java process Active node only Licman Java process for license management Active and standby 13-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Understanding ANM High Availability ANM Server ANM high availability consists of two nodes, which both run the ANM software. Each node must have at least two network interfaces as follows: • A primary interface, normally used to access the node. • A heartbeat interface, which is used to provide additional redundancy. The heartbeat interfaces of the two nodes must be connected via a crossover Ethernet connection. • The two Ethernet interfaces used on one of the hosts should match the two interfaces used on the other host, with regard to the subnets they participate in. For example, if HA Node 1 uses eth0 for the primary interface and eth1 for the heartbeat interface, then HA Node 2 should also use eth0 for the primary interface and eth1 for the heartbeat interface. Note ANM does not configure the primary and heartbeat IP addresses of the nodes’ interfaces. You must manually configure the node’s interfaces. When you installed ANM, you provided values for high availability parameters, determined the node IDs of the two nodes designated as Node 1 and Node 2. For additional information about the installation parameters, see the Installation Guide for Cisco Application Networking Manager 5.2. Related Topics • Understanding ANM High Availability, page 13-2 • Configuring ACE High Availability Groups, page 13-17 • Configuring ACE High Availability, page 13-14 CLI Commands for ANM High Availability Processes You use two commands to view ANM processes: • Use the /opt/CSCOanm/bin/anm-tool command to start and stop the ANM processes and to view the status of the ANM processes. • Use the /opt/CSCOanm/bin/anm-ha command to check high availability configuration or to force a node to become standby or active. Table 13-2 lists the sub-commands and their descriptions. 13-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Understanding ANM High Availability Related Topics • Understanding ANM High Availability Processes, page 13-3 Table 13-2 CLI Sub-commands for Processes Command Sub-command Description /opt/CSCOanm/bin/anm-tool info-services Indicates the state of all ANM processes. This command does not return process status if monit is not running. stop-services Stops all ANM processes, including monit. Note Monit must be running in order for the info-services command to provide status information. Note When ANM is running in HA mode and the standby ANM is just starting up, the active ANM copies its entire database to the standby ANM. During the copy process, the active ANM cannot be stopped or restarted using the anm-tool command. Check the Admin > ANM Management page for the HA Replication Status and wait until the status is set to OK before attempting to stop ANM. start-services Starts the relevant ANM processes. restart-services Restarts the relevant ANM processes. Note When ANM is running in HA mode and the standby ANM is just starting up, the active ANM copies its entire database to the standby ANM. During the copy process, the active ANM cannot be stopped or restarted using the anm-tool command. Check the Admin > ANM Management page for the HA Replication Status and wait until the status is set to OK before attempting to restart ANM. info Provides additional information (state, whether running or stopped, start time, and PID) regarding the Java processes. Monit need not be running for this command to return information. /opt/CSCOanm/bin/anm-ha check Checks the local node’s high availability configuration. If errors are returned, HA might not function correctly until you fix the errors. Note You must run this command on both the active and standby node. While errors might indicate a problem, they could also simply indicate a known condition. For example, you receive a warning if the ANM cannot ping the peer node via either of the specified IP addresses; however, if the peer is down, the warning can be ignored because this is a known issue. It is also possible that no error might be returned even though there is a configuration problem. For example, the configuration of the two nodes must match; however the check sub-command cannot validate that the configurations match. active Forces the local node to become active and the peer node to become the standby node. standby Forces the local node to become standby and the peer node to become the active node. 13-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Understanding ACE Redundancy • Understanding ANM High Availability, page 13-2 • Configuring ACE High Availability, page 13-14 • Understanding ACE Redundancy, page 13-6 Recovering From an HA Database Replication Failure This section provides an overview of the database replication process that occurs between ANM HA active and standby nodes and how to recover from a replication failure. When the active ANM is running and the standby ANM is just starting up, the active ANM copies its entire database to the standby ANM. This process normally takes from a few seconds to a few minutes depending on the size of the configuration data and monitoring data. During the replication process, the active ANM database is locked and the active ANM cannot be stopped or restarted using the anm-tool command nor can it perform a failover. It is possible for the database replication process to fail if the standby ANM is stopped or powered down, the connectivity is down, or the active ANM is powered down. The failure of the replication process does not affect the integrity of the active ANM database. The procedure in this section describes what to do if you encounter a replication failure. Procedure Step 1 Check the standby ANM and make sure that it has stopped. If the standby ANM is still running, stop it because its database might be incomplete due to the replication failure. Step 2 Check the connectivity between the active ANM and standby ANM and make sure that both links are up and connected. Step 3 Do one of the following: • If the active ANM is still running, login and check to see that its configuration is normal. • If the active ANM has stopped or powered down, restart it now. Step 4 After the active ANM is running normally, restart the standby ANM. Caution Do not restart the standby ANM before the active ANM is running and operating normally. Step 5 From the standby ANM GUI, choose Admin > ANM Management to display the ANM Server window and make sure that the HA Replication Status is set to OK before performing any daily management tasks. Understanding ACE Redundancy ACE module redundancy (or fault tolerance) uses a maximum of two ACEs in the same Catalyst 6500 switch or in separate switches to ensure that your network remains operational even if one of the modules becomes unresponsive. 13-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Understanding ACE Redundancy ACE appliance redundancy uses a maximum of two ACEs to ensure that your network remains operational even if one of the ACE appliances becomes unresponsive. Note Redundancy is supported between ACEs of the same type only. Redundancy is not supported between an ACE appliance and an ACE module operating as peers. Redundancy must be of the same ACE device type and software version. For additional information about ACE redundancy, see either the Cisco Application Control Engine Module Administration Guide or the Cisco 4700 Series Application Control Engine Appliance Administration Guide. This section includes the following topics: • ACE High Availability Polling, page 13-7 • ACE Redundancy Protocol, page 13-8 • ACE Stateful Failover, page 13-9 • ACE Fault-Tolerant VLAN, page 13-10 • ACE Configuration Synchronization, page 13-11 • ACE Redundancy Configuration Requirements and Restrictions, page 13-12 • ACE High Availability Troubleshooting Guidelines, page 13-12 ACE High Availability Polling Approximately every two minutes, the ANM issues the show ft group command to the ACE to gather the redundancy statistics of each virtual context. The state information is displayed in the HA State and HA Autosync fields when you click Config > Devices > virtual context. Note To display statistics and status information for a particular high availability group displayed in the High Availability (HA) Setup window (Config > Devices > admin_context > High Availability (HA) > Setup), see the “Displaying High Availability Group Statistics and Status” section on page 13-21. The possible HA states are as follows: • Active—Local member of the FT group is active and processing flows. • Standby Cold—Indicates if the FT VLAN is down but the peer ACE is still alive, or the configuration or application state synchronization failed. When a context is in this state and a switchover occurs, the transition to the ACTIVE state is stateless. • Standby Bulk—Local standby context is waiting to receive state information from its active peer context. The active peer context receives a notification to send a snapshot of the current state information for all applications to the standby context. • Standby Hot—Local standby context has all the state information it needs to statefully assume the active state if a switchover occurs. • Standby Warm—Allows the configuration and state synchronization process to continue on a best-effort basis when you upgrade or downgrade the ACE software. 13-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Understanding ACE Redundancy • Inconclusive—Indicates that ANM was able to determine that the given ACE was configured in HA, however ANM was able to find more than one ACE module or ACE appliance that appeared to be a peer. In this case, ANM was unable to conclusively find a unique HA peer for the given ACE module or ACE appliance. For additional details on addressing this state, see the “ANM Requirements for ACE High Availability” section on page 5-8 for details. Inconclusive is not shown in the HA State field but is shown in the HA Peer field. It is possible that a context HA peer is inconclusive, but its HA State and HA Peer state are still shown normally because these states are from context polling from the ACE device. Note When you upgrade or downgrade the ACE from one software version to another, there is a point in the process when the two ACEs have different software versions and, therefore, a software incompatibility. When the Standby Warm state appears, this means that the active ACE will continue to synchronize configuration and state information to the standby even though the standby may not recognize or understand the software commands or state information. This standby state allows the standby ACE to come up with best-effort support. Related Topics • ACE High Availability Polling, page 13-7 • ACE Redundancy Protocol, page 13-8 ACE Redundancy Protocol You can configure a maximum of two ACEs of the same type (peers) for redundancy in the same Catalyst 6500 switch or in different chassis for redundancy. Each peer ACE can contain one or more fault-tolerant (FT) groups. Each FT group consists of two members: one active context and one standby context. An FT group has a unique group ID that you assign. Note For the replication process to function properly and successfully replicate the configuration for a user context when switching from the active context to the standby context, ensure that each user context has been added to the FT group. All applicable user contexts must be part of an FT group for redundancy to function properly. One virtual MAC address (VMAC) is associated with each FT group. The format of the VMAC is: 00-0b-fc-fe-1b-groupID. Because a VMAC does not change upon switchover, the client and server ARP tables does not require updating. The ACE selects a VMAC from a pool of virtual MACs available to it. For more information, see the “Configuring Virtual Contexts” section on page 6-8. Each FT group acts as an independent redundancy instance. When a switchover occurs, the active member in the FT group becomes the standby member and the original standby member becomes the active member. A switchover can occur for the following reasons: • The active member becomes unresponsive. • A tracked host or interface fails. • You force a switchover for a high availability group by clicking Switchover in the HA Groups table (see the “Switching Over an ACE High Availability Group” section on page 13-22). 13-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Understanding ACE Redundancy To outside nodes (clients and servers), the active and standby FT group members appear as one node with respect to their IP addresses and associated VMAC. ACE provides active-active redundancy with multiple contexts only when there are multiple FT groups configured on each ACE and both devices contain at least one active group member (context). With a single context, the ACE supports active-backup redundancy and each group member is an Admin context. The ACE sends and receives all redundancy-related traffic (protocol packets, configuration data, heartbeats, and state replication packets) on a dedicated FT VLAN. You cannot use this dedicated VLAN for normal traffic. To optimize the transmission of heartbeat packets for multiple FT groups and to minimize network traffic, the ACE sends and receives heartbeat messages using a separate process. The ACE uses the heartbeat to probe the peer ACE, rather than probe each context. When an ACE does not receive a heartbeat from the peer ACE, all the contexts in the standby state become active. The ACE sends heartbeat packets over UDP. You can set the frequency with which the ACE sends heartbeat packets as part of the FT peer configuration. For details about configuring the heartbeat, see the “Configuring ACE High Availability Peers” section on page 13-15. The election of the active member within each FT group is based on a priority scheme. The member configured with the higher priority is elected as the active member. If a member with a higher priority is found after the other member becomes active, the new member becomes active because it has a higher priority. This behavior is known as preemption and is enabled by default. You can override this default behavior by disabling preemption. To disable preemption, use the Preempt parameter. Enabling Preempt causes the member with the higher priority to assert itself and become active. For details about configuring preemption, see the “Configuring ACE High Availability Groups” section on page 13-17. For additional information about ACE redundancy, see either the Cisco Application Control Engine Module Administration Guide or the Cisco 4700 Series Application Control Engine Appliance Administration Guide. Related Topics • Understanding ACE Redundancy, page 13-6 • ACE High Availability Polling, page 13-7 ACE Stateful Failover The ACE replicates flows on the active FT group member to the standby group member per connection for each context. The replicated flows contain all the flow-state information necessary for the standby member to take over the flow if the active member becomes unresponsive. If the active member becomes unresponsive, the replicated flows on the standby member become active when the standby member assumes mastership of the context. The active flows on the former active member transition to a standby state to fully back up the active flows on the new active member. Note For the replication process to function properly and successfully replicate the configuration for a user context when switching from the active context to the standby context, ensure that the user context has been added to the FT group. All applicable user contexts must be part of an FT group for redundancy to function properly. Note By default, connection replication is enabled in the ACE. 13-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Understanding ACE Redundancy After a switchover occurs, the same connection information is available on the new active member. Supported end-user applications do not need to reconnect to maintain the same network session. The state information passed to the standby ACE includes the following data: • Network Address Translation (NAT) table based on information synchronized with the connection record • All Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) connections not terminated by the ACE • HTTP connection states (Optional) • Sticky table Note In a user context, the ACE allows a switchover only of the FT group that belongs to that context. In the Admin context, the ACE allows a switchover of all FT groups in all configured contexts in the ACE. To ensure that bridge learning occurs quickly upon a switchover in a Layer 2 configuration in the case where a VMAC moves to a new location, the new active member sends a gratuitous ARP on every interface associated with the active context. Also, when there are two VLANs on the same subnet and servers need to send packets to clients directly, the servers must know the location of the gateway on the client-side VLAN. The active member acts as the bridge for the two VLANs. In order to initiate learning of the new location of the gateway, the new active member sends an ARP request to the gateway on the client VLAN and bridges the ARP response onto the server VLAN. For additional information about ACE redundancy, see either the Cisco Application Control Engine Module Administration Guide or Cisco 4700 Series Application Control Engine Appliance Administration Guide. Related Topics • Understanding ACE Redundancy, page 13-6 ACE Fault-Tolerant VLAN ACE redundancy uses a dedicated fault-tolerant VLAN between redundant ACEs of the same type to transmit flow-state information and the redundancy heartbeat. Do not use this dedicated VLAN for normal network traffic. You must configure this same VLAN on both peers. You also must configure a different IP address within the same subnet on each ACE for the fault-tolerant VLAN. The two redundant ACEs constantly communicate over the fault-tolerant VLAN to determine the operating status of each ACE. The standby member uses the heartbeat packet to monitor the health of the active member. The active member uses the heartbeat packet to monitor the health of the standby member. Communications over the switchover link include the following data: • Redundancy protocol packets • State information replication data • Configuration synchronization information • Heartbeat packets 13-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Understanding ACE Redundancy For multiple contexts, the fault-tolerant VLAN resides in the system configuration data. Each fault-tolerant VLAN on the ACE has one unique MAC address associated with it. The ACE uses these ACE MAC addresses as the source or destination MACs for sending or receiving redundancy protocol state and configuration replication packets. Note The IP address and the MAC address of the fault-tolerant VLAN do not change at switchover. For additional information about ACE redundancy, see either the Cisco Application Control Engine Module Administration Guide or the Cisco 4700 Series Application Control Engine Appliance Administration Guide. Related Topics Understanding ACE Redundancy, page 13-6 ACE Configuration Synchronization For redundancy to function properly, both members of an fault-tolerant group must have identical configurations. The ACE automatically replicates the active configuration on the standby member using a process called configuration synchronization (config sync). Config sync automatically replicates any changes made to the configuration of the active member to the standby member. After the ACE synchronizes the redundancy configuration from the active member to the standby peer, it disables configuration mode on the standby. See the “Configuring ACE High Availability Peers” section on page 13-15. Note The Application Networking Manager manages local configurations only. When ANM detects a pair of ACE peers operating in high availability (HA), ANM allows you to make configuration changes on either the active or standby ACE. ANM then automatically (and seamlessly) pushes the configuration to the active ACE and locally replicates the configuration on the standby imported into ANM. This action is similar to what is performed by the ACE to the peers. Note Keep in mind that the configuration pushed while the standby ACE has been selected does not mean that ANM pushed the configuration to the standby ACE. Typically, with auto-sync turned off, configuration changes are disabled on the standby ACE. In this case, ANM tries to push the configuration to the active ACE in the HA device pair. For additional information about ACE redundancy, see either the Cisco Application Control Engine Module Administration Guide or Cisco 4700 Series Application Control Engine Appliance Administration Guide. Related Topics • Understanding ACE Redundancy, page 13-6 • Synchronizing ACE High Availability Configurations, page 13-30 • Synchronizing SSL Certificate and Key Pairs on Both ACE Peers, page 13-32 13-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Understanding ACE Redundancy ACE Redundancy Configuration Requirements and Restrictions Follow these requirements and restrictions when configuring the ACE redundancy feature. • In bridged mode (Layer 2), two contexts cannot share the same VLAN. • To achieve active-active redundancy, a minimum of two contexts and two fault-tolerant groups are required on each ACE. • When you configure redundancy, the ACE keeps all interfaces that do not have an IP address in the Down state. The IP address and the peer IP address that you assign to a VLAN interface should be in the same subnet, but different IP addresses. For more information about configuring VLAN interfaces, see the “Configuring Virtual Context VLAN Interfaces” section on page 12-6. • When importing an ACE HA pair into ANM, follow one of the configuration requirements outlined below for ANM to uniquely identify the ACE HA pair: – Use a unique combination of FT interface VLAN and FT IP address/peer IP address for every ACE HA pair imported into ANM. For HA, it is critical that the combination of FT interface VLAN and IP address/peer IP address always be unique across every pair of ACE peer devices. – Define a peer IP address in the management interface, using the management IP address of the peer ACE (module or appliance). Note that the management IP address and management peer IP address used for this definition should be the management IP address used to import both ACE devices into ANM. For more information about the use of multiple HA pairs imported into ANM, see the “ANM Requirements for ACE High Availability” section on page 5-8 For additional information about ACE redundancy, see either the Cisco Application Control Engine Module Administration Guide or the Cisco 4700 Series Application Control Engine Appliance Administration Guide. Related Topics • Understanding ANM High Availability, page 13-2 ACE High Availability Troubleshooting Guidelines This section provides the following set of guidelines for troubleshooting an ACE high availability (or redundancy) configuration in ANM: • If the high availability setup of two ACE devices is successful, the HA State field of the ACE HA Management table should indicate no errors. If the HA State field does not read Compatible, verify that both ACE devices are the same type of hardware. ACE modules cannot be synchronized with ACE appliances. • If the high availability setup of two ACE devices is successful, the License Compatibility and SRG Compatibility fields of the show ft peer CLI command output on the ACE (module or appliance) should indicate no errors. See either the Cisco Application Control Engine Module Administration Guide or Cisco 4700 Series Application Control Engine Appliance Administration Guide for details on the show ft peer CLI command. – If the SRG Compatibility field indicates a problem, this means that the versions of the ACE software running on the devices are not compatible with each other. One or both of the devices will need to have an appropriate version of the ACE software installed before they can be synchronized. 13-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Understanding ACE Redundancy – If the License Compatibility field indicates a licensing problem, go to the Licenses page of ACE Hardware Setup (see the “Using ACE Hardware Setup” section on page 3-5) and make sure each ACE device has a valid license installed. Licenses must be installed on each device separately because each license is only valid for one hardware device. For proper HA functionality, the licenses on both ACEs in the pair must be also compatible with each other. This means both licenses must permit the same bandwidth and the same number of virtual contexts. Note If the licenses' bandwidth limits do not match, configuration synchronization may appear to work (although Admin context synchronization may actually not be functional), and the License Compatibility field may not show an error. However, failover from the higher bandwidth ACE to a lower bandwidth ACE could result in loss of traffic. 13-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Configuring ACE High Availability Configuring ACE High Availability The tasks involved with configuring high availability on ACE devices are described in Table 13-3. Related Topics • Understanding ACE Redundancy, page 13-6 • Configuring ACE High Availability Peers, page 13-15 • Configuring ACE High Availability Groups, page 13-17 • ACE High Availability Tracking and Failure Detection Overview, page 13-23 • Synchronizing ACE High Availability Configurations, page 13-30 • Synchronizing SSL Certificate and Key Pairs on Both ACE Peers, page 13-32 Table 13-3 High Availability Task Overview Task Reference Step 1 Create a fault-tolerant VLAN and identify peer IP addresses and configure peer devices for heartbeat count and interval. Configuring ACE High Availability Peers, page 13-15 Step 2 Reconcile SSL certificates and keys, create a fault-tolerant group, assign peer priorities, associate the group with a context, place the group in service, and enable automatic synchronization. Configuring ACE High Availability Groups, page 13-17 Step 3 Configure tracking for switchover. ACE High Availability Tracking and Failure Detection Overview, page 13-23 13-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Configuring ACE High Availability Peers Configuring ACE High Availability Peers Note This functionality is available for only Admin contexts. Fault-tolerant peers transmit and receive heartbeat packets and state and configuration replication packets. The standby member uses the heartbeat packet to monitor the health of the active member, while the active member uses the heartbeat packet to monitor the health of the standby member. When the heartbeat packets are not received from the active member when expected, switchover occurs and the standby member assumes all active communications previously on the active member. Use this procedure to do the following tasks: • Identify the two members of a high availability pair. • Assign IP addresses to the peer ACEs. • Assign a fault-tolerant VLAN to high availability peers and bind a physical gigabit Ethernet interface to the FT VLAN. • Configure heartbeat frequency and count on the ACEs in a fault-tolerant VLAN. Note For ANM to properly manage high availability peers, ensure that the combination of FT interface VLAN along with IP and peer IP address always be unique across every pair of ACE devices in high availability when those devices are imported into ANM. For details, see the “ANM Requirements for ACE High Availability” section on page 5-8. Assumption At least one fault-tolerant VLAN has been configured. Note A fault-tolerant VLAN cannot be used for other network traffic. Procedure Step 1 Choose Config > Devices > admin_context > High Availability (HA) > Setup. The HA Management window appears with two columns; one for the selected ACE and one for a peer ACE. Step 2 Click Edit and enter the information for the primary ACE and the peer ACE as described in Table 13-4. Table 13-4 High Availability Management Configuration Attributes Field This Device Peer Device Module Name of the ACE Not applicable. VLAN Fault-tolerant VLAN to be used for this high availability pair. Valid entries are from 1 to 4094. Note This VLAN cannot be used for other network traffic. Not applicable. 13-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Configuring ACE High Availability Peers Step 3 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. Continue with configuring high availability groups. The HA Management window appears at the top of the content area and the HA Groups table appears at the bottom. See the “Configuring ACE High Availability Groups” section on page 13-17 to configure a high availability group. • Click Cancel to exit this procedure without saving your entries and to view the HA Management window. Related Topics • Understanding ANM High Availability, page 13-2 • Configuring ACE High Availability, page 13-14 • Configuring ACE High Availability Groups, page 13-17 • Synchronizing ACE High Availability Configurations, page 13-30 IP Address IP address for the fault-tolerant VLAN in dotted-decimal format, such as 192.168.11.2. Enter the IP address of the peer interface in dotted-decimal format so that the peer ACE can communicate on the fault-tolerant VLAN. Netmask Subnet mask that is to be used for the fault-tolerant VLAN. Not applicable. Query VLAN VLAN that the standby ACE is to use to determine whether the active ACE is down or if there is a connectivity problem with the fault-tolerant VLAN. Choose the VLAN that the standby ACE is to use to determine whether the active ACE is down or if there is a connectivity problem with the fault-tolerant VLAN. Heartbeat Count Number of heartbeat intervals that must occur with no heartbeat packet received by the standby ACE before the standby ACE determines that the active member is not available. Valid entries are from 10 to 50. Not applicable. Heartbeat Interval Number of milliseconds that the active ACE is to wait between each heartbeat it sends to the standby ACE. Valid entries are from 100 to 1000. Not applicable. Interface Enabled Interface Enabled check box that enables the high availability interface. Uncheck the check box to disable the high availability interface. Not applicable. Shared VLAN Host ID Specific bank of MAC addresses that the ACE uses. Enter a number from 1 to 16. Be sure to configure different bank numbers for multiple ACEs. Not applicable. Peer Shared VLAN Host ID Specific bank of MAC addresses for the same ACE in a redundant configuration. Valid entries are from 1 to 16. Be sure to configure different bank numbers for multiple ACEs. Not applicable. HA State Read-only field with the current state of high availability on the ACE. Not applicable. Table 13-4 High Availability Management Configuration Attributes (continued) Field This Device Peer Device 13-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Clearing ACE High Availability Pairs • Synchronizing SSL Certificate and Key Pairs on Both ACE Peers, page 13-32 • Tracking ACE VLAN Interfaces for High Availability, page 13-24 Clearing ACE High Availability Pairs Note This functionality is available for only Admin contexts. You can remove a high availability link between two ACEs. Procedure Step 1 Choose Config > Devices > admin_context > High Availability (HA) > Setup. The HA Management window appears. Step 2 Choose the ACE pair whose high availability configuration that you want to remove, and click Clear. A message appears asking you to confirm the clearing of the high availability link. Step 3 Do one of the following: • Click OK to confirm the removal of this high availability link and to return to the HA Management window. • Click Cancel to exit this procedure without removing this high availability link and to return to the HA Management window. Related Topics • Understanding ANM High Availability, page 13-2 • Configuring ACE High Availability Peers, page 13-15 • Editing High Availability Groups, page 13-19 • ACE High Availability Tracking and Failure Detection Overview, page 13-23 • Tracking ACE VLAN Interfaces for High Availability, page 13-24 • Tracking Hosts for High Availability, page 13-25 Configuring ACE High Availability Groups Note This functionality is available for only Admin contexts. You can configure a high availability group, or fault-tolerant group, which consists of a maximum of two contexts: One active context on one ACE and one standby context on the peer ACE. You can create multiple fault-tolerant groups on each ACE up to a maximum of: • For the ACE module—251 groups (250 user contexts and 1 Admin context). • For the ACE appliance—21 groups (20 user contexts and 1 Admin context). 13-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Configuring ACE High Availability Groups Note For the replication process to function properly and successfully replicate the configuration for a user context when switching from the active context to the standby context, ensure that each user context has been added to the FT group. All applicable user contexts must be part of an FT group for redundancy to function properly. Assumption At least one high availability pair has been configured (see the “Configuring ACE High Availability Peers” section on page 13-15). Procedure Step 1 Choose Config > Devices > admin_context > High Availability (HA) > Setup. The HA Management window appears at the top of the content area and the HA Groups table appears at the bottom. Step 2 In the HA Groups table of the HA Management window, click Add to add a new high availability group. The table refreshes with the configurable fields. Step 3 Check the Enabled check box to enable the high availability group. Uncheck the Enabled check box to disable the high availability group. Step 4 In the Context field, choose the virtual context to associate with this high availability group. Step 5 In the Priority (Actual) field, enter the priority that you want to assign to the first device in the group. Valid entries are from 1 to 255. A member of a fault-tolerant group becomes the active member through a process based on the priority assigned. In this process, the group member with the higher priority becomes the active member. When you set up a fault-tolerant pair, use a higher priority for the group where the active member initially resides. Step 6 Check the Preempt check box to specify that the group member with the higher priority is to always assert itself and become the active member. Uncheck the Preempt check box to specify that you do not want the group member with the higher priority to always become the active member. Step 7 In the Peer Priority (Actual) field, enter the priority that you want to assign to the peer device in the group. Valid entries are from 1 to 255. A member of a fault-tolerant group becomes the active member through a process based on the priority assigned. In this process, the group member with the higher priority becomes the active member. When you set up a fault-tolerant pair, use a higher priority for the group where the active member initially resides. Step 8 Check the Autosync Run check box to enable automatic synchronization of the running configuration files. Uncheck the Autosync Run check box to disable automatic synchronization of the running configuration files. If you disable automatic synchronization, you need to update the configuration of the standby context manually. See the “Synchronizing Virtual Context Configurations” section on page 6-105. 13-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Configuring ACE High Availability Groups Note If you check Autosync Run for the HA group, you must manually sync the standby context in order for ANM to allow subsequent configuration changes. Until you have done this, the standby context will be marked out of sync. See the “Synchronizing Virtual Context Configurations in High Availability Mode” section on page 13-31. Step 9 Check the Autosync Startup check box to enable automatic synchronization of the startup configuration files. Uncheck the Autosync Run check box to disable automatic synchronization of the startup configuration files. If you disable automatic synchronization, you need to update the configuration of the standby context manually. See the “Synchronizing Virtual Context Configurations” section on page 6-105. Step 10 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The HA Groups table refreshes with the new high availability group. • Click Cancel to exit this procedure without saving your entries and to return to the HA Management window and HA Groups table. Step 11 (Optional) To display statistics and status information for a particular high availability group, choose the group from the ACE HA Groups table, and click Details. The show ft group group_id detail CLI command output appears. See the “Displaying High Availability Group Statistics and Status” section on page 13-21 for details. Related Topics • Configuring ACE High Availability Peers, page 13-15 • Editing High Availability Groups, page 13-19 • Synchronizing Virtual Context Configurations, page 6-105 • Synchronizing SSL Certificate and Key Pairs on Both ACE Peers, page 13-32 • Tracking ACE VLAN Interfaces for High Availability, page 13-24 • Tracking Hosts for High Availability, page 13-25 Editing High Availability Groups Note This functionality is available for only Admin contexts. You can modify the attributes of a high availability group. Note If you need to modify a fault-tolerant group, take the group out of service before making any other changes (see the “Taking a High Availability Group Out of Service” section on page 13-20). When you finish making all changes, place the group back into service (see the “Enabling a High Availability Group” section on page 13-21). 13-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Configuring ACE High Availability Groups Procedure Step 1 Choose Config > Devices > admin_context > High Availability (HA) > Setup. The HA Management window appears at the top of the content area and the HA Groups table appears at the bottom. Step 2 In the HA Groups table, choose the high availability group that you want to modify, and click Edit. The table refreshes with configurable fields. Step 3 Modify the fields as desired. For information on these fields, see the “Configuring ACE High Availability Groups” section on page 13-17. Note If you leave unchecked Autosync Run for the HA group, you must manually sync the standby context in order for ANM to allow subsequent configuration changes. Until you have done this, the standby context will be marked out of sync. See the “Synchronizing Virtual Context Configurations in High Availability Mode” section on page 13-31. Step 4 When you finish modifying this group, do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the HA Groups table. • Click Cancel to exit this procedure without saving your entries and to return to the HA Management window. Related Topics • Configuring ACE High Availability Groups, page 13-17 • Taking a High Availability Group Out of Service, page 13-20 • Enabling a High Availability Group, page 13-21 • Configuring ACE High Availability Peers, page 13-15 • ACE High Availability Tracking and Failure Detection Overview, page 13-23 Taking a High Availability Group Out of Service Note This functionality is available for only Admin contexts. You can take a high availability group out of service, which you must do before you can modify it. Procedure Step 1 Choose Config > Devices > admin_context > High Availability (HA) > Setup. The HA Management window appears at the top of the content area and the HA Groups table appears at the bottom. 13-21 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Displaying High Availability Group Statistics and Status Step 2 In the HA Groups table, choose the high availability group you want to take out of service, and click Edit. The table refreshes with configurable fields. Step 3 Uncheck the Enabled check box. Step 4 Click Deploy Now to take the high availability group out of service and to return to the HA Groups table. You can now make the necessary modifications to the high availability group. To put the high availability group back in service, see the “Enabling a High Availability Group” section on page 13-21. Related Topics Enabling a High Availability Group, page 13-21 Enabling a High Availability Group Note This functionality is available for only Admin contexts. You can put a high availability group back into service after taking it out of service. Procedure Step 1 Choose Config > Devices > admin_context > High Availability (HA) > Setup. The HA Management window appears at the top of the content area and the HA Groups table appears at the bottom. Step 2 In the HA Groups table, choose the high availability group you want to take out of service, and click Edit. The table refreshes with configurable fields. Step 3 Check the Enabled check box. Step 4 Click Deploy Now to put the high availability group in service and to return to the HA Groups table. Related Topics Taking a High Availability Group Out of Service, page 13-20 Displaying High Availability Group Statistics and Status You can display statistics and status information for a particular high availability group by using the Details button. ANM accesses the show ft group group_id detail CLI command to display detailed ACE HA group information. Procedure Step 1 Choose Config > Devices > admin_context > High Availability (HA) > Setup. 13-22 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Switching Over an ACE High Availability Group The HA Management window appears at the top of the content area and the HA Groups table appears at the bottom. Step 2 Choose an ACE HA group from the ACE HA Groups table and click Details. The show ft group group_id detail CLI command output appears. For details on the displayed output fields, see either the Cisco ACE Module Administration Guide or the Cisco ACE 4700 Series Appliance Administration Guide. Step 3 Click Update Details to refresh the output for the show ft group group_id detail CLI command. Step 4 Click Close to return to the VLAN Interfaces table. Switching Over an ACE High Availability Group Note This functionality is available for only Admin contexts. You can force the failover of a high availability group. You may need to force a switchover when you want to make a particular context the standby (for example, for maintenance or a software upgrade on the currently active context). If the standby group member can statefully become the active member of the high availability group, a switchover occurs. Procedure Step 1 Choose Config > Devices > admin_context > High Availability (HA) > Setup. The HA Management window appears at the top of the content area and the HA Groups table appears at the bottom. Step 2 In the HA Groups table, choose the group that you want to switch over, and click Switchover. The standby group member becomes active, while the previously active group member becomes the standby member. Note You must manually sync the standby context in order for ANM to allow subsequent configuration changes. Until you have done this, the standby context will be marked out of sync. See the “Synchronizing Virtual Context Configurations in High Availability Mode” section on page 13-31. Related Topics • Understanding ANM High Availability, page 13-2 • Configuring ACE High Availability Peers, page 13-15 • Configuring ACE High Availability Groups, page 13-17 • Synchronizing SSL Certificate and Key Pairs on Both ACE Peers, page 13-32 • Tracking ACE VLAN Interfaces for High Availability, page 13-24 13-23 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Deleting ACE High Availability Groups Related Topics • Understanding ANM High Availability, page 13-2 • Configuring ACE High Availability Peers, page 13-15 • Configuring ACE High Availability Groups, page 13-17 Deleting ACE High Availability Groups Note This functionality is available for only Admin contexts. You can remove a high availability group from ANM management. Procedure Step 1 Choose Config > Devices > admin_context > High Availability (HA) > Setup. The HA Management window appears at the top of the content area and the HA Groups table appears at the bottom. Step 2 In the HA Groups table, choose the high availability group that you want to remove, and click Delete. A message appears asking you to confirm the deletion. Step 3 Do one of the following: • Click Deploy Now to delete the high availability group and to return to the HA Groups table. The selected group no longer appears. • Click Cancel to exit this procedure without deleting the high availability group and to return to the HA Groups table. Related Topics • Configuring ACE High Availability Peers, page 13-15 • Configuring ACE High Availability Groups, page 13-17 • Tracking ACE VLAN Interfaces for High Availability, page 13-24 ACE High Availability Tracking and Failure Detection Overview ANM supports the tracking and detection of failures to ensure that switchover occurs as soon as the criteria are met (see Configuring ACE High Availability Peers, page 13-15). You can track and detect failures on the following: • Hosts—See Tracking Hosts for High Availability, page 13-25. • Interfaces—See Tracking ACE VLAN Interfaces for High Availability, page 13-24. When the active member of a fault-tolerant group becomes unresponsive, the following occurs: 1. The active member’s priority is reduced by 10. 13-24 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Tracking ACE VLAN Interfaces for High Availability 2. If the resulting priority value is less than that of the standby member, the active member switches over and the standby member becomes the new active member. All active flows continue uninterrupted. 3. When the failed member comes back up, its priority is incremented by 10. 4. If the resulting priority value is greater than that of the currently active member, a switchover occurs again, returning the flows to the originally active member. Note In a user context, the ACE allows a switchover only of the fault-tolerant groups belonging to that context. In an Admin context, the ACE allows a switchover of all fault-tolerant groups on all configured contexts on the ACE. Related Topics • Configuring ACE High Availability Groups, page 13-17 • Tracking ACE VLAN Interfaces for High Availability, page 13-24 • Tracking Hosts for High Availability, page 13-25 Tracking ACE VLAN Interfaces for High Availability You can configure a tracking and failure detection process for a VLAN interface. Procedure Step 1 Choose Config > Devices > admin_context > HA Tracking And Failure Detection > Interfaces. The Track Interface table appears. Step 2 Click Add to add a new tracking process to this table, or choose an existing entry and click Edit to modify it. The Track Interface configuration window appears. Step 3 In the Track Object Name field of the Track Interface configuration window, enter a unique identifier for the tracking process. Valid entries are unquoted text strings with no spaces. Step 4 In the Priority field, enter the priority for the interface on the active member. Valid entries are from 0 to 255 with higher values indicating higher priorities. The values that you enter here and in the Interface Peer Priority field (see Step 6) reflect the point at which you want switchover to occur. If the tracked interface goes down, the priority of that fault-tolerant group is decremented by the value entered in the Priority field. If the priority of the fault-tolerant group on the active member falls below that of the standby member, a switchover occurs. Step 5 In the VLAN Interface field, choose the fault-tolerant VLAN that you want the active member to track. Step 6 In the Interface Peer Priority field, enter the priority for the interface on the standby member. Valid entries are from 0 to 255 with higher values indicating higher priorities. The values that you enter here and in the Priority field (See Step 4) reflect the point at which you want switchover to occur. If the tracked interface goes down, the priority of that fault-tolerant group is decremented by the value entered in the Interface Peer Priority field. If the priority of the fault-tolerant group on the active member falls below that of the standby member, a switchover occurs. 13-25 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Tracking Hosts for High Availability Step 7 In the Peer VLAN Interface field, enter the identifier of an existing fault-tolerant VLAN that you want the standby member to track. Valid entries are from 1 to 4096. Step 8 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Track Interface table. • Click Cancel to exit this procedure without saving your entries and to return to the Track Interface table. • Click Next to deploy your entries and to configure the next entry in the Track Interface table. Related Topics • Configuring ACE High Availability Peers, page 13-15 • Configuring ACE High Availability Groups, page 13-17 • Tracking Hosts for High Availability, page 13-25 Tracking Hosts for High Availability You can configure a tracking and failure detection process for a gateway or host. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Procedure Step 1 Choose Config > Devices > admin_context > HA Tracking And Failure Detection > Hosts. The Track Host table appears. Step 2 In the Track Host table, click Add to add a new tracking process to the table, or choose an existing entry and click Edit to modify it. The Track Host configuration window appears. Step 3 In the Track Object Name field of the Track Host configuration window, enter a unique identifier for the tracking process. Valid entries are unquoted text strings with no spaces. Step 4 In the IP Address Type field, choose either IPv4 or IPv6 for the host address type. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. Step 5 In the Track Host/IP Address field, enter the IPv4 or IPv6 address or hostname of the gateway or host that you want the active member of the high availability group to track. Step 6 In the Priority field, enter the priority of the probe sent by the active member. 13-26 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Configuring Host Tracking Probes Valid entries are from 0 to 255. Higher values indicate higher priorities. Assign a priority value based on the relative importance of the host that the probe is tracking. If the probe goes down, the ACE decrements the priority of the fault-tolerant group on the active member by the value in the Priority field. Step 7 In the Peer Host/IP Address field, enter the IPv4 or IPv6 address or hostname of the host that you want the standby member to track. Step 8 In the Peer Priority field, enter the priority of the probe sent by the standby member. Valid entries are from 0 to 255. Higher values indicate higher priorities. Assign a priority value based on the relative importance of the host that the probe is tracking. If the probe goes down, the ACE decrements the priority of the fault-tolerant group on the standby member by the value in the Priority field. Step 9 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. Continue with configuring track host probes. See Configuring Host Tracking Probes, page 13-26. • Click Cancel to exit this procedure without saving your entries and to return to the Track Host table. • Click Next to deploy your entries and to configure another tracking process. Related Topics • Configuring Host Tracking Probes, page 13-26 • Configuring ACE High Availability Peers, page 13-15 • Configuring ACE High Availability Groups, page 13-17 • Tracking ACE VLAN Interfaces for High Availability, page 13-24 Configuring Host Tracking Probes You can configure probes on the active high availability group member to track the health of the gateway or host. Assumptions This topic assumes the following: • At least one host tracking process for high availability has been configured (see Tracking Hosts for High Availability, page 13-25.) • At least one health monitoring probe has been configured (see Configuring Health Monitoring for Real Servers, page 8-51). Procedure Step 1 Choose Config > Devices > admin_context > HA Tracking And Failure Detection > Hosts. The Track Host table appears. Step 2 Choose the tracking process that you want to modify, and click the Peer Track Host Probe tab. The Peer Track Host Probes table appears. 13-27 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Configuring Host Tracking Probes Step 3 In the Peer Track Host Probes table, click Add to add a peer host tracking probe, or choose an existing peer host tracking probe and click Edit to modify it. The Peer Track Host Probes configuration window appears. Step 4 In the Probe Name field, choose the name of the probe to be used for the peer host tracking process. Step 5 In the Priority field, enter a priority for the host that you are tracking by the active member. Valid entries are from 1 to 255 with higher values indicating higher priorities. Assign a priority value based on the relative importance of the gateway or host that the probes are tracking. If the host goes down, the ACE decrements the priority of the high availability group on the standby member by the value in this Priority field. Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Track Host Probe table. The table includes the added probe. • Click Cancel to exit this procedure without saving your entries and to return to the Track Host Probe table. • Click Next to deploy your entries and to configure another track host probe. Related Topics • Configuring ACE Peer Host Tracking Probes, page 13-28 • Configuring ACE High Availability Peers, page 13-15 • Configuring ACE High Availability Groups, page 13-17 • Tracking ACE VLAN Interfaces for High Availability, page 13-24 Deleting Host Tracking Probes You can remove a high availability host tracking probe. Procedure Step 1 Choose Config > Devices > ACE admin_context > HA Tracking And Failure Detection > Hosts. The Track Host table appears. Step 2 In the Track Host table, choose the tracking process you want to modify, and click the Track Host Probe tab. The Track Host Probe table appears. Step 3 In the Track Host table, choose the probe that you want to remove, and click Delete. The probe is deleted and the Track Host Probe table refreshes without the deleted probe. Related Topics • Configuring ACE Peer Host Tracking Probes, page 13-28 • Configuring ACE High Availability Peers, page 13-15 13-28 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Configuring ACE Peer Host Tracking Probes • Configuring ACE High Availability Groups, page 13-17 • Tracking ACE VLAN Interfaces for High Availability, page 13-24 Configuring ACE Peer Host Tracking Probes You can configure probes on the standby member of a high availability group to track the health of the gateway or host. Assumptions This topic assumes the following: • At least one host tracking process for high availability has been configured (see Tracking Hosts for High Availability, page 13-25.) • At least one health monitoring probe has been configured (see Configuring Health Monitoring for Real Servers, page 8-51). Procedure Step 1 Choose Config > Devices > ACE admin_context > HA Tracking And Failure Detection > Hosts. The Track Host table appears. Step 2 In the Track Host table, choose the tracking process that you want to modify, and click the Peer Track Host Probe tab. The Peer Track Host Probes table appears. If the Track Host Probe and Peer Track Host Probes tabs do not appear below the Track Host table, click Show Tabs below the Track Host table name. Step 3 In the Peer Track Host Probes table, click Add to add a peer host tracking probe, or choose an existing peer host tracking probe and click Edit to modify it. The Peer Track Host Probes configuration window appears. Step 4 In the Probe Name field of the Peer Track Host Probes configuration window, choose the name of the probe to be used for the peer host tracking process. Step 5 In the Priority field, enter a priority for the host you are tracking by the standby member of the high availability group. Valid entries are from 0 to 255 with higher values indicating higher priorities. Assign a priority value based on the relative importance of the gateway or host that the probes are tracking. If the host goes down, the ACE decrements the priority of the high availability group on the standby member by the value in this Priority field. Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Peer Track Host Probes table. The table includes the added probe. • Click Cancel to exit this procedure without saving your entries and to return to the Peer Track Host Probes table. • Click Next to deploy your entries and to configure another peer track host probe. 13-29 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Configuring ACE HSRP Groups Related Topics • Configuring Host Tracking Probes, page 13-26 • Configuring ACE High Availability Peers, page 13-15 • Configuring ACE High Availability Groups, page 13-17 • Tracking ACE VLAN Interfaces for High Availability, page 13-24 Deleting Peer Host Tracking Probes You can remove a high availability peer host tracking probe. Procedure Step 1 Choose Config > Devices > ACE admin_context > HA Tracking And Failure Detection > Hosts. The Track Host table appears. Step 2 In the Track Host table, choose the tracking process that you want to modify and click the Peer Track Host Probe tab. The Peer Track Host Probes table appears. If the Track Host Probe and Peer Track Host Probes tabs do not appear below the Track Host table, click Show Tabs below the Track Host table name. Step 3 In the Peer Track Host Probes table, choose the probe that you want to remove, and click Delete. The probe is deleted and the Peer Track Host Probes table refreshes without the deleted probe. Related Topics • Configuring ACE Peer Host Tracking Probes, page 13-28 • Configuring Host Tracking Probes, page 13-26 • Tracking ACE VLAN Interfaces for High Availability, page 13-24 Configuring ACE HSRP Groups You can add or edit a Hot Standby Router Protocol (HSRP) group. Assumptions This topic assumes the following: • At least one host tracking process for high availability has been configured (see Tracking Hosts for High Availability, page 13-25.) • Before you configure an HSRP tracking and failure detection process on the ACE, you must configure the HSRP group on the Catalyst 6500 Supervisor. 13-30 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Synchronizing ACE High Availability Configurations Procedure Step 1 Choose Config > Devices > ACE admin_context > HA Tracking And Failure Detection > HSRP Groups. The HSRP Groups table appears. Step 2 In the HSRP Groups table, click Add to add a new HSRP group, or choose an existing entry and click Edit to modify it. The HSRP Group configuration window appears. Step 3 In the Track Object Name field of the HSRP Group configuration window, enter a unique identifier for the tracking process. Valid entries are unquoted text strings with no spaces. Step 4 In the Priority field, enter the priority of the HSRP group as an from 0 to 255. The default is 0. Higher values indicate higher priorities. Assign a priority value based on the relative importance of the HSRP group that you are tracking. If the HSRP group goes down, the ACE decrements the priority of the FT group on the active member. If the priority of the FT group on the active member falls below the priority of the FT group on the standby member, a switchover occurs. Step 5 In the HSRP Group Name, enter a name for the HSRP group. Step 6 In the HSRP Peer Priority field, enter the priority of the HSRP group as a value from 0 to 255. The default is 0. Higher values indicate higher priorities. Assign a priority value based on the relative importance of the HSRP group you are tracking. If the HSRP group goes down, the ACE decrements the priority of the FT group on the standby member. Step 7 In the HSRP Group Name of Peer field, enter a name for the HSRP group on the peer ACE. Step 8 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the HSRP Groups table. The table includes the added HSRP group. • Click Cancel to exit this procedure without saving your entries and to return to the HSRP Groups table. Synchronizing ACE High Availability Configurations When two ACE devices are configured as high availability peers, their configurations must be synchronized at all times so that the standby member can take over for the active member seamlessly. As they synchronize, however, the configuration on the hot standby ACE can become out of sync with the ANM-maintained configuration data for that ACE. Note ANM manages local configurations only. 13-31 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Synchronizing ACE High Availability Configurations Note Although a context might have been configured for syslog notification, changes applied to the standby ACE configuration can change syslog notification configuration so that you are not notified of the out-of-sync configurations. As a result, it is important for you to manually synchronize ANM with the standby ACE. Synchronizing configuration files for the standby ACE requires the following: 1. Auditing the standby ACE to confirm that its configuration does not agree with the ANM-maintained configuration data for the ACE. See Synchronizing Virtual Context Configurations, page 6-105. 2. Uploading the configuration from the standby ACE to the ANM server. See Synchronizing Virtual Context Configurations, page 6-105. 3. Ensuring that the SSL certificate/keys are imported and identical for the pair. See Synchronizing SSL Certificate and Key Pairs on Both ACE Peers, page 13-32. 4. For an Admin context, uploading configurations on any newly imported user contexts. If new user contexts are not updated, they cannot be managed using ANM. Synchronizing Virtual Context Configurations in High Availability Mode When configuration changes are made from ANM on any of the ACE devices in a HA pair, ANM automatically detects the active HA peer and deploys the configuration changes to the active ACE alone. ANM does not attempt to deploy a configuration to a standby ACE even if you selected the standby ACE from the ANM device tree. ANM detects the active ACE and will always deploy configuration changes only to the active ACE. In addition, if ACE HA auto-sync is enabled, after the deployment is successful, ANM will locally replicate the configuration in the ANM database on the standby as well to ensure that the ANM configuration is in synchronization with that of the two ACE peers. In a high availability pair, the two configured virtual contexts synchronize with each other as part of their ongoing communications. However, their copies do not synchronize in ANM and the configuration on the standby member may become out-of-sync with the configuration on the ACE. After the active member of a high availability pair fails and the standby member becomes active, the newly active member detects any out-of-sync virtual context configurations and reports that status in the Virtual Contexts table so that you can synchronize the virtual context configurations. Note If a context is put into an out-of-sync state, this context will be automatically synchronized by the backend ANM. It is not necessary for you to perform an explicit synchronization to take care of the out-of-sync state. For information on synchronizing virtual context configurations, see Synchronizing Virtual Context Configurations, page 6-105. Related Topics • Configuring ACE High Availability Peers, page 13-15 • Configuring ACE High Availability Groups, page 13-17 • Synchronizing Virtual Context Configurations, page 6-105 13-32 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Synchronizing SSL Certificate and Key Pairs on Both ACE Peers Synchronizing SSL Certificate and Key Pairs on Both ACE Peers You can reconcile the SSL certificates and key pairs. When SSL certificate/key import is attempted on a peer that is configured in HA, ANM detects the HA state and also imports the same certificate/key into the other HA peer. In addition, when you are configuring two peers in HA from ANM, a warning message appears asking you to perform certificate/key reconciliation and offers the appropriate window enabling you to do this. Guidelines and Restrictions The certificate/key reconciliation feature is available from the Admin context only; however, executing this feature from the Admin context also reconciles the SSL certificates and key pairs on all the virtual contexts associated with the ACE peers. Procedure Step 1 Choose Config > Devices > admin_context > High Availability (HA) > Setup. The HA Management window appears at the top of the content area and the HA Groups table appears at the bottom. Step 2 In the HA Groups table, choose the group that you want to reconcile the SSL certificates and key pairs on the two HA pairs after a switchover occurs, and click SSL Certificate/Key Reconcile. The SSL Certificate/Key Reconciliation popup window appears. Information appears in this popup window for the primary ACE and the peer ACE as described in Table 13-5. Table 13-5 SSL Certificate/Key Reconciliation Popup Window Attributes Field Description This Device IP address for the fault-tolerant VLAN. Peer Device Fault-tolerant VLAN to be used for this high availability pair. Valid entries are from 1 to 4094. Note This VLAN cannot be used for other network traffic. Context Name Unique name for the virtual context Matched State Feature that indicates a match between the SSL certificates and key pairs on the active ACE and the standby ACE peer. Not Matched State Feature that indicates that there is not a match between the SSL certificates and key pairs on the active ACE and the standby ACE peer. SSL Certificates/Keys On Both HA Peers File Type Format of the file: PEM, DER, or PKCS12. Name Name of the file that contains the certificate or key pair. Exportable Field that indicates whether or not you can export the file from the ACE. Choices are as follows: • Yes—You can export the file to an FTP, SFTP, or TFP server (see Chapter 11, “Configuring SSL”). • No—You cannot export the file as it is protected. Matched Field that indicates that the SSL certificate and key pair is a match on the peer ACE. Available On Field that identifies the ACE devices that contain the SSL certificate and key pair. 13-33 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Synchronizing SSL Certificate and Key Pairs on Both ACE Peers Step 3 To copy an SSL certificate and key pair to the ACE peer device, choose it from the SSL Certificates/Keys On Both HA Peers list, and then click Copy To Peer (or click Cancel to close the SSL Certificate/Key Reconciliation popup window without performing the copy). Step 4 To delete an SSL certificate and key pair from the ACE HA pair, choose it from the SSL Certificates/Keys On Both HA Peers list, and click Delete (or click Cancel to close the SSL Certificate/Key Reconciliation popup window without performing the deletion). Related Topics • Understanding ANM High Availability, page 13-2 • Configuring ACE High Availability Peers, page 13-15 • Configuring ACE High Availability Groups, page 13-17 • Synchronizing ACE High Availability Configurations, page 13-30 13-34 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 13 Configuring High Availability Synchronizing SSL Certificate and Key Pairs on Both ACE Peers CHAPTER 14-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 14 Configuring Traffic Policies Date: 3/28/12 Cisco Application Networking Manager helps you configure class maps and policy maps to provide a global level of classification for filtering traffic received by or passing through the ACE. Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • Traffic Policy Overview, page 14-1 • Class Map and Policy Map Overview, page 14-2 • Configuring Virtual Context Class Maps, page 14-6 • Setting Match Conditions for Class Maps, page 14-8 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Rules and Actions for Policy Maps, page 14-34 • Configuring Actions Lists, page 14-85 Traffic Policy Overview Cisco Application Networking Manager helps you configure class maps and policy maps to provide a global level of classification for filtering traffic received by or passing through the ACE. You create traffic policies and attach these policies to one or more VLAN interfaces associated with the ACE to apply feature-specific actions to the matching traffic. The ACE uses the individual traffic policies to implement functions such as: • FTP command inspection • IP normalization and fragment reassembly • Network Address Translation (NAT) 14-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Class Map and Policy Map Overview • Optimization of HTTP traffic • Protocol deep packet inspection • Remote access using Secure Shell (SSH) or Telnet • Secure Socket Layer (SSL) security services between a Web browser (the client) and the HTTP connection (the server) • Server load balancing • TCP termination, normalization, and reuse Related Topics • Class Map and Policy Map Overview, page 14-2 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 Class Map and Policy Map Overview You classify inbound network traffic destined to, or passing through, the ACE based on a series of flow match criteria specified by a class map. Each class map defines a traffic classification; that is, network traffic that is of interest to you. A policy map defines a series of actions (functions) that you want applied to a set of classified inbound traffic. Class maps enable you to classify network traffic based on the following criteria: • Layer 3 and Layer 4 traffic flow information—Source or destination IP address, source or destination port, virtual IP address, or IP protocol • Layer 7 protocol information—HTTP cookie, HTTP URL, HTTP header, HTTP content, FTP request commands, RADIUS, RDP, RTSP, Skinny, or SIP The policies that you can configure depend on the ACE you are configuring. Table 14-1 lists the available policies and the ACE devices that support them. Table 14-1 Traffic Policies and ACE Device Support Policy Map Type Description ACE Device ACE Module ACE Appliance Layer 3/4 Management Traffic (First-Match) Layer 3 and Layer 4 policy map for network management traffic received by the ACE X X Layer 3/4 Network Traffic (First-Match) Layer 3 and Layer 4 policy map for traffic passing through the ACE X X Layer 7 Command Inspection - FTP (First-Match) Layer 7 policy map for inspection of FTP commands X X Layer 7 Deep Packet Inspection - HTTP (All-Match) Layer 7 policy map for inspection of HTTP packets X X Layer 7 Deep Packet Inspection - SIP (All-Match) Layer 7 policy map for inspection of SIP packets X X Layer 7 Deep Packet Inspection - Skinny Layer 7 policy map for inspection of Skinny Client Control Protocol (SCCP) X X 14-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Class Map and Policy Map Overview The traffic classification process consists of the following three steps: 1. Creating a class map, which comprise a set of match criteria related to Layer 3 and Layer 4 traffic classifications or Layer 7 protocol classifications. 2. Creating a policy map, which refers to the class maps and identifies a series of actions to perform based on the traffic match criteria. 3. Activating the policy map and attaching it to a specific VLAN interface or globally to all VLAN interfaces associated with a context by configuring a virtual context global traffic policy to filter traffic received by the ACE. The following overview topics describe the components that define a traffic policy: • Class Maps, page 14-3 • Policy Maps, page 14-4 • Parameter Maps and Their Use in Layer 3 and Layer 4 Policy Maps, page 14-5 • Applying a Policy Map Globally to All VLAN Interfaces, page 6-35 Class Maps A class map defines each type of Layer 3 and Layer 4 traffic class and each Layer 7 protocol class. You create class maps to classify the traffic received and transmitted by the ACE as follows: • Layer 3 and Layer 4 traffic classes contain match criteria that identify the IP network traffic that can pass through the ACE or network management traffic that can be received by the ACE. • Layer 7 protocol-specific classes identify: – Server load-balancing traffic on generic, HTTP, RADIUS, RTSP, or SIP traffic – HTTP or SIP traffic for deep packet inspection – FTP traffic for inspection of commands Layer 7 HTTP Optimization (First-Match) Layer 7 policy map for optimizing HTTP traffic X Layer 7 Server Load Balancing (First-Match) Layer 7 policy map for HTTP server load balancing X X Server Load Balancing - Generic (First-Match) Generic Layer 7 policy map for server load balancing X X Server Load Balancing - RADIUS (First-Match) Layer 7 policy map for RADIUS server load balancing X X Server Load Balancing - RDP (First-Match) Layer 7 policy map for RDP server load balancing X X Server Load Balancing - RTSP (First-Match) Layer 7 policy map for RTSP server load balancing X X Server Load Balancing - SIP (First-Match) Layer 7 policy map for SIP server load balancing X X Table 14-1 Traffic Policies and ACE Device Support (continued) Policy Map Type Description ACE Device ACE Module ACE Appliance 14-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Class Map and Policy Map Overview A traffic class contains the following components: • Class map name • Class map type • One or more match conditions that define the match criteria for the class map • Instructions on how the ACE evaluates match conditions when you specify more than one match statement in a traffic class (match-any, match-all) The individual match conditions specify the criteria for classifying Layer 3 and Layer 4 network traffic as well as the Layer 7 server load balancing and application protocol-specific fields. The ACE evaluates the packets to determine whether they match the specified criteria. If a statement matches, the ACE considers that packet to be a member of the class and forwards the packet according to the specifications set in the traffic policy. Packets that fail to meet any of the matching criteria are classified as members of the default traffic class if one is specified. The ACE allows you to configure two Layer 7 load-balancing class maps in a nested traffic class configuration to create a single traffic class. You can nest Layer 7 class maps to achieve complex logical expressions. The ACE restricts the nesting of class maps to two levels to prevent you from including one nested class map under a different class map. Related Topics • Class Map and Policy Map Overview, page 14-2 • Policy Maps, page 14-4 • Parameter Maps and Their Use in Layer 3 and Layer 4 Policy Maps, page 14-5 • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 Policy Maps A policy map creates the traffic policy. The purpose of a traffic policy is to implement specific ACE functions associated with a traffic class. A traffic policy contains the following components: • Policy map name • Previously created traffic class map or, optionally, the class-default class map • One or more of the individual Layer 3 and Layer 4 or Layer 7 policies that specify the actions to be performed by the ACE A Layer 7 policy map is always associated within a Layer 3 and Layer 4 policy map to provide an entry point for traffic classification. Layer 7 policy maps are considered to be child policies and can only be nested under a Layer 3 and Layer 4 policy map. Only a Layer 3 and Layer 4 policy map can be activated on a VLAN interface; a Layer 7 policy map cannot be directly applied on an interface. For example, to associate a Layer 7 load-balancing policy map, you nest the load-balancing policy map by using the Layer 3 and Layer 4 Policy map action type. If none of the classifications specified in policy maps match, then the ACE executes the default actions specified against the class map configured with the Use Class Default option to use a default class map (if specified). All traffic that fails to meet the other matching criteria in the named class map belongs to the default traffic class. The Use Class Default feature has an implicit match-any match statement and is used to match any traffic classification. 14-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Class Map and Policy Map Overview The ACE supports flexible class map ordering within a policy map. The ACE executes only the actions for the first matching traffic classification, so the order of class maps within a policy map is very important. The policy lookup order is based on the security features of the ACE. The policy lookup order is implicit, irrespective of the order in which you configure policies on the interface. The policy lookup order of the ACE is as follows: 1. Access control (permit or deny a packet) 2. Permit or deny management traffic 3. TCP/UDP connection parameters 4. Load balancing based on a virtual IP (VIP) 5. Application protocol inspection 6. Source NAT 7. Destination NAT The sequence in which the ACE applies the actions for a specific policy is independent of the actions configured for a class map inside a policy. Related Topics • Class Map and Policy Map Overview, page 14-2 • Class Maps, page 14-3 • Parameter Maps and Their Use in Layer 3 and Layer 4 Policy Maps, page 14-5 • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Policy Maps, page 14-32 Parameter Maps and Their Use in Layer 3 and Layer 4 Policy Maps Parameter maps allow you to combine related actions in a Layer 3 and Layer 4 policy map. For example, an HTTP parameter map provides a means of performing actions on traffic ingressing an ACE interface based on certain criteria such as HTTP header and cookie settings, server connection reuse, action to be taken when an HTTP header, cookie, or URL exceeds a configured maximum length, and so on. The ACE uses policy maps to combine class maps and parameter maps into traffic policies and to perform certain configured actions on the traffic that matches the specified criteria in the policies. See Table 10-1 for a list of the available parameter maps and the ACE devices that support them. Related Topics • Configuring Parameter Maps, page 10-1 • Class Map and Policy Map Overview, page 14-2 • Class Maps, page 14-3 • Policy Maps, page 14-4 14-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Virtual Context Class Maps Protocol Inspection Overview Certain applications require special handling of the data portion of a packet as the packets pass through the ACE. Application protocol inspection helps to verify the protocol behavior and identify unwanted or malicious traffic passing through the ACE. Based on the specifications of the traffic policy, the ACE accepts or rejects the packets to ensure the secure use of applications and services. For information about application protocol inspection as configured and performed by the ACE, see the related topics. Related Topics • Configuring Virtual Context Policy Maps, page 14-32 • Setting Match Conditions for Layer 7 FTP Command Inspection Class Maps, page 14-22 • Setting Policy Map Rules and Actions for Layer 7 HTTP Deep Packet Inspection, page 14-51 • Setting Policy Map Rules and Actions for Layer 7 SIP Deep Packet Inspection, page 14-68 Configuring Virtual Context Class Maps You can create a class map to classify the traffic received and transmitted by the ACE. For more information about class maps, see the “Class Maps” section on page 14-3. Note To delete a class map from a context, the class map must no longer be in use. To delete multiple class maps, none of the class maps must be in use. If you attempt to delete multiple class maps and one of the class maps is still in use, none of the class maps are deleted and a message appears stating that one of the class maps is in use. Remove the class map that is still in use from your selection, then click Delete. The selected class maps are removed. Procedure Step 1 Choose Config > Devices > context > Expert > Class Maps. The Class Maps table appears. Step 2 In the Class Maps table, click Add to add a new class map, or choose an existing class map and click Edit to modify it. Step 3 (Optional) Enter a class map identifier number. The Name field contains an automatically incremented number for the class map. You can leave the number as it is or enter a different, unique number. Step 4 In the Class Map Type field, choose the type of class map that you are creating. The types that are available depend on the ACE that you are configuring. Table 14-2 lists the available class map types and the ACE devices that support them. 14-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Virtual Context Class Maps Step 5 In the Match Type field, choose the method to be used to evaluate multiple match statements when multiple match conditions exist: • All—A match exists only if all match conditions are satisfied. If you choose All, you can specify multiple types of match conditions. • Any—A match exists if at least one of the match conditions is satisfied. If you choose Any, you can specify only one type of match condition. This field does not appear for Layer 7 Command Inspection - FTP class maps. Step 6 In the Description field, enter a brief description for the class map. Step 7 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and to configure match conditions for the class map. See Setting Match Conditions for Class Maps, page 14-8 for more information. • Click Cancel to exit the procedure without saving your entries and to return to the Class Maps table. • Click Next to deploy your entries and to configure another class map. Related Topics • Information About Virtual Contexts, page 6-2 • Deleting Class Maps, page 14-8 • Setting Match Conditions for Class Maps, page 14-8 • Configuring Virtual Context Policy Maps, page 14-32 Table 14-2 Class Maps and ACE Device Support Class Map ACE Devices ACE Module ACE Appliance Layer 3/4 Management Traffic X X Layer 3/4 Network Traffic X X Layer 7 Command Inspection - FTP X X Layer 7 Deep Packet Inspection - HTTP X X Layer 7 Deep Packet Inspection - SIP X X Layer 7 Server Load Balancing X X Server Load Balancing - Generic X X Server Load Balancing - RADIUS X X Server Load Balancing - RTSP X X Server Load Balancing - SIP X X 14-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Deleting Class Maps You can delete a class map. To delete a class map from a context, the class map must no longer be in use. To delete multiple class maps, none of the class maps must be in use. Assumption The class map to be deleted is not being used. Procedure Step 1 Choose Config > Devices > context > Expert > Class Maps. The Class Maps table appears. Step 2 In the Class Maps table, choose the class maps that you want to delete and click Delete. A confirmation popup window appears, asking you to confirm the deletion. If you attempt to delete multiple class maps and one of the class maps is still in use, none of the class maps are deleted and a message appears stating that one of the class map is in use. Remove the class map that is still in use from your selection, then click Delete. The Class Maps table refreshes and the deleted class maps no longer appear. Step 3 Do one of the following: • Click OK to confirm the deletion. • Click Cancel to retain the class map and to return to the Class Maps table. Related Topics • Class Map and Policy Map Overview, page 14-2 • Configuring Virtual Context Class Maps, page 14-6 Setting Match Conditions for Class Maps Table 14-3 lists the class maps available for all ACE devices and provides links to topics for setting match conditions: Table 14-3 Class Maps Available for All ACE Devices Class Map Related Topic Layer 3/Layer 4 management traffic Setting Match Conditions for Layer 3/Layer 4 Management Traffic Class Maps, page 14-12 Layer 3/Layer 4 network traffic Setting Match Conditions for Layer 3/Layer 4 Network Traffic Class Maps, page 14-9 Layer 7 FTP command inspection Setting Match Conditions for Layer 7 FTP Command Inspection Class Maps, page 14-22 Layer 7 HTTP deep packet inspection Setting Match Conditions for Layer 7 HTTP Deep Packet Inspection Class Maps, page 14-17 Layer 7 server load balancing Setting Match Conditions for Layer 7 Server Load Balancing Class Maps, page 14-14 14-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Setting Match Conditions for Layer 3/Layer 4 Network Traffic Class Maps You can match criteria for a Layer 3/Layer 4 network traffic class map on the ACE. Assumption You have configured a Layer 3/Layer 4 network traffic class map and want to establish match conditions. Procedure Step 1 Choose Config > Devices > context > Expert > Class Maps. The Class Maps table appears. Step 2 In the Class Maps table, choose the Layer 3/4 network traffic class map that you want to set match conditions for. The Match Condition table appears. Step 3 In the Match Condition table, click Add to add match criteria, or choose the match condition you want to modify and click Edit. The Match Condition configuration window appears. Step 4 In the Sequence Number field of the Match Condition configuration window, enter a value from 2 to 255. Step 5 In the Match Condition Type field, choose the type of match condition to use for this class map and configure any match-specific attributes as described in Table 14-4. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Generic server load balancing Setting Match Conditions for Generic Server Load Balancing Class Maps, page 14-23 Layer 7 SIP deep packet inspection Setting Match Conditions for Layer 7 SIP Deep Packet Inspection Class Maps, page 14-30 RADIUS server load balancing Setting Match Conditions for RADIUS Server Load Balancing Class Maps, page 14-25 RTSP server load balancing Setting Match Conditions for RTSP Server Load Balancing Class Maps, page 14-26 SIP server load balancing Setting Match Conditions for SIP Server Load Balancing Class Maps, page 14-27 Table 14-3 Class Maps Available for All ACE Devices (continued) Class Map Related Topic Table 14-4 Layer 3/Layer 4 Network Traffic Class Map Match Conditions Match Condition Description Access List Access list that is the match type for this match condition. In the Extended ACL field, choose the ACL to use as the match condition. Any Any Layer 3 or Layer 4 IPv4 traffic passing through the ACE meets the match condition. 14-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Anyv6 Any Layer 3 or Layer 4 IPv6 traffic passing through the ACE meets the match condition. This option requires ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. Destination Address Destination address that is the match type for this match condition. Do the following: a. In the IP Address Type field, choose either IPv4 or IPv6. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. b. In the Destination Address field, enter the destination IP address for this match condition in the format based on the address type (IPv4 or IPv6). c. Depending on the destination IP address type that you chose, do one of the following: – For IPv4, in the Destination Netmask field, select the subnet mask of the IP address. – For IPv6, in the Destination Prefix-length field, enter the prefix length for the address. Port UDP or TCP port or range of ports for IPv4 traffic that is the match type for this match condition. Do the following: a. In the Port Protocol field, choose TCP or UDP as the protocol to match. b. In the Port Operator field, choose the match criteria for the port. Choices are as follows: – Any—Any port using the selected protocol meets the match condition. – Equal To—Specific port using the protocol meets the match condition. – In the Port Number field, enter the port to be matched. Valid entries are integers from 0 to 65535. A value of 0 indicates that the ACE is to include all ports. – Range—Port must be one of a range of ports to meet the match condition. Do the following: 1. In the Lower Port Number field, enter the first port number in the port range for the match condition. 2. In the Upper Port Number field, enter the last port number in the port range for the match condition. Valid entries are integers from 0 to 65535. A value of 0 indicates that the ACE is to include all ports. Portv6 UDP or TCP port or range of ports for IPv6 traffic that is the match type for this match condition. This option requires ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. For port configuration information, see Port. Table 14-4 Layer 3/Layer 4 Network Traffic Class Map Match Conditions (continued) Match Condition Description 14-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Source Address Source IP address that is the match type for this match condition. Do the following: a. In the IP Address Type field, choose either IPv4 or IPv6. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. b. In the Source IP Address field, enter the source IP address for this match condition in the format based on the address type (IPv4 or IPv6). c. Depending on the source IP address type that you chose, do one of the following: – For IPv4, in the Source Netmask field, select the subnet mask of the IP address. – For IPv6, in the Source Prefix-length field, enter the prefix length for the address. Virtual Address Virtual IP address that is the match type for this match condition. Do the following: a. In the IP Address Type field, choose either IPv4 or IPv6. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. a. In the Virtual IP Address field, enter the virtual IP address for this match condition in the format based on the address type (IPv4 or IPv6). b. Depending on the IP address type that you chose, do one of the following: – For IPv4, in the Virtual IP Netmask field, choose the subnet mask for the virtual IP address. – For IPv6, in the Virtual Prefix-length field, enter the prefix length for the address. c. In the Virtual Address Protocol field, choose the protocol to be used for this match condition. For a list of protocols and their respective numbers, see Table 6-20. Note Depending on the protocol that you choose, such as TCP or UDP, additional fields appear. If they appear, enter the information described in the following steps. d. In the Port Operator field, choose the match criteria for the port: – Any—Any port using the selected protocol meets the match condition. – Equal To—A specific port using the protocol meets the match condition. – In the Port Number field, enter the port to be matched. Valid entries are from 0 to 65535. A value of 0 indicates that the ACE is to include all ports. – Range—The port must be one of a range of ports to meet the match condition. Valid entries are from 0 to 65535. A value of 0 indicates that the ACE is to include all ports. Do the following: 1. In the Lower Port Number field, enter the first port number in the port range for the match condition. 2. In the Upper Port Number field, enter the last port number in the port range for the match condition. Table 14-4 Layer 3/Layer 4 Network Traffic Class Map Match Conditions (continued) Match Condition Description 14-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Match Condition table. Note If you click Deploy Now, the ACE drops the traffic and then restarts it, even if you have not made changes. If you have not altered existing match conditions, click Cancel instead of Deploy Now to ensure uninterrupted traffic. • Click Cancel to exit the procedure without saving your entries and to return to the Match Condition table. • Click Next to deploy your entries and to configure additional match conditions. Related Topics • Configuring Traffic Policies, page 14-1 • Setting Match Conditions for Layer 3/Layer 4 Management Traffic Class Maps, page 14-12 • Setting Match Conditions for Layer 7 Server Load Balancing Class Maps, page 14-14 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Virtual Context Class Maps, page 14-6 Setting Match Conditions for Layer 3/Layer 4 Management Traffic Class Maps You can identify the network management protocols that can be received by the ACE. Assumption You have configured a Layer 3/Layer 4 network management class map and want to establish match conditions. Procedure Step 1 Choose Config > Devices > context > Expert > Class Maps. The Class Maps table appears. Step 2 In the Class Maps table, choose the Layer 3/Layer 4 management class map that you want to set match conditions for. The Match Condition table appears. Step 3 In the Match Condition table, click Add to add match criteria, or choose the match conditions that you want to modify and click Edit. The Match Condition configuration window appears. Step 4 Enter the match conditions (see Table 14-5). Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. 14-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Step 5 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Match Condition table. Table 14-5 Layer 3/Layer 4 Management Traffic Class Map Match Conditions Field Description Sequence Number Number from 2 to 255 as the line number. The number entered here does not indicate a priority or sequence for the match conditions. Match Condition Type Confirm that Management is selected. Note To change the type of match condition, you must delete the class map and add it again with the correct match type. Management Protocol Type Field that identifies the network management protocols that can be received by the ACE. Choose the allowed protocol for this match condition as follows: • HTTP—Specifies the Hypertext Transfer Protocol (HTTP). • HTTPS—Specifies the secure (SSL) Hypertext Transfer Protocol (HTTP) for connectivity with the ANM GUI on the ACE. • ICMP—Specifies the Internet Control Message Protocol (ICMP), commonly referred to as ping. • ICMPv6—Specifies the Internet Control Message Protocol version 6 (ICMPv6). • SNMP—Specifies the Simple Network Management Protocol (SNMP). • SSH—Specifies a Secure Shell (SSH) connection to the ACE. • TELNET—Specifies a Telnet connection to the ACE. • KAL-AP-UDP—Specifies the KeepAlive Appliance Protocol over UDP. • XML-HTTPS—Specifies HTTPS as the transfer protocol for sending and receiving XML documents between the ACE and a Network Management System (NMS). Communication is performed using port 10443. This option is available for ACE appliances only. Traffic Type Type of traffic: • Any—Any client source IP address meets the match condition. • Source Address—A specific source IP address is part of the match condition. Source Address Field that appears if Source Address is selected for Traffic Type. Depending on the management protocol type that you chose, do one of the following • For ICMP, enter the source IP address of the client in dotted-decimal notation, such as 192.168.11.1. • For ICMPv6, enter a complete IPv6 address. Source Netmask Field that appears if Source Address is selected for Traffic Type. Choose the subnet mask for the source IP address. Source Prefix-length This field appears if ICMPv6 is selected for the Management Protocol Type and Source Address is selected for Traffic Type. Enter the prefix length for the source IPv6 address. 14-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Note If you click Deploy Now, the ACE drops the traffic and then restarts it, even if you have not made changes. If you have not altered existing match conditions, click Cancel instead of Deploy Now to ensure uninterrupted traffic. • Click Cancel to exit the procedure without saving your entries and to return to the Match Condition table. • Click Next to deploy your entries and to configure additional match conditions. Related Topics • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Real Servers, page 8-5 • Configuring Server Farms, page 8-30 • Configuring Sticky Groups, page 9-7 Setting Match Conditions for Layer 7 Server Load Balancing Class Maps You can set match conditions for Layer 7 server load balancing class maps. Assumption You have configured a load-balancing class map and want to establish the match conditions. Procedure Step 1 Choose Config > Devices > context > Expert > Class Maps. The Class Maps table appears. Step 2 In the Class Maps table, choose the Layer 7 server load balancing class map you want to set match conditions for. The Match Condition table appears. Step 3 In the Match Condition table, click Add to add match criteria, or choose the match condition that you want to modify and click Edit. The Match Condition configuration window appears. Step 4 In the Sequence Number field, enter a value from 2 to 255 as the line number. The number entered here does not indicate a priority or sequence for the match conditions. Step 5 In the Match Condition Type field, choose the type of match to use and configure condition-specific attributes as described in Table 14-6. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. 14-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Table 14-6 Layer 7 Server Load Balancing Class Map Match Conditions Match Condition Description Class Map Class map that is to be used to establish a match condition. In the Class Map field, choose the class map to apply to this match condition. HTTP Content Specific content contained within the HTTP entity-body that is used to establish a match condition. Do the following: a. In the Content Expression field, enter the content that is to be matched. Valid entries are alphanumeric strings from 1 to 255 characters. b. In the Content Offset (Bytes) field, enter the number of bytes to be ignored starting with the first byte of the Message body, after the empty line (CR,LF,CR,LF) between the headers and the body of the message. Valid entries are from 1 to 255. HTTP Cookie HTTP cookie that is to be used to establish a match condition. Do the following: a. In the Cookie Name field, enter a unique cookie name. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. b. In the Cookie Value field, enter a unique cookie value expression. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. c. Check the Secondary Cookie Matching check box to instruct the ACE to use both the cookie name and the cookie value to satisfy this match condition. Uncheck this check box to indicate that the ACE is to use either the cookie name or the cookie value to satisfy this match condition. HTTP Header HTTP header that is to be used to establish a match condition. Do the following: a. In the Header Name field, specify the header to match in one of the following ways: – To specify an HTTP header that is not one of the standard HTTP headers, click the first radio button, and enter the HTTP header name in the Header Name field. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. – To specify a standard HTTP header, click the second radio button, and choose an HTTP header from the list. b. In the Header Value (Bytes) field, enter the header value expression string to compare against the value in the specified field in the HTTP header. Valid entries are text strings with a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching. If the string includes spaces, enclose the string in quotes. See Table 14-33 for a list of the supported characters that you can use in regular expressions. 14-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Match Condition table. Note If you click Deploy Now, the ACE drops the traffic and then restarts it, even if you have not made changes. If you have not altered existing match conditions, click Cancel instead of Deploy Now to ensure uninterrupted traffic. • Click Cancel to exit the procedure without saving your entries and to return to the Match Condition table. • Click Next to deploy your entries and to configure additional match conditions. Related Topics • Information About Virtual Contexts, page 6-2 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 HTTP URL Portion of an HTTP URL that is to be used to establish a match condition. Do the following: a. In the URL Expression field, enter a URL or a portion of a URL to match. Valid entries are URL strings from 1 to 255 alphanumeric characters and include only the portion of the URL following www.hostname.domain. For example, in the URL www.anydomain.com/latest/whatsnew.html, include only /latest/whatsnew.html. b. In the Method Expression field, enter the HTTP method to match. Valid entries are method names entered as unquoted text strings with no spaces and a maximum of 15 alphanumeric characters. You can enter either one of the standard HTTP 1.1 method names (OPTIONS, GET, HEAD, POST, PUT, DELETE, TRACE, or CONNECT) or a text string that must be matched exactly (for example, CORVETTE). Source Address Source IP address that is to be used to establish a match condition. Do the following: a. In the IP Address Type field, choose either IPv4 or IPv6. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. b. In the Source Address field, enter the source IP address for this match condition in the format based on the address type (IPv4 or IPv6). c. Depending on the IP address type that you chose, do one of the following: – For IPv4, in the Source Netmask field, choose the subnet mask of the source IP address. – For IPv6, in the Source Prefix-length field, enter the prefix length for the address. Table 14-6 Layer 7 Server Load Balancing Class Map Match Conditions (continued) Match Condition Description 14-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Setting Match Conditions for Layer 7 HTTP Deep Packet Inspection Class Maps You can configure a Layer 7 class map for deep packet inspection of HTTP traffic by the ACE. When these features are configured, the ACE performs a stateful deep packet inspection of the HTTP protocol and permits or restricts traffic based on the actions in the defined policy maps. You can configure the following security features as part of HTTP deep packet inspection to be performed by the ACE: • Regular expression matching on name in an HTTP header, URL name, or content expressions in an HTTP entity body • Content, URL, and HTTP header length checks • MIME-type message inspection • Transfer-encoding methods • Content type verification and filtering • Port 80 misuse by tunneling protocols • RFC compliance monitoring and RFC method filtering Use this procedure to configure a Layer 7 class map for deep packet inspection of HTTP traffic. Assumption You have configured a Layer 7 HTTP deep packet inspection class map and want to establish match conditions. Procedure Step 1 Choose Config > Devices > context > Expert > Class Maps. The Class Maps table appears. Step 2 In the Class Maps table, choose the Layer 7 HTTP deep packet inspection class map that you want to set match conditions for. The Match Condition table appears. Step 3 In the Match Condition table, click Add to add match criteria, or choose the match condition that you want to modify and click Edit. The Match Condition configuration window appears. Step 4 In the Sequence Number field of the Match Condition configuration window, enter a value from 2 to 255 as the line number. The number entered here does not indicate a priority or sequence for the match conditions. Step 5 In the Match Condition Type field, choose the method that match decisions are to be made and configure condition-specific attributes as described in Table 14-7. 14-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Table 14-7 Layer 7 HTTP Deep Packet Inspection Class Map Match Conditions Match Condition Description Content Specific content contained within the HTTP entity-body that is to be used for protocol inspection decisions. Do the following: a. In the Content Expression field, enter the content that is to be matched. Valid entries are alphanumeric strings from 1 to 255 characters. b. In the Content Offset (Bytes) field, enter the number of bytes to be ignored starting with the first byte of the Message body, after the empty line (CR,LF,CR,LF) between the headers and the body of the message. Valid entries are from 1 to 255. Content Length Content parse length in an HTTP message that is to be used for protocol inspection decisions. Do the following: a. In the Content Length Operator field, choose the operand to use to compare content length as follows: – Equal To—The content length must equal the number in the Content Length Value (Bytes) field. – Greater Than—The content length must be greater than the number in the Content Length Value (Bytes) field. – Less Than—The content length must be less than the number in the Content Length Value (Bytes) field. – Range—The content length must be within the range specified in the Content Length Lower Value (Bytes) field and the Content Length Higher Value (Bytes) field. b. Enter values to apply for content length comparison as follows: – If you chose Equal To, Greater Than, or Less Than in the Content Length Operator field, the Content Length Value (Bytes) field appears. In the Content Length Value (Bytes) field, enter the number of bytes for comparison. Valid entries are from 0 to 4294967295. – If you chose Range in the Content Length Operator field, the Content Length Lower Value (Bytes) and the Content Length Higher Value (Bytes) fields appear. Do the following: 1. In the Content Length Lower Value (Bytes) field, enter the lowest number of bytes to be used for this match condition. Valid entries are from 0 to 4294967295. The number in this field must be less than the number entered in the Content Length Higher Value (Bytes) field. 2. In the Content Length Higher Value (Bytes) field, enter the highest number of bytes to be used for this match condition. Valid entries are from 0 to 4294967295. The number in this field must be greater than the number entered in the Content Length Lower Value (Bytes) field. 14-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Header Name and value in an HTTP header that are to be used for protocol inspection decisions. Do the following: a. In the Header field, choose one of the predefined HTTP headers to be matched, or choose HTTP Header to specify a different HTTP header. b. If you chose HTTP Header, in the Header Name field, enter the name of the HTTP header to match. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. c. In the Header Value (Bytes) field, enter the header value expression string to compare against the value in the specified field in the HTTP header. Valid entries are text strings with a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching. If the string includes spaces, enclose the string with quotes. All headers in the header map must be matched. See Table 14-33 for a list of the supported characters that you can use in regular expressions. Header Length Length of the header in the HTTP message that is to be used for protocol inspection decisions. Do the following: a. In the Header Length Type field, specify whether HTTP header request or response messages are to be used for protocol inspection decisions as follows: – Request—HTTP header request messages are to be checked for header length. – Response—HTTP header response messages are to be checked for header length. b. In the Header Length Operator field, choose the operand to use to compare header length: – Equal To—The header length must equal the number in the Header Length Value (Bytes) field. – Greater Than—The header length must be greater than the number in the Header Length Value (Bytes) field. – Less Than—The header length must be less than the number in the Header Length Value (Bytes) field. – Range—The header length must be within the range specified in the Header Length Lower Value (Bytes) field and the Header Length Higher Value (Bytes) field. c. Enter values to apply for header length comparison as follows: – If you chose Equal To, Greater Than, or Less Than in the Header Length Operator field, the Header Length Value (Bytes) field appears. In the Header Length Value (Bytes) field, enter the number of bytes for comparison. Valid entries are from 0 to 255. – If you chose Range in the Header Length Operator field, the Header Length Lower Value (Bytes) and the Header Length Higher Value (Bytes) fields appear. Do the following: 1. In the Header Length Lower Value (Bytes) field, enter the lowest number of bytes to be used for this match condition. Valid entries are from 0 to 255. The number in this field must be less than the number entered in the Header Length Higher Value (Bytes) field. 2. In the Header Length Higher Value (Bytes) field, enter the highest number of bytes to be used for this match condition. Valid entries are from 1 to 255. The number in this field must be greater than the number entered in the Header Length Lower Value (Bytes) field. Table 14-7 Layer 7 HTTP Deep Packet Inspection Class Map Match Conditions (continued) Match Condition Description 14-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Header MIME Type Multipurpose Internet Mail Extension (MIME) message types that are to be used for protocol inspection decisions. In the Header MIME Type field, choose the MIME message type to use for this match condition. Port Misuse Feature that specifies that the misuse of port 80 (or any other port running HTTP) is to be used for protocol inspection decisions. Choose the application category to use for this match condition: • IM—Instant messaging applications are to be used for this match condition. • P2P—Peer-to-peer applications are to be used for this match condition. • Tunneling—Tunneling applications are to be used for this match condition. Request Method Request method that is to be used for protocol inspection decisions. By default, ACEs allow all request and extension methods. This option allows you to configure class maps that define protocol inspection decisions based on compliance to request methods defined in RFC 2616 and by HTTP extension methods. Do the following: a. In the Request Method Type field, choose the type of compliance to be used for protocol inspection decision. Choices are as follows: – Ext—HTTP extension method is to be used for protocol inspection decisions. – RFC—Request method defined in RFC 2616 is to be used for protocol inspection decisions. Depending on your selection, the Ext Request Method field or the RFC Request Method field appears. b. In the Request Method field, choose the specific request method to be used. Transfer Encoding Field that appears when an HTTP transfer-encoding type is used for protocol inspection decisions. The transfer-encoding general-header field indicates the type of transformation, if any, that has been applied to the HTTP message body to safely transfer it between the sender and the recipient. In the Transfer Encoding field, choose the type of encoding that is to be checked: • Chunked—The message body is transferred as a series of chunks. • Compress—The encoding format that is produced by the UNIX file compression program compress. • Deflate—The .zlib format that is defined in RFC 1950 in combination with the DEFLATE compression mechanism described in RFC 1951. • Gzip—The encoding format that is produced by the file compression program GZIP (GNU zip) as described in RFC 1952. • Identity—The default (identity) encoding which does not require the use of transformation. URL URL name used for protocol inspection decisions. In the URL field, enter a URL or a portion of a URL to match. Valid entries are URL strings from 1 to 255 alphanumeric characters and include only the portion of the URL following www.hostname.domain. For example, in the URL www.anydomain.com/latest/whatsnew.html, include only /latest/whatsnew.html. Table 14-7 Layer 7 HTTP Deep Packet Inspection Class Map Match Conditions (continued) Match Condition Description 14-21 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. Note If you click Deploy Now, the ACE drops the traffic, then restarts it, even if you have not made changes. If you have not altered existing match conditions, click Cancel instead of Deploy Now to ensure uninterrupted traffic. • Click Cancel to exit this procedure without saving your entries and to return to the Match Condition table. • Click Next to configure another match condition for this class map. Related Topics • Configuring Virtual Context Policy Maps, page 14-32 • Setting Match Conditions for Layer 3/Layer 4 Network Traffic Class Maps, page 14-9 • Setting Match Conditions for Layer 3/Layer 4 Management Traffic Class Maps, page 14-12 URL Length URL length to be used for protocol inspection decisions. Do the following: a. In the URL Length Operator field, choose the operand to be used to compare URL length: – Equal To—The URL length must equal the number in the URL Length Value (Bytes) field. – Greater Than—The URL length must be greater than the number in the URL Length Value (Bytes) field. – Less Than—The URL length must be less than the number in the URL Length Value (Bytes) field. – Range—The URL length must be within the range specified in the URL Length Lower Value (Bytes) field and the URL Length Higher Value (Bytes) field. b. Enter values to apply for URL length comparison as follows: – If you chose Equal To, Greater Than, or Less Than in the URL Length Operator field, the URL Length Value (Bytes) field appears. In the URL Length Value (Bytes) field, enter the value for comparison. Valid entries are from 1 to 65535 bytes. – If you chose Range in the URL Length Operator field, the URL Length Lower Value (Bytes) and the URL Length Higher Value (Bytes) fields appear. Do the following: 1. In the URL Length Lower Value (Bytes) field, enter the lowest number of bytes to be used for this match condition. Valid entries are integers from 1 to 65535. The number in this field must be less than the number entered in the URL Length Higher Value (Bytes) field. 2. In the URL Length Higher Value (Bytes) field, enter the highest number of bytes to be used for this match condition. Valid entries are integers from 1 to 65535. The number in this field must be greater than the number entered in the URL Length Lower Value (Bytes) field. Table 14-7 Layer 7 HTTP Deep Packet Inspection Class Map Match Conditions (continued) Match Condition Description 14-22 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps • Setting Match Conditions for Layer 7 Server Load Balancing Class Maps, page 14-14 • Setting Match Conditions for Layer 7 FTP Command Inspection Class Maps, page 14-22 Setting Match Conditions for Layer 7 FTP Command Inspection Class Maps You can set match conditions for a Layer 7 FTP command inspection class map. Assumption You have configured a Layer 7 FTP command inspection class map and want to establish match criteria. Procedure Step 1 Choose Config > Devices > context > Expert > Class Maps. The Class Maps table appears. Step 2 In the Class Maps table, choose the Layer 7 FTP command inspection class map that you want to set match conditions for. The Match Condition table appears. Step 3 In the Match Condition table, click Add to add match criteria, or choose the match condition that you want to modify and click Edit. The Match Condition configuration window appears. Step 4 In the Sequence Number field of the Match Condition configuration window, enter a value from 2 to 255. Step 5 In the Match Condition Type field, confirm that Request Method Name is selected as the match condition type for this class map. Step 6 In the Request Method Name field, choose the FTP command to be inspected. Table 14-8 identifies the FTP commands that can be inspected. Table 14-8 FTP Commands for Inspection FTP Command Description Appe Append data to the end of the specified file on the remote host. Cdup Change to the parent of the current directory. Dele Delete the specified file. Get Copy the specified file from the remote host to the local system. Help List all available FTP commands. Mkd Create a directory using the specified path and directory name. Put Copy the specified file from the local system to the remote host. Rmd Remove the specified directory. Rnfr Rename a file, specifying the current file name. Used with rnto. Rnto Rename a file, specifying the new file name. Used with rnfr. Site Execute a site-specific command. Stou Store a file on the remote host and give it a unique name. Syst Query the remote host for operating system information. 14-23 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Step 7 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Match Condition table. Note If you click Deploy Now, the ACE drops the traffic and then restarts it, even if you have not made changes. If you have not altered existing match conditions, click Cancel instead of Deploy Now to ensure uninterrupted traffic. • Click Cancel to exit this procedure without saving your entries and to return to the Match Condition table. • Click Next to configure another match condition for this class map. Related Topics • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 Setting Match Conditions for Generic Server Load Balancing Class Maps You can set match conditions for a generic server load balancing class map. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Assumption You have configured a generic server load balancing class map and want to establish match criteria. Procedure Step 1 Choose Config > Devices > context > Expert > Class Maps. The Class Maps table appears. Step 2 In the Class Maps table, choose the generic server load balancing class map that you want to set match conditions for. The Match Condition table appears. Step 3 In the Match Condition table, click Add to add match criteria, or choose the match condition that you want to modify and click Edit. The Match Condition configuration window appears. Step 4 In the Sequence Number field of the Match Condition configuration window, enter a value from 2 to 255. Step 5 In the Match Condition Type field, choose the match condition type for this class map and configure any match-specific criteria as described in Table 14-9. 14-24 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Match Condition table. Note If you click Deploy Now, the ACE drops the traffic and then restarts it even if you have not made changes. If you have not altered existing match conditions, click Cancel instead of Deploy Now to ensure uninterrupted traffic. • Click Cancel to exit this procedure without saving your entries and to return to the Match Condition table. • Click Next to configure another match condition for this class map. Related Topics • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 Table 14-9 Generic Server Load Balancing Class Map Match Conditions Match Condition Description Class Map Class map that is used to establish a match condition. In the Class Map field, choose the class map to use for this match condition. Layer 4 Payload Generic data parsing that is used to establish a match condition. Do the following: a. In the Layer 4 Payload Regex field, enter the Layer 4 payload expression contained within the TCP or UDP entity body to use for this match condition. Valid entries are text strings with a maximum of 255 alphanumeric characters. See Table 14-33 for a list of the supported characters that you can use for matching string expressions. b. In the Layer 4 Payload Offset field, enter the absolute offset where the Layer 4 payload expression search starts. The offset starts at the first byte of the TCP or UDP body. Valid entries are from 0 to 999. Source Address Source IP address that is used to establish a match condition. Do the following: a. In the IP Address Type field, choose either IPv4 or IPv6. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. b. In the Source Address field, enter the source IP address for this match condition in the format based on the address type (IPv4 or IPv6). c. Depending on the IP address type that you chose, do one of the following: – For IPv4, in the Source Netmask field, choose the subnet mask for the source IP address. – For IPv6, in the Source Prefix-length field, enter the prefix length for the address. 14-25 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Setting Match Conditions for RADIUS Server Load Balancing Class Maps You can set match conditions for a RADIUS server load balancing class map. Assumption You have configured a RADIUS server load balancing class map and want to establish match criteria. Procedure Step 1 Choose Config > Devices > context > Expert > Class Maps. The Class Maps table appears. Step 2 In the Class Maps table, choose the RADIUS server load balancing class map that you want to set match conditions for. The Match Condition table appears. Step 3 In the Match Condition table, click Add to add match criteria, or choose the match condition that you want to modify and click Edit. The Match Condition configuration window appears. Step 4 In the Sequence Number field, enter a value from 2 to 255. Step 5 In the Match Condition Type field, choose the match condition type for this class map and configure any match-specific criteria as described in Table 14-10. Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Match Condition table. Note If you click Deploy Now, the ACE drops the traffic and then restarts it, even if you have not made changes. If you have not altered existing match conditions, click Cancel instead of Deploy Now to ensure uninterrupted traffic. • Click Cancel to exit this procedure without saving your entries and to return to the Match Condition table. • Click Next to configure another match condition for this class map. Table 14-10 RADIUS Server Load Balancing Class Map Match Conditions Match Condition Description Calling Station ID Unique identifier of the calling station that is used to establish a match condition. In the RADIUS Calling Station ID field, enter the calling station identifier to match. Valid entries are strings containing 1 to 64 alphanumeric characters. See Table 14-33 for a list of the supported characters that you can use for matching string expressions. User Name Username that is used to establish a match condition. In the User Name field, enter the name to match. Valid entries are strings containing 1 to 64 alphanumeric characters. See Table 14-33 for a list of the supported characters that you can use for matching string expressions. 14-26 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Related Topics • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 Setting Match Conditions for RTSP Server Load Balancing Class Maps You can set match conditions for a RTSP server load balancing class map. Assumption You have configured a RTSP server load balancing class map and want to establish match criteria. Procedure Step 1 Choose Config > Devices > context > Expert > Class Maps. The Class Maps table appears. Step 2 In the Class Maps table, choose the RTSP server load balancing class map that you want to set match conditions for. The Match Condition table appears. Step 3 In the Match Condition table, click Add to add match criteria, or choose the match condition that you want to modify and click Edit. The Match Condition configuration window appears. Step 4 In the Sequence Number field, enter a value from 2 to 255. Step 5 In the Match Condition Type field, choose the match condition type for this class map and configure any match-specific criteria as described in Table 14-11. Table 14-11 RTSP Server Load Balancing Class Map Match Conditions Match Condition Description Class Map Class map that is used to establish a match condition. In the Class Map field, choose the class map to use for this match condition. RTSP Header Name and value in an RTSP header that is used to establish a match condition. Do the following a. In the Header Name field, specify the header in one of the following ways: – To specify an RTSP header that is not one of the standard RSTP headers, choose the first radio button and enter the RTSP header name in the Header Name field. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. – To specify one of the standard RTSP headers, choose the second radio button and choose one of the RTSP headers from the list. b. In the Header Value (Bytes) field, enter the header value expression string to compare against the value in the specified field in the RTSP header. Valid entries are text strings with a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching. If the string includes spaces, enclose the string with quotes. All headers in the header map must be matched. See Table 14-33 for a list of the supported characters that you can use in regular expressions. 14-27 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Match Condition table. Note If you click Deploy Now, the ACE drops the traffic and then restarts it, even if you have not made changes. If you have not altered existing match conditions, click Cancel instead of Deploy Now to ensure uninterrupted traffic. • Click Cancel to exit this procedure without saving your entries and to return to the Match Condition table. • Click Next to configure another match condition for this class map. Related Topics • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 Setting Match Conditions for SIP Server Load Balancing Class Maps You can set match conditions for a SIP server load balancing class map. Assumption You have configured a SIP server load balancing class map and want to establish match criteria. RTSP URL URL or portion of a URL that is used to establish a match condition. Do the following: a. In the URL Expr field, enter a URL, or portion of a URL, to match. The ACE performs matching on whatever URL string appears after the RTSP method, regardless of whether the URL includes the host name. The ACE supports regular expressions for matching URL strings. See Table 14-33 for a list of the supported characters that you can use in regular expressions. b. In the Method field, enter the RTSP method to match. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. The method can be either one of the standard RTSP method names (DESCRIBE, ANNOUNCE, GET_PARAMETER, OPTIONS, PAUSE, PLAY, RECORD, REDIRECT, SETUP, SET_PARAMETER, TEARDOWN) or a text string that must be matched exactly (for example, STINGRAY). Source Address Source IP address that is used to establish a match condition. Do the following: a. In the Source Address field, enter the source IP address for this match condition in dotted-decimal format, such as 192.168.11.1. b. In the Source Netmask field, choose the subnet mask for the source IP address. Table 14-11 RTSP Server Load Balancing Class Map Match Conditions (continued) Match Condition Description 14-28 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Procedure Step 1 Choose Config > Devices > context > Expert > Class Maps. The Class Maps table appears. Step 2 In the Class Maps table, choose the SIP server load balancing class map that you want to set match conditions for. The Match Condition table appears. Step 3 In the Match Condition table, click Add to add match criteria, or choose the match condition that you want to modify and click Edit. The Match Condition configuration window appears. Step 4 In the Sequence Number field of the Match Condition configuration window, enter a value from 2 to 255. Step 5 In the Match Condition Type field, choose the match condition type for this class map and configure any match-specific criteria as described in Table 14-12. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Table 14-12 SIP Server Load Balancing Class Map Match Conditions Match Condition Description Class Map Class map that is used to establish a match condition. In the Class Map field, choose the class map to use for this match condition. 14-29 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Match Condition table. Note If you click Deploy Now, the ACE drops the traffic and then restarts it, even if you have not made changes. If you have not altered existing match conditions, click Cancel instead of Deploy Now to ensure uninterrupted traffic. • Click Cancel to exit this procedure without saving your entries and to return to the Match Condition table. • Click Next to configure another match condition for this class map. Related Topics • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 SIP Header SIP header name and value that are used to establish a match condition. Do the following: a. In the Header Name field, specify the header in one of the following ways: – To specify a SIP header that is not one of the standard SIP headers, choose the first radio button and enter the SIP header name in the Header Name field. Enter an unquoted text string with no spaces and a maximum of 64 characters. – To specify one of the standard SIP headers, choose the second radio button and choose one of the SIP headers from the list. b. In the Header Value (Bytes) field, enter the header value expression string to compare against the value in the specified field in the SIP header. Valid entries are text strings with a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching. If the string includes spaces, enclose the string with quotes. All headers in the header map must be matched. See Table 14-33 for a list of the supported characters that you can use in regular expressions. Source Address Source IP address that is used to establish a match condition. Do the following: a. In the IP Address Type field, select either IPv4 or IPv6. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. b. In the Source Address field, enter the source IP address for this match condition in the format based on the address type (IPv4 or IPv6). c. Depending on the IP address type that you chose, do one of the following: – For IPv4, in the Source Netmask field, choose the subnet mask for the source IP address. – For IPv6, in the Source Prefix-length field, enter the prefix length for the address. Table 14-12 SIP Server Load Balancing Class Map Match Conditions (continued) Match Condition Description 14-30 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Setting Match Conditions for Layer 7 SIP Deep Packet Inspection Class Maps You can set match conditions for a SIP deep packet inspection class map. Assumption You have configured a SIP deep packet inspection class map and want to establish match criteria. Procedure Step 1 Choose Config > Devices > context > Expert > Class Maps. The Class Maps table appears. Step 2 In the Class Maps table, choose the SIP deep packet inspection class map that you want to set match conditions for. The Match Condition table appears. Step 3 In the Match Condition table, click Add to add match criteria, or choose the match condition that you want to modify and click Edit. The Match Condition configuration window appears. Step 4 In the Sequence Number field of the Match Condition configuration window, enter a value from 2 to 255. Step 5 In the Match Condition Type field, choose the match condition type for this class map and configure any match-specific criteria as described in Table 14-13. Table 14-13 Layer 7 SIP Deep Packet Inspection Class Map Match Conditions Match Condition Description Called Party Destination or called party in the URI of the SIP To header that is used to establish a match condition. In the Called Party field, enter a regular expression that identifies the called party in the URI of the SIP To header for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. Calling Party Source or calling party in the URI of the SIP From header that is used to establish a match condition. In the Calling Party field, enter a regular expression that identifies the called party in the URI of the SIP To header for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. IM Subscriber IM (instant messaging) subscriber that is used to establish a match condition. In the IM Subscriber field, enter a regular expression that identifies the IM subscriber for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. Message Path Message coming from or transiting through certain SIP proxy servers that is used to establish a match condition. In the Message Path field, enter a regular expression that identifies the SIP proxy server for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. 14-31 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Setting Match Conditions for Class Maps Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. You return to the Match Condition table. Note If you click Deploy Now, the ACE drops the traffic and then restarts it, even if you have not made changes. If you have not altered existing match conditions, click Cancel instead of Deploy Now to ensure uninterrupted traffic. • Click Cancel to exit this procedure without saving your entries and to return to the Match Condition table. SIP Content Length SIP message body length that is used to establish a match condition. Do the following: a. In the Content Operator field, confirm that Greater Than is selected. b. In the Content Length field, enter the maximum size of a SIP message body in bytes that the ACE is to allow without performing SIP protocol inspection. If a SIP message exceeds the specified value, the ACE performs SIP protocol inspection as defined in an associated policy map. Valid entries are from 0 to 65534 bytes. SIP Content Type Content type in the SIP message body that is used to establish a match condition. In the Content Type field, enter the a regular expression that identifies the content type in the SIP message body to use for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. SIP Request Method SIP request method that is used to establish a match condition. In the Request Method field, choose the request method that is to be matched. Third Party Third party who is authorized to register other users on their behalf that is used to establish a match condition. In the Third Party Registration Entities field, enter a regular expression that identifies a privileged user authorized for third-party registrations for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. URI Length SIP URI or user identifier that is used to establish a match condition. Do the following: a. In the URI Type field, choose the type of URI to use: – SIP URI—The calling party URI is used for this match condition. – Tel URI—A telephone number is used for this match condition. b. In the URI Operator field, confirm that Greater Than is selected. c. In the URI Length field, enter the maximum length of the SIP URI or Tel URI in bytes. Valid entries are integers from 0 to 254 bytes. Table 14-13 Layer 7 SIP Deep Packet Inspection Class Map Match Conditions (continued) Match Condition Description 14-32 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Virtual Context Policy Maps • Click Next to configure another match condition for this class map. Related Topics • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 Configuring Virtual Context Policy Maps You can create policy maps for a context that establish traffic policy for the ACE. The purpose of a traffic policy is to implement specific ACE functions associated with a traffic class. A traffic policy contains the following: • A policy map name. • A previously created traffic class map or, optionally, the class-default class map. • One or more of the individual Layer 3/Layer 4 or Layer 7 policies that specify the actions to be performed by the ACE. The ACE executes actions specified in a policy map on a first-match, multi-match, or all-match basis as follows: • First-match—With a first-match policy map, the ACE executes only the action specified against the first classification that it matches. Layer 3/Layer 4 Management Traffic, Layer 7 Server Load Balancing, Layer 7 Command Inspection - FTP, and Layer 7 HTTP Optimization policy maps are first-match policy maps. • Multi-match—With a multi-match policy map, the ACE executes all possible actions applicable for a specific classification. Layer 3/Layer 4 Network Traffic policy maps are multi-match policy maps. • All-match—With an all-match policy map, the ACE attempts to match all specified conditions against the matching classification and executes the actions of all matching classes until it encounters a deny for a match request. You can display a context’s policy maps and their types in the Policy Maps table (Config > Virtual Contexts > context > Expert > Policy Maps.) The types of policy maps that you can configure depend on the ACE device type. Table 14-14 lists the types of policy maps with brief descriptions and the ACE devices that support them. Table 14-14 Policy Maps and ACE Device Support Policy Map Type Description ACE Device ACE Module ACE Appliance Layer 3/4 Management Traffic (First-Match) Layer 3 and Layer 4 policy map for network management traffic received by the ACE X X Layer 3/4 Network Traffic (First-Match) Layer 3 and Layer 4 policy map for traffic passing through the ACE X X Layer 7 Command Inspection - FTP (First-Match) Layer 7 policy map for inspection of FTP commands X X 14-33 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Virtual Context Policy Maps Procedure Step 1 Choose Config > Devices > context > Expert > Policy Maps. The Policy Maps table appears. Step 2 In the Policy Maps table, click Add to add a new policy map, or choose an existing policy map and click Edit to modify it. Step 3 The Policy Map Name field contains an automatically incremented number for the policy map. Either leave the entry as it is or enter a different, unique number. Step 4 In the Type field, choose the type of policy map to create. See Table 14-14 for a list of the policy maps and their availability for the different ACE models. Step 5 In the Description field, enter a brief description of the policy map. Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. To define rules and actions for the policy map, see Configuring Rules and Actions for Policy Maps, page 14-34. • Click Cancel to exit this procedure without saving your entries and to return to the Policy Maps table. • Click Next to deploy your entries and to configure another policy map. Layer 7 Deep Packet Inspection - HTTP (All-Match) Layer 7 policy map for inspection of HTTP packets X X Layer 7 Deep Packet Inspection - SIP (All-Match) Layer 7 policy map for inspection of SIP packets X X Layer 7 Deep Packet Inspection - Skinny Layer 7 policy map for inspection of Skinny Client Control Protocol (SCCP) X X Layer 7 HTTP Optimization (First-Match) Layer 7 policy map for optimizing HTTP traffic X Layer 7 Server Load Balancing (First-Match) Layer 7 policy map for HTTP server load balancing X X Server Load Balancing - Generic Generic Layer 7 policy map for server load balancing X X Server Load Balancing - RADIUS (First-Match) Layer 7 policy map for RADIUS server load balancing X X Server Load Balancing - RDP (First-Match) Layer 7 policy map for RDP server load balancing X X Server Load Balancing - RTSP (First-Match) Layer 7 policy map for RTSP server load balancing X X Server Load Balancing - SIP (First-Match) Layer 7 policy map for SIP server load balancing X X Table 14-14 Policy Maps and ACE Device Support (continued) Policy Map Type Description ACE Device ACE Module ACE Appliance 14-34 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Related Topics • Information About Virtual Contexts, page 6-2 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Rules and Actions for Policy Maps, page 14-34 Configuring Rules and Actions for Policy Maps Table 14-15 lists the policy maps and related topics for setting rules and actions. Table 14-15 Topic Reference for Policy Map Rules and Actions Policy Map Type Topic for Setting Rules and Actions Layer 3/4 Management Traffic (First-Match) Setting Policy Map Rules and Actions for Layer 3/Layer 4 Management Traffic, page 14-39 Layer 3/4 Network Traffic (First-Match) Setting Policy Map Rules and Actions for Layer 3/Layer 4 Network Traffic, page 14-41 Layer 7 Command Inspection - FTP (First-Match) Setting Policy Map Rules and Actions for Layer 7 FTP Command Inspection, page 14-48 Layer 7 Deep Packet Inspection - HTTP (All-Match) Setting Policy Map Rules and Actions for Layer 7 HTTP Deep Packet Inspection, page 14-51 Layer 7 Deep Packet Inspection - SIP (All-Match) Setting Policy Map Rules and Actions for Layer 7 SIP Deep Packet Inspection, page 14-68 Layer 7 Deep Packet Inspection - Skinny Setting Policy Map Rules and Actions for Layer 7 Skinny Deep Packet Inspection, page 14-71 Layer 7 HTTP Optimization (First-Match) Setting Policy Map Rules and Actions for Layer 7 HTTP Optimization, page 14-57 Layer 7 Server Load Balancing (First-Match) Setting Policy Map Rules and Actions for Layer 7 Server Load-Balancing Traffic, page 14-61 Server Load Balancing - Generic (First-Match) Setting Policy Map Rules and Actions for Generic Server Load Balancing, page 14-35 Server Load Balancing - RADIUS (First-Match) Setting Policy Map Rules and Actions for RADIUS Server Load Balancing, page 14-73 Server Load Balancing - RDP (First-Match) Setting Policy Map Rules and Actions for RDP Server Load Balancing, page 14-75 Server Load Balancing - RTSP (First-Match) Setting Policy Map Rules and Actions for RTSP Server Load Balancing, page 14-76 Server Load Balancing - SIP (First-Match) Setting Policy Map Rules and Actions for SIP Server Load Balancing, page 14-79 14-35 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Setting Policy Map Rules and Actions for Generic Server Load Balancing You can configure the rules and actions for generic traffic received by the ACE. Assumptions This topic assumes the following: • A generic traffic policy map has been configured. • A class map has been defined for a class map rule if you do not want to use the class-default class map. Procedure Step 1 Choose Config > Devices > context > Expert > Policy Maps. The Policy Maps table appears. Step 2 In the Policy Maps table, choose the generic traffic policy map that you want to set rules and actions for. The Rule table appears. Step 3 In the Rule table, click Add to add a new rule, or choose the rule that you want to modify and click Edit. The Rule window appears. Step 4 In the Type field of the Rule window, configure rules using the information in Table 14-16. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Table 14-16 Generic Server Load Balancing Policy Map Rules Option Description Class Map Class map to use for this traffic policy. From the Use Class Map field, do one of the following: • To use the default class map, choose class-default. The class-default class map is a reserved, well-known class map created by the ACE. You cannot delete or modify this class. All traffic that fails to meet the other matching criteria in the named class map belongs to the default traffic class. If none of the specified classifications matches the traffic, then the ACE performs the action specified by the class-default class map. The class-default class map has an implicit match any statement that enables it to match all traffic. • To use a previously created class map, do the following: 1. Choose others. 2. In the Class Map Name field, choose the class map to use. 14-36 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Match Condition Match condition is used for this traffic policy. Match Condition Name Enter a name for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Match Condition Type Layer 4 Payload Layer 4 payload data that is used for the network matching criteria. Do the following: a. In the Layer 4 Payload RegexMatch Condition field, enter a Layer 4 payload expression that is contained within the TCP or UDP entity body. Valid entries are strings containing 1 to 255 alphanumeric characters. Table 14-33 lists the supported characters that you can use for matching string expressions. b. In the Layer 4 Payload Offset field, enter the absolute offset in the data where the Layer 4 payload expression search string starts. The offset starts at the first byte of the TCP or UDP body. Valid entries are from 0 to 999. Source Address Client source host IP address and subnet mask that are used for the network traffic matching criteria. Do the following: a. In the IP Address Type field, choose either IPv4 or IPv6. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. b. In the Source IP v4/v6 Address field, enter the source IP address of the client in the format based on the address type (IPv4 or IPv6). c. Depending on the IP address type that you chose, do one of the following: – For IPv4, in the Source Netmask field, choose the subnet mask for the source IP address. – For IPv6, in the Source Prefix-length field, enter the prefix length for the address. Insert Before a. Indicate whether this rule is to precede another rule for this policy map: – N/A—This option is not configured. – False—This rule is not to precede another rule in this policy map. – True—This rule is to precede another rule in this policy map. The Insert Before Policy Rule field appears. b. If you chose True, in the Insert Before Policy Rule field, choose the rule that you want the current rule to precede. Table 14-16 Generic Server Load Balancing Policy Map Rules (continued) Option Description 14-37 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 5 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The window refreshes and the Action table appears. Continue with Step 6. • Click Cancel to exit this procedure without saving your entries and to return to the Rule table. Note If you chose the Insert Before option described in Table 14-16 and specified True, perform the following steps to refresh the Rule tab before adding an action for this rule: 1. Click the Rule tab to refresh the Rule table. 2. In the Rule table, choose the newly added rule. When the window refreshes, an empty action list appears. Step 6 In the Action table, click Add to add an entry or choose an existing entry to modify and click Edit. Step 7 In the Id field, accept the automatically incremented entry or assign a unique identifier for this action. Step 8 In the Action Type field, configure actions for this rule using the information in Table 14-17. Table 14-17 Generic Server Load Balancing Policy Map Actions Action Description Drop Field that instructs the ACE to discard packets that match this policy map. In the Action Log field, specify whether or not the dropped packets are to be logged in the software: • N/A—This option is not configured. • False—Dropped packets are not to be logged in the software. • True—Dropped packets are to be logged in the software. Forward Field that instructs the ACE to forward the traffic that matches this policy map to its destination. Reverse Sticky Feature that applies only to the ACE module version 3.0(0)A2(1.1), ACE appliance version A4(1.0), or later releases of either device type. Reverse IP stickiness is an enhancement to regular stickiness and is used mainly in FWLB. It ensures that multiple distinct connections that are opened by hosts at both ends (client and server) are load-balanced and stuck to the same firewall. Reverse stickiness applies to such protocols as FTP, RTSP, SIP, and so on where there are separate control channels and data channels opened by the client and the server, respectively. For complete details about reverse stickiness, see the Release Note for the Cisco Application Control Engine Module (Software Version 3.0(0)A2(X)). In the Sticky Group field, choose an existing IP netmask sticky group that you want to associate with reverse IP stickiness. 14-38 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 9 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Action table. • Click Next to deploy your entries and to configure another action. Related Topics • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 Server Farm Serverfarm that the ACE is to load balance client requests for content. Do the following: a. In the Server Farm field, choose the server farm for this policy map action. b. In the Backup Server Farm field, choose the backup server farm for this action. c. Check the Sticky Enabled check box to indicate that the backup server farm is sticky. Uncheck this check box if the backup server farm is not sticky. d. Check the Aggregate State Enabled check box to indicate that the operational state of the backup server farm is taken into consideration when evaluating the state of the load-balancing class in a policy map. Uncheck this check box to indicate that the operational state of the backup server farm is not taken into consideration when evaluating the state of the load-balancing class in a policy map. Server Farm-NAT Dynamic NAT that the ACE is to apply to traffic for this policy map. Do the following: a. In the NAT Pool ID field, enter the number of the pool of IP addresses that exist under the VLAN specified in the VLAN Id field. Valid entries are from 1 to 2147483647. For information about configuring NAT pools, see “Configuring Virtual Context BVI Interfaces” section on page 12-19. b. In the VLAN ID field, choose the VLAN to use for NAT. Valid entries are from 1 to 4094. c. In the Server Farm Type field, indicate whether the server farm is a backup or primary server farm. Set-IP-TOS IP Differentiated Services Code Point (DSCP) bit in the Type of Service (ToS) byte that the ACE is to set. After the IP DSCP bit is set, other Quality of Service (QoS) services can then operate on the bit settings. In the IP TOS Rewrite Value field, enter the IP DSCP value. Valid entries are from 0 to 255. Sticky Group Sticky group that you want to associate with reverse stickiness. Sticky Server Farm Sticky server farm that the ACE is to load balance client requests for content. In the Sticky Group field, choose the sticky server farm that is to be used for requests that match this policy map. Table 14-17 Generic Server Load Balancing Policy Map Actions (continued) Action Description 14-39 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps • Configuring Rules and Actions for Policy Maps, page 14-34 Setting Policy Map Rules and Actions for Layer 3/Layer 4 Management Traffic You can configure the rules and actions for IP management traffic received by the ACE. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Assumptions This topic assumes the following: • A network management policy map has been configured. • A class map has been defined for a class map rule if you do not want to use the class-default class map. Procedure Step 1 Choose Config > Devices > context > Expert > Policy Maps. The Policy Maps table appears. Step 2 In the Policy Maps table, choose the Layer 3/Layer 4 management traffic policy map that you want to set rules and actions for. The Rule table appears. Step 3 In the Rule table, click Add to add a new rule, or choose the rule that you want to modify and click Edit. The Rule window appears. Step 4 In the Type field of the Rule window, confirm that classmap is selected. Step 5 In the Use Class Map field, do one of the following: • For an IPv4 default class map, choose the class-default radio button. • For an IPv6 default class map, choose the class-default-v6 radio button. • For a previously created class map, go to Step 6. Step 6 To use a previously created class map for this rule, do the following: a. In the Use Class Map field, choose the others radio button. b. In the Class Map Name field, choose the class map to be used. c. In the Insert Before field, specify whether this rule is to precede another rule in this policy map: – N/A—This option is not configured. – False—This rule is not to precede another rule in this policy map. – True—This rule is to precede another rule in this policy map. The Insert Before Policy Rule field appears d. If you chose True, in the Insert Before Policy Rule field, choose the rule that you want the current rule to precede. 14-40 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 7 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The Action table appears. To define actions for this rule, continue with Step 8. • Click Cancel to exit this procedure without saving your entries and to return to the Policy Maps table. • Click Next to deploy your entries and to configure another rule. Note If you chose the Insert Before option in Step 6 and specified True, perform the following steps to refresh the Rule tab before adding an action for this rule: 1. Click the Rule tab to refresh the Rule table. 2. In the Rule table, choose the newly added rule. When the window refreshes, an empty action list appears. Step 8 In the Action table, click Add to add an action or choose an existing action, and click Edit to modify it. The Action configuration window appears. Step 9 In the Id field of the Action configuration window, either accept the automatically incremented entry or assign a unique identifier for this action. Step 10 In the Action Type field, confirm that Management Permit is selected to indicate that this action permits or denies network management traffic. Step 11 In the Action field, specify the action that is to occur: • Deny—The ACE is to deny network management traffic when this rule is met. • Permit—The ACE is to accept network management traffic when this rule is met. Step 12 Do the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Action table. • Click Next to deploy your entries and to configure another action. Related Topics • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Rules and Actions for Policy Maps, page 14-34 14-41 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Setting Policy Map Rules and Actions for Layer 3/Layer 4 Network Traffic You can configure rules and actions for Layer 3/Layer 4 traffic other than network management traffic. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Assumptions This topic assumes the following: • You have configured a Layer 3/Layer 4 policy map. • A class map has been defined if you do not want to use the class-default class map. Procedure Step 1 Choose Config > Devices > context > Expert > Policy Maps. The Policy Maps table appears. Step 2 In the Policy Maps table, choose the Layer 3/Layer 4 network traffic policy map that you want to set rules and actions for. The Rule table appears. Step 3 In the Rule table, click Add to add a new rule, or choose the rule that you want to modify and click Edit. The Rule configuration window appears. Step 4 In the Type field of the Rule configuration window, confirm that Class Map is selected. Step 5 In the Use Class Map field, choose one of the following: • For an IPv4 default class map, choose the class-default radio button. • For an IPv6 default class map, choose the class-default-v6 radio button. • For a previously created class map, go to Step 6. Step 6 To use a previously created class map for this rule, do the following: a. In the Use Class Map field, choose the others radio button. b. In the Class Map Name field, choose the class map to be used. c. In the Insert Before field, choose one of the following to indicate whether this rule is to precede another rule in this policy map: – N/A—Indicates that this option is not configured. – False—Indicates that this rule is not to precede another rule in this policy map. – True—Indicates that this rule is to precede another rule in this policy map. If you select True, the Insert Before Policy Rule field appears. Select the rule that you want the current rule to precede. 14-42 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 7 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The window refreshes and the Action field appears. To configure actions for this rule, continue with Step 8. • Click Cancel to exit this procedure without saving your entries and to return to the Policy Maps table. • Click Next to deploy your entries and to configure another rule. Note If you chose the Insert Before option in Step 6 and specified True, perform the following steps to refresh the Rule tab before adding an action for this rule: 1. Click the Rule tab to refresh the Rule table. 2. In the Rule table, choose the newly added rule. When the window refreshes, an empty action list appears. Step 8 In the Action field, click Edit. The Action table appears. Step 9 In the Action table, click Add to add an action or choose an existing action and click Edit to modify it. The Action configuration window appears. Step 10 In the Id field, either accept the automatically incremented entry or assign a unique identifier for this action. Step 11 In the Action Type field, choose the type of action to be taken for this rule and configure the related attributes. See Table 14-18. Table 14-18 Layer 3/Layer 4 Network Traffic Policy Map Actions Action Description/Steps Appl-Parameter-DNS DNS parameter map that contains DNS-related actions that is to be implemented for this rule. In the Parameter Map field, specify the name of the DNS parameter map to use. Appl-Parameter-Generic Generic parameter map that is to be implemented for this rule. In the Parameter Map field, specify the name of the generic parameter map to use. Appl-Parameter-HTTP HTTP parameter map that contains HTTP-related actions that is to be implemented for this rule. In the Parameter Map field, specify the name of the HTTP parameter map to use. Appl-Parameter-RTSP RTSP parameter map that contains RTSP-related actions that is to be implemented for this rule. In the Parameter Map field, specify the name of the RTSP parameter map to use. Appl-Parameter-SIP SIP parameter map that contains SIP-related actions that is to be implemented for this rule. In the Parameter Map field, specify the name of the SIP parameter map to use. Appl-Parameter-Skinny Skinny parameter map that contains Skinny-related actions that is to be implemented for this rule. In the Parameter Map field, specify the name of the Skinny parameter map to use. Connection Connection parameter map that contains TCP/IP connection-related commands that pertain to normalization and termination that is to be implemented for this rule. In the Connection Parameter Maps field, choose the Connection parameter map that is to be used. 14-43 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps HTTP Optimize Option that appears for ACE appliances only. In the HTTP Optimization Policy field, choose the HTTP optimization policy map to use. Inspect Application inspection that is to be implemented for this rule. Do the following: a. In the Inspect Type field, choose the protocol that is to be inspected. b. Provide any protocol-specific information. Table 14-19 describes the available options for application inspection actions. KAL-ap-Primary-Out-of -Service Feature that is supported only for ACE module software Version A2(3.1), ACE appliance software Version A4(1.0), and later versions of either device type. This feature enables the ACE to notify a Global Site Selector (GSS) that the primary server farm is down when the backup server farm is in use. By default, when you configure a redirect server farm as a backup server farm on the ACE and the primary server farm fails, the backup server farm redirects client requests to another data center; however, the VIP remains in the INSERVICE state. When you configure the ACE to communicate with a GSS, it provides information for server availability. When a backup server is in use after the primary server farm is down, this feature enables the ACE to inform the GSS that the VIP for the primary server farm is out of service by returning a load value of 255. The GSS recognizes that the primary server farm is down and sends future DNS requests with the IP address of the other data center. KAL-AP-TAG Feature that is supported only for the ACE module software Version A2(2.0), ACE appliance software Version A4(1.0), and later versions for both device types. The KAL-AP-TAG feature allows the Cisco Global Site Selector (GSS) proprietary KAL-AP protocol to extract load and availability information from the ACE when a firewall is positioned between the GSS and the ACE. This feature allows you to configure a tag (name) per VIP for a maximum of 4096 tags on an ACE. This feature does not replace the tag per domain feature. For more information about this feature, see the Release Note for the Cisco Application Control Engine Module (Software Version A2(2.0)) or the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide (Software Version A2(3.0)), the Configuring Health Monitoring chapter. Note The KAL-AP-TAG selection is not available for the class-default class map. In the KAL-AP-Tag Name field, enter the name as an unquoted text string with no spaces and a maximum of 76 alphanumeric characters. The following scenarios are not supported and will result in an error: • You cannot configure a tag name for a VIP that already has a tag configuration as part of a different policy configuration. • You cannot associate the same tag name with more than one VIP. • You cannot associate the same tag name with a domain and a VIP. • You cannot assign two different tags to two different Layer 3 class maps that have the same VIP, but different port numbers. The KAL-AP protocol considers these class maps to have the same VIP and calculates the load for both Layer 3 rules together when the GSS queries the VIP. Table 14-18 Layer 3/Layer 4 Network Traffic Policy Map Actions (continued) Action Description/Steps 14-44 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps NAT Network address translation (NAT) that the ACE is to use for this rule. Do the following: a. In the NAT Mode field, choose the type of NAT to be used: – Dynamic NAT—NAT is to translate local addresses to a pool of global addresses. Continue with Step c. – Static NAT—NAT is to translate each local address to a fixed global address. Continue with Step b. b. If you chose Static NAT, do the following: 1. In the IP Address Type field, choose either IPv4 or IPv6. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. 2. In the Static Mapped Address field, enter the IP address to use for static NAT translation. This entry establishes the globally unique IP address of a host as it appears to the outside world. The policy map performs the global IP address translation for the source IP address specified in the ACL (as part of the class-map traffic classification). 3. Depending on the IP address type that you chose, do one of the following: - For IPv4, in the Static Mapped Netmask field, choose the subnet mask to apply to the static mapped address. - For IPv6, in the Static Mapped Prefix-length field, enter the prefix length for the static mapped address. 4. In the NAT Protocol field, choose the protocol to use for NAT. Choices are as follows: - N/A—This attribute is not set. - TCP—The ACE is to use TCP for NAT. - UDP—The ACE is to use UDP for NAT. 5. In the Static Port field, enter the TCP or UDP port to use for static port redirection. Valid entries are from 0 to 65535. 6. In the VLAN Id field, choose the VLAN to use for NAT. c. If you chose Dynamic NAT, do the following: 1. In the NAT Pool Id field, enter the number of the pool of IP addresses that exist under the VLAN specified in the VLAN Id field. Valid entries are from 1 to 2147483647. See the “Configuring Virtual Context BVI Interfaces” section on page 12-19. 2. In the VLAN Id field, choose the VLAN to use for NAT. Note For dynamic NAT, ACE allows you to associate a non-configured NAT pool ID to the dynamic NAT action. However, the ANM will not discover the dynamic NAT action when the NAT pool ID is not configured. You must associate the configured NAT pool ID to the dynamic NAT action for ANM discovery to complete successfully. Policymap Layer 7 server load-balancing policy map that the ACE is to associate with this Layer 3/Layer 4 policy map. In the Policy Map field, choose the Layer 7 policy map. Table 14-18 Layer 3/Layer 4 Network Traffic Policy Map Actions (continued) Action Description/Steps 14-45 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps SSL-Proxy SSL proxy server service that defines the SSL parameters that the ACE is to use during the handshake and subsequent SSL session. Do the following: a. In the SSL Proxy field, choose the SSL proxy server service to use in the handshake and subsequent SSL session when the ACE engages with an SSL client. b. In the SSL Proxy Type field, confirm that Server is selected to indicate that the ACE is to be configured so that it is recognized as an SSL server. UDP-Fast-Age Option that appears for ACE modules only. The ACE is to close the connection immediately after sending a response to the client, thereby enabling per-packet load balancing for UDP traffic. VIP-Advertise Option that appears for ACE modules release only. The ACE is to advertise the IP address of a virtual server as the host route. Do the following: a. In the Active field, check the checkbox if you want the ACE to advertises the IP address of the virtual server as the host route only if there is at least one active real server in the server farm. Note Uncheck the Active field check box if you want the ACE to always advertises the IP address of the virtual server whether there is any active real server associated with the VIP. b. If you check the Active field check box, in the Metric Distance field, enter the administrative distance to include in the routing table. Valid entries are from 1 to 254. VIP-ICMP-Reply VIP is to send an ICMP ECHO-REPLY response to ICMP requests. Do the following: a. In the Active field, check the checkbox to instruct the ACE to reply to an ICMP request only if the configured VIP is active. If the VIP is not active and the active option is specified, the ACE discards the ICMP request and the request times out. b. In the Primary Inservice field, check the checkbox to instruct the ACE to reply to an ICMP ping only if the primary server farm state is UP, regardless of the state of the backup server farm. If this option is enabled and the primary server farm state is DOWN, the ACE discards the ICMP request and the request times out. VIP-In-Service VIP is to be enabled for server load-balancing operations. Table 14-18 Layer 3/Layer 4 Network Traffic Policy Map Actions (continued) Action Description/Steps 14-46 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Table 14-19 Layer 3/Layer 4 Network Traffic Policy Map Application Inspection Options Option Description DNS Domain Name System (DNS) query inspection is to be implemented. DNS requires application inspection so that DNS queries will not be subject to the generic UDP handling based on activity timeouts. Instead, the UDP connections associated with DNS queries and responses are torn down as soon as a reply to a DNS query has been received. The ACE performs the reassembly of DNS packets to verify that the packet length is less than the configured maximum length. In the DNS Max. Length field, enter the maximum length of a DNS reply in bytes. Default for all modules and ACE 4710 devices is 512. Valid range for ACE 1.0 modules is 64 to 65535, and for all other supported modules and ACE 4710 devices, 64 to 65535. FTP FTP inspection is to be implemented. The ACE inspects FTP packets, translates the address and port embedded in the payload, and opens up secondary channel for data. a. In the Parameter Map field, specify a previously created parameter map used to define parameters for FTP inspection. b. In the FTP Strict field, specify whether or not the ACE is to check for protocol RFC compliance and prevent Web browsers from sending embedded commands in FTP requests: – N/A—This attribute is not set. – False—The ACE is not to check for RFC compliance or prevent Web browsers from sending embedded commands in FTP requests. – True—The ACE is to check for RFC compliance and prevent Web browsers from sending embedded commands in FTP requests. c. If you chose True, in the FTP Inspect Policy field, choose the Layer 7 FTP command inspection policy to be implemented for this rule. HTTP Enhanced Hypertext Transfer Protocol (HTTP) inspection is to be performed on HTTP traffic. The inspection checks are based on configured parameters in an existing Layer 7 policy map and internal RFC compliance checks performed by the ACE. By default, the ACE allows all request methods. Do the following: a. In the HTTP Inspect Policy field, choose the HTTP inspection policy map to be implemented for this rule. If you do not specify a Layer 7 policy map, the ACE performs a general set of Layer 3 and Layer 4 protocol fixup actions and internal RFC compliance checks. b. In the URL Logging field, specify whether or not Layer 3 and Layer 4 traffic is to be monitored: – N/A—This attribute is not set. – False—Layer 3 and Layer 4 traffic is not to be monitored. – True—Layer 3 and Layer 4 traffic is to be monitored. When enabled, this function logs every URL request that is sent in the specified class of traffic, including the source or destination IP address and the URL that is accessed. 14-47 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps ICMP Internet Control Message Protocol (ICMP) payload inspection is to be performed. ICMP inspection allows ICMP traffic to have a “session” so that it can be inspected similarly to TCP and UDP traffic. In the ICMP Error field, specify whether or not the ACE is to perform name address translation on ICMP error messages: • N/A—This attribute is not set. • False—The ACE is not to perform NAT on ICMP error messages. • True—The ACE is to perform NAT on ICMP error messages. When enabled, the ACE creates translation sessions for intermediate or endpoint nodes that send ICMP error messages based on the NAT configuration. The ACE overwrites the packet with the translated IP addresses. ILS Internet Locator Service (ILS) protocol inspection is to be implemented. RTSP Real Time Streaming Protocol (RTSP) packet inspection is to be implemented. RTSP is used by RealAudio, RealNetworks, Apple QuickTime 4, RealPlayer, and Cisco IP/TV connections. The ACE monitors Setup and Response (200 OK) messages in the control channel established using TCP port 554 (no UDP support). In the Parameter Map field, choose a previously defined parameter map used to define parameters for RTSP inspection. SIP SIP protocol inspection is to be implemented. SIP is used for call handling sessions and instant messaging. The ACE inspects signaling messages for media connection addresses, media ports, and embryonic connections. The ACE also uses NAT to translate IP addresses that are embedded in the user-data portion of the packet. Do the following: a. In the Parameter Map field, specify a previously created parameter map used to define parameters for SIP inspection. b. In the SIP Inspect Policy field, choose a previously created Layer 7 SIP inspection policy map to implement packet inspection of Layer 7 SIP application traffic. If you do not specify a Layer 7 policy map, the ACE performs a general set of Layer 3 and Layer 4 HTTP fixup actions and internal RFC compliance checks. Skinny Cisco Skinny Client Control Protocol (SCCP) protocol inspection is to be implemented. The SCCP is a Cisco proprietary protocol that is used between Cisco CallManager and Cisco VOiP phones. The ACE uses NAT to translate embedded IP addresses and port numbers in SCCP packet data. Do the following: a. In the Parameter Map field, specify a previously created connection parameter map used to define parameters for Skinny inspection. b. In the Skinny Inspect Policy field, choose a previously created Layer 7 Skinny inspection policy map to implement packet inspection of Layer 7 Skinny application traffic. If you do not specify a Layer 7 policy map, the ACE performs a general set of Layer 3 and Layer 4 HTTP fixup actions and internal RFC compliance checks. Table 14-19 Layer 3/Layer 4 Network Traffic Policy Map Application Inspection Options (continued) Option Description 14-48 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 12 Do the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Action table. • Click Next to deploy your entries and to configure another Action. Related Topics • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 Setting Policy Map Rules and Actions for Layer 7 FTP Command Inspection You can add rules and actions for Layer 7 FTP command inspection policy maps. File Transfer Protocol (FTP) inspection inspects FTP sessions for address translation in a message, dynamic opening of ports, and stateful tracking of request and response messages. Each specified FTP command must be acknowledged before the ACE allows a new command. Command filtering allows you to restrict specific commands by the ACE. When the ACE denies a command, it closes the connection. The FTP command inspection process, as performed by the ACE: • Prepares a dynamic secondary data connection. The channels are allocated in response to a file upload, a file download, or a directory listing event and must be prenegotiated. The port is negotiated through the PORT or PASV commands. • Tracks the FTP command-response sequence. The ACE performs the command checks listed below. If you specify the FTP Strict field in a Layer 3 and Layer 4 policy map, the ACE tracks each FTP command and response sequence for the anomalous activity outlined below. The FTP Strict parameter is used in conjunction with a Layer 7 FTP policy map (nested within the Layer 3 and Layer 4 policy map) to deny certain FTP commands or to mask the server reply for SYST command. Note The use of the FTP Strict parameter may affect FTP clients that do not comply with the RFC standards. – Truncated command—Checks the number of commas in the PORT and PASV reply command against a fixed value of five. If the value is not five, the ACE assumes that the PORT command is truncated and issues a warning message and closes the TCP connection. – Incorrect command—Checks the FTP command to verify if it ends with characters, as required by RFC 959. If the FTP command does not end with those characters, the ACE closes the connection. – Size of RETR and STOR commands—Checked the size of the RETR and STOR commands against a fixed constant of 256. If the size is greater, the ACE logs an error message and closes the connection. – Command spoofing—Verifies that the PORT command is always sent from the client. If a PORT command is sent from the server, the ACE denies the TCP connection. 14-49 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps – Reply spoofing—Verifies that the PASV reply command (227) is always sent from the server. If a PASV reply command is sent from the client, the ACE denies the TCP connection. This denial prevents a security hole when the user executes “227 xxxxx a1, a2, a3, a4, p1, p2.” – Invalid port negotiation—Checks the negotiated dynamic port value to verify that it is greater than 1024 (port numbers in the range from 2 to 1024 are reserved for well-known connections). If the negotiated port falls in this range, the ACE closes the TCP connection. – Command pipelining—Checks the number of characters present after the port numbers in the PORT and PASV reply command against a constant value of 8. If the number of characters is greater than 8, the ACE closes the TCP connection. • Translates embedded IP addresses in conjunction with NAT. FTP command inspection translates the IP address within the application payload. Refer to RFC 959 for background details. Procedure Step 1 Choose Config > Devices > context > Expert > Policy Maps. The Policy Maps table appears. Step 2 In the Policy Maps table, choose the Layer 7 FTP command inspection policy map that you want to set rules and actions for. The Rule table appears. Step 3 In the Rule table, click Add to add a new rule, or choose an existing rule and click Edit to modify it. The Rule configuration window appears. Step 4 In the Type field of the Rule configuration window, configure rules using the information in Table 14-20. Table 14-20 Layer 7 FTP Command Inspection Policy Map Rules Option Description Class Map Class map to use for this traffic policy. Do the following: a. To use the class-default class map, check the Use Class Default check box. The class-default class map is a reserved, well-known class map created by the ACE. You cannot delete or modify this class. All traffic that fails to meet the other matching criteria in the named class map belongs to the default traffic class. If none of the specified classifications matches the traffic, then the ACE performs the action specified by the class-default class map. The class-default class map has an implicit match any statement that enables it to match all traffic. b. To use a previously created class map, do the following: 1. Clear the Use Class Default check box. 2. In the Class Map Name field, choose the class map to be used. 14-50 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 5 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The window refreshes and the Action table appears. Continue with Step 6. • Click Cancel to exit this procedure without saving your entries and to return to the Policy Maps table. • Click Next to deploy your entries and to configure another rule. Note If you chose the Insert Before option described in Table 14-20 and specified True, perform the following steps to refresh the Rule tab before adding an action for this rule: 1. Click the Rule tab to refresh the Rule table. 2. In the Rule table, choose the newly added rule. When the window refreshes, an empty action list appears. Step 6 In the Action table, click Add to add an entry, or choose an existing entry and click Edit to modify it. The Action configuration window appears. Step 7 In the Id field of the Action configuration window, either accept the automatically incremented entry or assign a unique identifier for this action. Step 8 In the Action Type field, specify the action to be taken for this rule: • Deny—The ACE is to deny the specified FTP command when this rule is met. Match Condition Match condition to use for this traffic policy. Do the following: a. In the Match Condition Name field, enter a name for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. b. In the Match Condition Type field, confirm that Request Method Name is selected. c. In the Request Method Name field, choose the FTP command to be inspected for this rule. Table 14-8 describes the FTP commands that can be inspected. Insert Before Order of the rules in the policy map. Do the following: a. Specify whether or not this rule is to precede another rule for this policy map. Choices are as follows: – N/A—This option is not configured. – False—This rule is not to precede another rule in this policy map. – True—This rule is to precede another rule in this policy map. The Insert Before Policy Rule field appears. b. If you chose True, in the Insert Before Policy Rule field, choose the rule that you want the current rule to precede. Table 14-20 Layer 7 FTP Command Inspection Policy Map Rules (continued) Option Description 14-51 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps • Mask Reply—The ACE is to mask the reply to the FTP syst command by filtering sensitive information from the command output. The action applies to the FTP syst command only. Step 9 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Action table. • Click Next to deploy your entries and to configure another action for this rule. Related Topics • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 Setting Policy Map Rules and Actions for Layer 7 HTTP Deep Packet Inspection You can add rules and actions for Layer 7 HTTP deep packet inspection policy maps. The ACE performs a stateful deep packet inspection of the HTTP protocol. Deep packet inspection is a special case of application inspection where the ACE examines the application payload of a packet or a traffic stream and makes decisions based on the content of the data. During HTTP deep inspection, the main focus of the application inspection process is on HTTP attributes such as HTTP header, URL, and to a limited extent, the payload. User-defined regular expressions can also be used to detect “signatures” in the payload. You define policies to permit or deny the traffic, or to send a TCP reset message to the client or server to close the connection. The security features covered by HTTP application inspection include: • RFC compliance monitoring and RFC method filtering • Content, URL, and HTTP header length checks • Transfer-encoding methods • Content type verification and filtering • Port 80 misuse Procedure Step 1 Choose Config > Devices > context > Expert > Policy Maps. The Policy Maps table appears. Step 2 In the Policy Maps table, choose the Layer 7 deep packet inspection policy map that you want to set rules and actions for. The Rule table appears. Step 3 In the Rule table, click Add to add a new rule, or choose an existing rule and click Edit to modify it. The Rule configuration window appears. Step 4 In the Type field of the Rule configuration window, configure rules using the information in Table 14-21. 14-52 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Table 14-21 Layer 7 HTTP Deep Packet Inspection Policy Map Rules Option Description Class Map Class map to use for this traffic policy. From the Use Class Map field, do one of the following: • To use the default class map, choose class-default. The class-default class map is a reserved, well-known class map created by the ACE. You cannot delete or modify this class. All traffic that fails to meet the other matching criteria in the named class map belongs to the default traffic class. If none of the specified classifications matches the traffic, then the ACE performs the action specified by the class-default class map. The class-default class map has an implicit match any statement that enables it to match all traffic. • To use a previously created class map, do the following: 1. Choose others. 2. In the Class Map Name field, choose the class map to use. Match Condition Match condition to use for this traffic policy. Do the following: a. In the Match Condition Name field, enter a name for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. b. In the Match Condition Type field, choose the method by which match decisions are to be made and their corresponding conditions. See Table 14-22 for information about these selections. Insert Before Order of the rules in the policy map. Do the following: a. Specify whether or not this rule is to precede another rule for this policy map. Choices are as follows: – N/A—This option is not configured. – False—This rule is not to precede another rule in this policy map. – True—This rule is to precede another rule in this policy map. The Insert Before Policy Rule field appears. b. If you chose True, in the Insert Before Policy Rule field, choose the rule that you want the current rule to precede. 14-53 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Table 14-22 Layer 7 HTTP Deep Packet Inspection Policy Map Match Conditions Match Condition Description Content Content contained within the HTTP entity-body that is used for protocol inspection decisions. Do the following: a. In the Content Expression field, enter the content that is to be matched. Valid entries are alphanumeric strings from 1 to 255 characters. b. In the Content Offset (Bytes) field, enter the number of bytes to be ignored starting with the first byte of the Message body, after the empty line (CR,LF,CR,LF) between the headers and the body of the message. Valid entries are from 1 to 255 bytes. Content Length Content parse length in an HTTP message that is used for protocol inspection decisions. Do the following: a. In the Content Length Operator field, choose the operand to be used to compare content length: – Equal To—Content length must equal the number in the Content Length Value (Bytes) field. – Greater Than—Content length must be greater than the number in the Content Length Value (Bytes) field. – Less Than—Content length must be less than the number in the Content Length Value (Bytes) field. – Range—Content length must be within the range specified in the Content Length Lower Value (Bytes) field and the Content Length Higher Value (Bytes) field. b. Enter values to apply for content length comparison as follows: – If you chose Equal To, Greater Than, or Less Than in the Content Length Operator field, the Content Length Value (Bytes) field appears. In the Content Length Value (Bytes) field, enter the number of bytes for comparison. Valid entries are from 0 to 4294967295. – If you chose Range in the Content Length Operator field, the Content Length Lower Value (Bytes) and the Content Length Higher Value (Bytes) fields appear: 1. In the Content Length Lower Value (Bytes) field, enter the lowest number of bytes to be used for this match condition. Valid entries are from 0 to 4294967295. The number in this field must be less than the number entered in the Content Length Higher Value (Bytes) field. 2. In the Content Length Higher Value (Bytes) field, enter the highest number of bytes to be used for this match condition. Valid entries are from 1 to 4294967295. The number in this field must be greater than the number entered in the Content Length Lower Value (Bytes) field. Content Type Verification Match command that verifies the content MIME-type messages with the header MIME-type. This inline match command limits the MIME-types in HTTP messages allowed through the ACE. It verifies that the header MIME-type value is in the internal list of supported MIME-types and the header MIME-type matches the actual content in the data or entity body portion of the message. If they do not match, the ACE performs the specified Layer 7 policy map action. 14-54 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Header Name and value in an HTTP header that are used for protocol inspection decisions. Do the following: a. In the Header field, choose one of the predefined HTTP headers to be matched, or choose HTTP Header to specify a different HTTP header. b. If you chose HTTP Header, in the Header Name field, enter the name of the HTTP header to match. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. c. In the Header Value (Bytes) field, enter the header value expression string to compare against the value in the specified field in the HTTP header. Valid entries are text strings with a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching. To include spaces in the string, enclose the entire string in quotes. All headers in the header map must be matched. See Table 14-33 for a list of the supported characters that you can use in regular expressions. Header Length Length of the header in the HTTP message that is used for protocol inspection decisions. Do the following: a. In the Header Length Type field, specify whether or not HTTP header request or response messages are to be used for protocol inspection decisions: – Request—HTTP header request messages are to be checked for header length. – Response—HTTP header response messages are to be checked for header length. b. In the Header Length Operator field, choose the operand to be used to compare header length: – Equal To—The header length must equal the number in the Header Length Value (Bytes) field. – Greater Than—The header length must be greater than the number in the Header Length Value (Bytes) field. – Less Than—The header length must be less than the number in the Header Length Value (Bytes) field. – Range—The header length must be within the range specified in the Header Length Lower Value (Bytes) field and the Header Length Higher Value (Bytes) field. c. Enter values to apply for header length comparison as follows: – If you chose Equal To, Greater Than, or Less Than in the Header Length Operator field, the Header Length Value (Bytes) field appears. In the Header Length Value (Bytes) field, enter the number of bytes for comparison. Valid entries are from 0 to 255. – If you chose Range in the Header Length Operator field, the Header Length Lower Value (Bytes) and the Header Length Higher Value (Bytes) fields appear. Do the following: 1. In the Header Length Lower Value (Bytes) field, enter the lowest number of bytes to be used for this match condition. Valid entries are from 0 to 255. The number in this field must be less than the number entered in the Header Length Higher Value (Bytes) field. 2. In the Header Length Higher Value (Bytes) field, enter the highest number of bytes to be used for this match condition. Valid entries are from 1 to 255. The number in this field must be greater than the number entered in the Header Length Lower Value (Bytes) field. Table 14-22 Layer 7 HTTP Deep Packet Inspection Policy Map Match Conditions (continued) Match Condition Description 14-55 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Header MIME Type Multipurpose Internet Mail Extension (MIME) message types that are used for protocol inspection decisions. In the Header MIME Type field, choose the MIME message type to be used for this match condition. Port Misuse Misuse of port 80 (or any other port running HTTP) that is used for protocol inspection decisions. In the Port Misuse field, choose the application category to be used for this match condition: • IM—Instant messaging applications are to be used for this match condition. • P2P—Peer-to-peer applications are to be used for this match condition. • Tunneling—Tunneling applications are to be used for this match condition. Request Method Request method that is used for protocol inspection decisions. By default, ACEs allow all request and extension methods. This option allows you to configure class maps that define protocol inspection decisions based on compliance to request methods defined in RFC 2616 and by HTTP extension methods. a. In the Request Method Type field, choose the type of compliance to be used for protocol inspection decision: – Ext—An HTTP extension method is to be used for protocol inspection decisions. Note The list of available HTTP extension methods from which to choose varies depending on the version of software installed in the ACE. – RFC—A request method defined in RFC 2616 is to be used for protocol inspection decisions. b. In the Request Method field, choose the specific request method to be used. Strict HTTP Internal compliance checks that are performed to verify that a message is compliant with the HTTP RFC standard, RFC 2616. If the HTTP message is not compliant, the ACE performs the specified Layer 7 policy map action. Transfer Encoding HTTP transfer-encoding type that is used for protocol inspection decisions. The transfer-encoding general-header field indicates the type of transformation, if any, that has been applied to the HTTP message body to safely transfer it between the sender and the recipient. In the Transfer Encoding field, choose the type of encoding that is to be checked: • Chunked—Message body is transferred as a series of chunks. • Compress—Encoding format that is produced by the UNIX file compression program compress. • Deflate—The .zlib format that is defined in RFC 1950 in combination with the DEFLATE compression mechanism described in RFC 1951. • Gzip—Encoding format that is produced by the file compression program GZIP (GNU zip) as described in RFC 1952. • Identity—Default (identity) encoding which does not require the use of transformation. Table 14-22 Layer 7 HTTP Deep Packet Inspection Policy Map Match Conditions (continued) Match Condition Description 14-56 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 5 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The window refreshes and the Action table appears. To define actions for this rule, continue with Step 6. • Click Cancel to exit this procedure without saving your entries and to return to the Policy Maps table. • Click Next to deploy your entries and to configure another rule. URL URL names are used for protocol inspection decisions. In the URL field, enter a URL or a portion of a URL to match. Valid entries are URL strings from 1 to 255 alphanumeric characters and include only the portion of the URL following www.hostname.domain. For example, in the URL www.anydomain.com/latest/whatsnew.html, include only /latest/whatsnew.html. URL Length URL length that is used for protocol inspection decisions. Do the following: a. In the URL Length Operator field, choose the operand to be used to compare URL length: – Equal To—URL length must equal the number in the URL Length Value (Bytes) field. – Greater Than—URL length must be greater than the number in the URL Length Value (Bytes) field. – Less Than—URL length must be less than the number in the URL Length Value (Bytes) field. – Range—URL length must be within the range specified in the URL Length Lower Value (Bytes) field and the URL Length Higher Value (Bytes) field. b. Enter values to apply for URL length comparison as follows: – If you chose Equal To, Greater Than, or Less Than in the URL Length Operator field, the URL Length Value (Bytes) field appears. In the URL Length Value (Bytes) field, enter the value for comparison. Valid entries are from 1 to 65535 bytes. – If you chose Range in the URL Length Operator field, the URL Length Lower Value (Bytes) and the URL Length Higher Value (Bytes) fields appear. Do the following: 1. In the URL Length Lower Value (Bytes) field, enter the lowest number of bytes to be used for this match condition. Valid entries are from 1 to 65535. The number in this field must be less than the number entered in the URL Length Higher Value (Bytes) field. 2. In the URL Length Higher Value (Bytes) field, enter the highest number of bytes to be used for this match condition. Valid entries are from 1 to 65535. The number in this field must be greater than the number entered in the URL Length Lower Value (Bytes) field. Table 14-22 Layer 7 HTTP Deep Packet Inspection Policy Map Match Conditions (continued) Match Condition Description 14-57 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Note If you chose the Insert Before option described in Table 14-21 and specified True, perform the following steps to refresh the Rule tab before adding an action for this rule: 1. Click the Rule tab to refresh the Rule table. 2. In the Rule table, choose the newly added rule. When the window refreshes, an empty action list appears. Step 6 In the Action table, click Add to add a new action, or choose an existing action and click Edit to modify it. The Action configuration window appears. Step 7 In the Id field of the Action configuration window, either accept the automatically incremented entry or assign a unique identifier for this action. Step 8 In the Action Type field, choose the action to be taken for this rule: • Permit—The HTTP traffic is to be allowed if it meets the match criteria. • Reset—The HTTP traffic is to be denied if it meets the match criteria. A TCP reset message is sent to the client or server to close the connection. Step 9 In the Action Log field, specify whether or not the action taken is to be logged: • N/A—This option is not configured. • False—Dropped packets are not to be logged in the software. • True—Dropped packets are to be logged in the software. Step 10 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Action table. • Click Next to configure another action for this policy map and rule. Related Topics • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Rules and Actions for Policy Maps, page 14-34 Setting Policy Map Rules and Actions for Layer 7 HTTP Optimization Note HTTP optimization policy maps are available for ACE appliances only. You can add rules and actions for Layer 7 HTTP optimization policy maps. 14-58 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Assumptions This topic assumes the following: • An action list has been configured. See Configuring an HTTP Optimization Action List, page 15-3 for more information. • A class map has been defined if you are not using the class-default class map. See Configuring Virtual Context Class Maps, page 14-6 for more information. Procedure Step 1 Choose Config > Devices > context > Expert > Policy Maps. The Policy Maps table appears. Step 2 In the Policy Maps table, choose the Layer 7 HTTP optimization policy map that you want to set rules and actions for. The Rule table appears. Step 3 In the Rule table, click Add to add a new rule, or choose an existing rule and click Edit to modify it. The Rule configuration window appears. Step 4 In the Type field of the Rule configuration window, configure rules using the information in Table 14-23. Table 14-23 Layer 7 HTTP Optimization Policy Map Rules Option Description Class Map Class map to use for this traffic policy. From the Use Class Map field, do one of the following: • To use the default class map, choose class-default. The class-default class map is a reserved, well-known class map created by the ACE. You cannot delete or modify this class. All traffic that fails to meet the other matching criteria in the named class map belongs to the default traffic class. If none of the specified classifications matches the traffic, then the ACE performs the action specified by the class-default class map. The class-default class map has an implicit match any statement that enables it to match all traffic. • To use a previously created class map, do the following: 1. Choose others. 2. In the Class Map Name field, choose the class map to use. 14-59 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Match Condition Match condition to use for this traffic policy. Do the following: a. In the Match Condition Name field, enter a name for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. b. In the Match Condition Type field, choose the method by which match decisions are to be made and their corresponding conditions. See Table 14-24 for information about these selections. Insert Before Order of the rules in the policy map. Do the following: a. Specify whether or not this rule is to precede another rule for this policy map: – N/A—This option is not configured. – False—This rule is not to precede another rule in this policy map. – True—This rule is to precede another rule in this policy map. The Insert Before Policy Rule field appears. b. If you chose True, in the Insert Before Policy Rule field, choose the rule that you want the current rule to precede. Table 14-23 Layer 7 HTTP Optimization Policy Map Rules (continued) Option Description 14-60 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 5 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The window refreshes and the Action table appears. To define actions for this rule, continue with Step 6. • Click Cancel to exit this procedure without saving your entries and to return to the Rule table. • Click Next to deploy your entries and to configure another rule. Table 14-24 Layer 7 HTTP Optimization Policy Map Match Conditions Match Condition Procedure Cookie HTTP cookie that is to be used to establish a match condition. Do the following: a. In the Cookie Name field, enter a unique cookie name. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. b. In the Cookie Value field, enter a unique cookie value expression. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. c. In the Secondary Cookie field, check the checkbox to specify that the ACE is to use either the cookie name or the cookie value to satisfy this match condition. Uncheck this check box to indicate that the ACE is to use either the cookie name or the cookie value to satisfy this match condition. Header HTTP header that is to be used to establish a match condition. Do the following: a. In the Header field, choose one of the predefined HTTP headers to be matched, or choose HTTP Header to specify a different HTTP header. b. If you chose HTTP Header, in the Header Name field, enter the name of the HTTP header to match. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. c. In the Header Value (Bytes) field, enter the header value expression string to compare against the value in the specified field in the HTTP header. Valid entries are text strings with a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching. To include spaces in the string, enclose the entire string in quotes. All headers in the header map must be matched. See Table 14-33 for a list of the supported characters that you can use in regular expressions. HTTP URL Portion of an HTTP URL that is to be used to establish a match condition. Do the following: a. In the URL Expression field, enter a URL or a portion of a URL to match. Valid entries are URL strings from 1 to 255 alphanumeric characters and include only the portion of the URL following www.hostname.domain. For example, in the URL www.anydomain.com/latest/whatsnew.html, include only /latest/whatsnew.html. b. In the Method Expression field, enter the HTTP method to match. Valid entries are method names entered as unquoted text strings with no spaces and a maximum of 15 alphanumeric characters. You can enter either one of the standard HTTP 1.1 method names (OPTIONS, GET, HEAD, POST, PUT, DELETE, TRACE, or CONNECT) or a text string that must be matched exactly (for example, CORVETTE). 14-61 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Note If you chose the Insert Before option described in Table 14-23 and specified True, perform the following steps to refresh the Rule tab before adding an action for this rule: 1. Click the Rule tab to refresh the Rule table. 2. In the Rule table, choose the newly added rule. When the window refreshes, an empty action list appears. Step 6 In the Action table, click Add to add a new action, or choose an existing action and click Edit to modify it. The Action configuration window appears. Step 7 In the Id field of the Action configuration window, either accept the automatically incremented entry or assign a unique identifier for this action. Step 8 In the Action Type field, confirm that Action List is selected. Step 9 In the Action List field, choose the action list to apply to this policy map and rule. Step 10 In the Optimization Parameter Map field, choose the optimization parameter map to apply to this policy map and rule. Step 11 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries and to return to the Action table. • Click Next to deploy your entries and to configure another action for this rule. Related Topics • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Rules and Actions for Policy Maps, page 14-34 Setting Policy Map Rules and Actions for Layer 7 Server Load-Balancing Traffic You can set rules and actions for Layer 7 server load-balancing policy maps. Assumptions This topic assumes the following: • You have configured a load-balancing policy map and want to establish the corresponding rules and actions. • If you want to configure an SSL proxy action, you have configured SSL proxy service for this context. 14-62 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps • If you want to insert, rewrite, and delete HTTP headers, ensure that an HTTP header modify action list has been configured (see the “Configuring an HTTP Header Modify Action List” section on page 14-85). Procedure Step 1 Choose Config > Devices > context > Expert > Policy Maps. The Policy Maps table appears. Step 2 In the Policy Maps table, choose the load-balancing policy map you want to set rules and actions for. The Rule table appears. Step 3 In the Rule table, click Add to add a new rule, or choose an existing rule and Edit to modify it. The Rule configuration window appears. Step 4 From the Type field, choose one of the following rule types to use: • Class Map—Indicates that the ACE appliance is to use an existing class map that identifies the rules and corresponding actions. If you choose this rule type, go to Step 5. • Match Condition—Indicates that the ACE appliance is to use a set of conditions to identify the rules and corresponding actions. If you choose this rule type, go to Step 6. Step 5 If you chose Class Map rule type, from the Use Class Map field, either choose class-default to use the default class map or specify a previously created class map as follows: a. From the Use Class Map field, choose others. The Class Map field appears. b. From the Class Map field, choose the class map to use. c. In the Insert Before field, indicate whether this rule is to precede another rule in this policy map by choosing on of the following options: – N/A—Indicates that this option is not configured. – False—Indicates that this rule is not to precede another rule in this policy map. – True—Indicates that this rule is to precede another rule in this policy map. d. If you chose True, the Insert Before Policy Rule field appears. Select the rule that you want the current rule to precede. Step 6 If you chose the Match Conditions rule type, do the following: a. In the Match Condition Name field enter a name for the match condition. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. b. In the Match Condition Type field, select the method by which match decisions are to be made and their corresponding conditions. See Table 14-25 for information about these selections. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. 14-63 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Table 14-25 Layer 7 Server Load Balancing Policy Map Match Conditions Match Condition Description HTTP Content Option that appears for ACE modules only. Specific content contained within the HTTP entity-body is used to establish a match condition. Do the following: a. In the Content Expression field, enter the content that is to be matched. Valid entries are alphanumeric strings from 1 to 255 characters. b. In the Content Offset (Bytes) field, enter the number of bytes to be ignored starting with the first byte of the Message body, after the empty line (CR,LF,CR,LF) between the headers and the body of the message. Valid entries are from 1 to 255. HTTP Cookie HTTP cookies are to be used for this match condition. Do the following: a. In the Cookie Name field, enter a unique cookie name. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. b. In the Cookie Value field, enter a unique cookie value expression. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 14-33 lists the supported characters that you can use for matching string expressions. HTTP Header HTTP header and a corresponding value are to be used for this match condition. Do the following: a. In the Header Name field, specify the header to match in one of the following ways: – To specify an HTTP header that is not one of the standard HTTP headers, choose the first radio button, then enter the HTTP header name in the Header Name field. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. – To specify a standard HTTP header, click the second radio button, then choose an HTTP header from the list. b. In the Header Value (Bytes) field, enter the header-value expression string to compare against the value in the specified field in the HTTP header. Valid entries are text strings with a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching. To include spaces, enclose the entire string in quotes. All headers in the header map must be matched. See Table 14-33 for a list of the supported characters that you can use in regular expressions. 14-64 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 7 For specific class maps and match conditions, in the Insert Before field, indicate whether this rule is to precede another defined policy rule by choosing one of the following: • N/A—Indicates that this option is not applicable. • False—Indicates that this rule is not to precede another defined policy rule. • True—Indicates that this rule is to precede another policy rule. If you select True, in the Insert Before Policy Rule field, select the policy rule that this rule is to precede. Step 8 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The window refreshes and the Action table appears. To define the actions for this rule, continue with Step 9. • Click Cancel to exit this procedure without saving your entries and to return to the Rule table. • Click Next to deploy your entries and to configure another rule. HTTP URL Rule that performs regular expression matching against the received packet data from a particular connection based on the HTTP URL string. Do the following: a. In the URL Expression field, enter a URL, or portion of a URL, to match. Valid entries are URL strings from 1 to 255 alphanumeric characters. Include only the portion of the URL following www.hostname.domain in the match statement. For example, in the URL www.anydomain.com/latest/whatsnew.html, include only /latest/whatsnew.html. To match the www.anydomain.com portion, the URL string can take the form of a URL regular expression. The ACE supports regular expressions for matching URL strings. See Table 14-33 for a list of the supported characters that you can use in regular expressions. b. In the Method Expression field, enter the HTTP method to match. Valid entries are unquoted text strings with no spaces and a maximum of 15 alphanumeric characters. The method can either be one of the standard HTTP 1.1 method names (OPTIONS, GET, HEAD, POST, PUT, DELETE, TRACE, or CONNECT) or a text string that must be matched exactly (for example, CORVETTE). Source Address Client source IP address that is used to establish match conditions. Do the following: a. In the IP Address Type field, choose either IPv4 or IPv6. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. b. In the Source IP v4/v6 Address field, enter the source IP address of the client in the format based on the address type (IPv4 or IPv6). c. Depending on the IP address type that you chose, do one of the following: – For IPv4, from the Source Netmask field, choose the subnet mask of the IP address. – For IPv6, from the Source Prefix-length field, enter the prefix length for the address. Table 14-25 Layer 7 Server Load Balancing Policy Map Match Conditions (continued) Match Condition Description 14-65 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Note If you chose the Insert Before option described in Step 7 and specified True, perform the following steps to refresh the Rule tab before adding an action for this rule: 1. Click the Rule tab to refresh the Rule table. 2. In the Rule table, choose the newly added rule. When the window refreshes, an empty action list appears. Step 9 In the Action table, click Add to add a new action, or choose an existing action and click Edit to modify it. Step 10 In the Id field, either accept the automatically incremented entry or assign a unique identifier for this action. Step 11 In the Action Type field, choose the action to be taken and configure any action-specific attributes as described in Table 14-26. Table 14-26 Layer 7 Server Load Balancing Policy Map Actions Action Description Action Action that the ACE is to implement for the rule. In the Action List field, choose an action list to associate with this rule. Compress Option that appears for ACE appliances (all versions) and ACE modules version A4(1.0) and later. The ACE is to compress packets that match this policy map. This option is available only when you associate an HTTP-type class map with a policy map. In the Compress Method field, specify the method that the ACE is to use to compress packets: • Deflate—Indicates that the ACE is to use the DEFLATE compression method when the client browser supports both the DEFLATE and GZIP compression methods. • Gzip—Indicates that ACE is to use the GZIP compression method when the client browser supports both the DEFLATE and GZIP compression methods. Drop Field that instructs the ACE to discard packets that match the rule. In the Action Log field, specify whether or not the dropped packets are to be logged in the software: • N/A—This option is not configured. • False—Dropped packets are not to be logged in the software. • True—Dropped packets are to be logged in the software. Forward Field that instructs the ACE to forward requests that match this policy map without load balancing the requests. 14-66 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Insert-HTTP Field that instructs the ACE to insert an HTTP header for Layer 7 load balancing for requests that match this policy map. This option allows the ACE to identify a client whose IP address has been translated using NAT by inserting a generic header and string value in the client HTTP request. Do the following: a. In the HTTP Header Name field, enter the name of the generic field in the HTTP header. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. b. In the HTTP Header Value field, enter the value to be inserted into the HTTP header. Valid entries are unquoted text strings with a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching. To include spaces, enclose the entire string in quotes. All headers in the header map must be matched. See Table 14-33 for a list of the supported characters that you can use in regular expressions. Reverse Sticky Feature that applies only to the ACE module version 3.0(0)A2(1.1), ACE appliance version A4(1.0), or later releases of either device type. Reverse IP stickiness is an enhancement to regular stickiness and is used mainly in firewall load balancing (FWLB). It ensures that multiple distinct connections that are opened by hosts at both ends (client and server) are load-balanced and stuck to the same firewall. Reverse stickiness applies to such protocols as FTP, RTSP, SIP, and so on where there are separate control channels and data channels opened by the client and the server, respectively. For complete details about reverse stickiness, see the Release Note for the Cisco Application Control Engine Module (Software Version 3.0(0)A2(X)). In the Sticky Group field, choose the name of a an existing IP netmask sticky group that you want to associate with reverse IP stickiness. Server Farm Field that instructs the ACE to load balance client requests for content to a server farm. Do the following: a. In the Server Farm field, choose the server farm to which requests for content are to be sent. b. In the Backup Server Farm field, choose the backup server farm to which requests for content are to be sent. Choose N/A to indicate that no backup server farm is to be used. c. Choose the Sticky Enabled check box to indicate that the sticky group associated with this policy and applied to the primary server farm is applied to the backup server farm. Clear the Sticky Enabled check box to indicate that the sticky group associated with this policy and applied to the primary server farm in that policy is not applied to the backup server farm. d. Choose the Aggregate State Enabled check box to indicate that the operational state of the backup server farm is taken into consideration when evaluating the state of the load-balancing class in a policy map. Clear this check box to indicate that the operational state of the backup server farm is not taken into consideration when evaluating the state of the load-balancing class in a policy map. Table 14-26 Layer 7 Server Load Balancing Policy Map Actions (continued) Action Description 14-67 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Server Farm-NAT Option that appears for ACE modules only. The ACE is to apply dynamic NAT to traffic for this policy map. Do the following: a. In the NAT Pool ID field, enter the number of the pool of IP addresses that exist under the VLAN specified in the VLAN Id field. Valid entries are from 1 to 2147483647. For information on configuring NAT pools, see Configuring Virtual Context BVI Interfaces, page 12-19. b. In the VLAN ID field, choose the VLAN to use for NAT. Valid entries are from 1 to 4094. c. In the Server Farm Type field, indicate whether the server farm is a backup or primary server farm. Set IP-TOS Set the IP Differentiated Services Code Point (DSCP) bit in the Type of Service (ToS) byte. After the IP DSCP bit is set, other Quality of Service (QoS) services can then operate on the bit settings. In the IP TOS Rewrite Value (Bytes) field, enter the IP DSCP value. Valid entries are from 0 to 255. SSL-Proxy SSL proxy client service that defines the SSL parameters that the ACE is to use during the handshake and subsequent SSL session. Do the following: a. In the SSL Proxy field, choose the SSL proxy service to be used for this action. b. In the SSL Proxy Type field, confirm that Client is selected to indicate that the ACE is to be configured so that it is recognized as an SSL client. Sticky-Server Farm Field that instructs the ACE to load balance requests that match this policy to a sticky server farm. In the Sticky Group field, choose the sticky server farm that is to be used for requests that match this policy map. Table 14-26 Layer 7 Server Load Balancing Policy Map Actions (continued) Action Description 14-68 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 12 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Action table. • Click Next to deploy your entries and to configure another action. Related Topics • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Rules and Actions for Policy Maps, page 14-34 Setting Policy Map Rules and Actions for Layer 7 SIP Deep Packet Inspection You can configure the rules and actions for a SIP deep packet inspection policy map. Assumptions This topic assumes the following: • A SIP deep packet inspection policy map has been configured. • A class map has been defined for a class map rule if you do not want to use the class-default class map. Procedure Step 1 Choose Config > Devices > context > Expert > Policy Maps. The Policy Maps table appears. Step 2 In the Policy Maps table, choose the SIP deep packet inspection policy map that you want to set rules and actions for. The Rule table appears. Step 3 In the Rule table, click Add to add a new rule, or choose the rule that you want to modify and click Edit. The Rule window appears. Step 4 In the Type field of the Rule window, configure rules using the information in Table 14-27. 14-69 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 5 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The window refreshes and the Action table appears. Continue with Step 6. • Click Cancel to exit this procedure without saving your entries and to return to the Rule table. • Click Next to deploy your entries and to add another rule. Table 14-27 Layer 7 SIP Deep Packet Inspection Policy Map Rules Option Description Class Map Class map to use for this traffic policy. From the Use Class Map field, do one of the following: • To use the default class map, choose class-default. The class-default class map is a reserved, well-known class map created by the ACE. You cannot delete or modify this class. All traffic that fails to meet the other matching criteria in the named class map belongs to the default traffic class. If none of the specified classifications matches the traffic, then the ACE performs the action specified by the class-default class map. The class-default class map has an implicit match any statement that enables it to match all traffic. • To use a previously created class map, do the following: 1. Choose others. 2. In the Class Map Name field, choose the class map to use. Match Condition Match condition to use for this traffic policy. Do the following: a. In the Match Condition field, enter a name for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. b. In the Match Condition Type field, choose the type of match condition to use for this policy map and configure any type-specific options using the information in Table 7-10. Insert Before Order of the rules in the policy map. Do the following: a. Specify whether or not this rule is to precede another rule for this policy map: – N/A—This option is not configured. – False—This rule is not to precede another rule in this policy map. – True—This rule is to precede another rule in this policy map. The Insert Before Policy Rule field appears. b. If you chose True, in the Insert Before Policy Rule field, choose the rule that you want the current rule to precede. 14-70 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Note If you chose the Insert Before option described in Table 14-27 and specified True, perform the following steps to refresh the Rule tab before adding an action for this rule: 1. Click the Rule tab to refresh the Rule table. 2. In the Rule table, choose the newly added rule. When the window refreshes, an empty action list appears. Step 6 In the Action table, click Add to add an entry or choose an existing entry to modify and click Edit. Step 7 In the Id field, either accept the automatically incremented entry or assign a unique identifier for this action. Step 8 In the Action Type field, choose the action to be taken for this rule: • Drop—The SIP traffic is to be dropped if it meets the specified match criteria. • Permit—The SIP traffic is to be allowed if it meets the specified match criteria. • Reset—The SIP traffic is to be denied if it meets the specified match criteria. A TCP reset message is sent to the client or server to close the connection. Step 9 In the Action Log field, specify whether the action taken is to be logged: • N/A—This option is not configured. • False—Dropped packets are not to be logged in the software. • True—Dropped packets are to be logged in the software. Step 10 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Action table. • Click Next to deploy your entries and to configure another action. Related Topics • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Rules and Actions for Policy Maps, page 14-34 14-71 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Setting Policy Map Rules and Actions for Layer 7 Skinny Deep Packet Inspection You can configure the rules and actions for a Skinny Client Control Protocol (SCCP) deep packet inspection policy map. Assumptions This topic assumes the following: • A Skinny deep packet inspection policy map has been configured. • A class map has been defined for a class map rule if you do not want to use the class-default class map. Procedure Step 1 Choose Config > Devices > context > Expert > Policy Maps. The Policy Maps table appears. Step 2 In the Policy Maps table, choose the Skinny deep packet inspection policy map that you want to set rules and actions for. The Rule table appears. Step 3 In the Rule table, click Add to add a new rule, or choose the rule you want to modify, then click Edit. The Rule window appears. Step 4 In the Type field of the Rule window, confirm that Match Condition is selected. Step 5 In the Match Condition Name field, enter a name for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Step 6 In the Match Condition Type field, confirm that Message ID is selected. Step 7 In the Message ID Operator field, specify whether of not the match criteria is for a single message identifier or for a range of message identifiers: • Equal To—A single message identifier is used for this match condition. In the Message ID Value field, enter the numerical identifier of a SCCP message. Valid entries are from 0 to 65535. • Range—A range of message identifiers is used for this match condition. Do the following: a. In the Message ID Low Range Value field, enter the lowest numerical identifier of a range of SCCP messages. Valid entries are from 0 to 65535. b. In the Message ID High Range Value field, enter the highest numerical identifier of a range of SCCP messages. Valid entries are integers from 0 to 65535, and the value in this field must equal or be greater than the value in the Message ID Low Range Value field. Step 8 In the Insert Before field, specify whether or not this rule is to precede another rule in this policy map: • N/A—This option is not configured. • False—This rule is not to precede another rule in this policy map. 14-72 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps • True—This rule is to precede another rule in this policy map. The Insert Before Policy Rule field appears. Step 9 If you chose True, in the Insert Before Policy Rule field, choose the rule that you want the current rule to precede. Step 10 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The window refreshes and the Action table appears. To define the actions for this rule, continue with Step 11. • Click Cancel to exit this procedure without saving your entries and to return to the Rule table. • Click Next to deploy your entries and to configure another rule. Note If you chose the Insert Before option in Step 8 and specified True, perform the following steps to refresh the Rule tab before adding an action for this rule: 1. Click the Rule tab to refresh the Rule table. 2. In the Rule table, choose the newly added rule. When the window refreshes, an empty action list appears. Step 11 In Action table, click Add to add a new action, or choose an existing action and click Edit to modify it. The Action configuration window appears. Step 12 In the ID field, accept the automatically incremented entry or assign a unique identifier for this action. Step 13 In the Action Type field, confirm that Reset is selected. Step 14 In the Action Log field, specify whether the action taken is to be logged: • N/A—This option is not configured. • False—Dropped packets are not to be logged in the software. • True—Dropped packets are to be logged in the software. Step 15 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Action table. • Click Next to deploy your entries and to configure another action. Related Topics • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Rules and Actions for Policy Maps, page 14-34 14-73 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Setting Policy Map Rules and Actions for RADIUS Server Load Balancing You can configure the rules and actions for RADIUS traffic received by the ACE. Assumptions This topic assumes the following: • A RADIUS server load balancing traffic policy map has been configured. • A class map has been defined for a class map rule if you do not want to use the class-default class map. Procedure Step 1 Choose Config > Devices > context > Expert > Policy Maps. The Policy Maps table appears. Step 2 In the Policy Maps table, choose the RADIUS server load balancing policy map that you want to set rules and actions for. The Rule table appears. Step 3 In the Rule table, click Add to add a new rule, or choose the rule you want to modify and click Edit. The Rule window appears. Step 4 In the Type field of the Rule window, configure rules using the information in Table 14-28. Table 14-28 RADIUS Server Load Balancing Policy Map Rules Option Description Class Map Class map to use for this traffic policy. From the Use Class Map field, do one of the following: • To use the default class map, choose class-default. The class-default class map is a reserved, well-known class map created by the ACE. You cannot delete or modify this class. All traffic that fails to meet the other matching criteria in the named class map belongs to the default traffic class. If none of the specified classifications matches the traffic, then the ACE performs the action specified by the class-default class map. The class-default class map has an implicit match any statement that enables it to match all traffic. • To use a previously created class map, do the following: 1. Choose others. 2. In the Class Map Name field, choose the class map to use. 14-74 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 5 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The window refreshes and the Action table appears. To enter actions for this rule, continue with Step 6. • Click Cancel to exit this procedure without saving your entries and to return to the Rule table. • Click Next to deploy your entries and to configure another rule. Note If you chose the Insert Before option described in Table 14-28 and specified True, perform the following steps to refresh the Rule tab before adding an action for this rule: 1. Click the Rule tab to refresh the Rule table. 2. In the Rule table, choose the newly added rule. When the window refreshes, an empty action list appears. Step 6 In the Action table, click Add to add an entry or choose an existing entry to modify and click Edit. Match Condition Match condition to use for this traffic policy. Do the following: a. In the Match Condition Name field, enter a name for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. b. In the Match Condition Type field, choose the type of match condition to use for this policy map: – Calling Station ID—A unique identifier of the calling station is used to establish a match condition. In the RADIUS Calling Station ID field, enter the calling station identifier to match. Valid entries are strings containing 1 to 64 alphanumeric characters. See Table 14-33 for a list of the supported characters that you can use for matching string expressions. – User Name—A username is used to establish a match condition. In the User Name field, enter the name to match. Valid entries are strings containing 1 to 64 alphanumeric characters. See Table 14-33 for a list of the supported characters that you can use for matching string expressions. Insert Before Order of the rules in the policy map. Do the following: a. Indicate whether this rule is to precede another rule for this policy map: – N/A—This option is not configured. – False—This rule is not to precede another rule in this policy map. – True—This rule is to precede another rule in this policy map. The Insert Before Policy Rule field appears. b. If you chose True, in the Insert Before Policy Rule field, choose the rule that you want the current rule to precede. Table 14-28 RADIUS Server Load Balancing Policy Map Rules (continued) Option Description 14-75 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 7 In the Id field, accept the automatically incremented entry or assign a unique identifier for this action. Step 8 In the Action Type field, configure actions for this rule using the information in Table 14-17. Step 9 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Action table. • Click Next to deploy your entries and to configure another action. Related Topics • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Rules and Actions for Policy Maps, page 14-34 Setting Policy Map Rules and Actions for RDP Server Load Balancing Use this procedure to configure the rules and actions for RDP traffic received by the ACE. Assumptions This topic assumes the following: • An RDP server load balancing traffic policy map has been configured. • A class map has been defined for a class map rule if you do not want to use the class-default class map. Procedure Step 1 Choose Config > Devices > context > Expert > Policy Maps. The Policy Maps table appears. Step 2 In the Policy Maps table, choose the RDP server load balancing policy map that you want to set rules and actions for. The Rule table appears. Step 3 In the Rule table, click Add to add a new rule. The Rule window appears. Step 4 In the Type field of the Rule window, confirm that Class Map is selected. Step 5 Check the Use Class Default check box. Note You can only use the default class map (Class Default) with an RDP server load balancing policy map. 14-76 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps The class-default class map is a reserved, well-known class map created by the ACE. You cannot delete or modify this class. The class-default class map has an implicit match any statement that enables it to match all traffic. Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The window refreshes and the Action table appears. To enter actions for this rule, continue with Step 7. • Click Cancel to exit this procedure without saving your entries and to return to the Rule table. • Click Next to deploy your entries and to configure another rule. Step 7 In the Action table, click Add to add an entry, or choose an existing entry to modify and click Edit. Step 8 In the Id field, accept the automatically incremented entry or assign a unique identifier for this action. Step 9 In the Action Type field, configure actions for this rule using the information in Table 14-17. Step 10 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Action table. • Click Next to deploy your entries and to configure another action. Related Topics • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Rules and Actions for Policy Maps, page 14-34 Setting Policy Map Rules and Actions for RTSP Server Load Balancing You can configure the rules and actions for RTSP traffic received by the ACE. Assumptions This topic assumes the following: • An RTSP server load balancing traffic policy map has been configured. • A class map has been defined for a class map rule if you do not want to use the class-default class map. Procedure Step 1 Choose Config > Devices > context > Expert > Policy Maps. The Policy Maps table appears. Step 2 In the Policy Maps table, choose the RTSP server load balancing policy map that you want to set rules and actions for. The Rule table appears. 14-77 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 3 In the Rule table, click Add to add a new rule, or choose the rule that you want to modify and click Edit. The Rule window appears. Step 4 In the Type field of the Rule window, configure rules using the information in Table 14-29. Table 14-29 RTSP Server Load Balancing Policy Map Rules Option Description Class Map Class map to use for this traffic policy. From the Use Class Map field, do one of the following: • To use the default class map, choose class-default. The class-default class map is a reserved, well-known class map created by the ACE. You cannot delete or modify this class. All traffic that fails to meet the other matching criteria in the named class map belongs to the default traffic class. If none of the specified classifications matches the traffic, then the ACE performs the action specified by the class-default class map. The class-default class map has an implicit match any statement that enables it to match all traffic. • To use a previously created class map, do the following: 1. Choose others. 2. In the Class Map Name field, choose the class map to use. Match Condition Match condition to use for this traffic policy. Do the following: a. In the Match Condition Name field, enter a name for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. b. In the Match Condition Type field, choose the type of match condition to use for this policy map and configure any type-specific options using the information in Table 14-30. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Insert Before Order of the rules in the policy map. Do the following: a. Indicate whether or not this rule is to precede another rule for this policy map by choosing one of the following options: – N/A—This option is not configured. – False—This rule is not to precede another rule in this policy map. – True—This rule is to precede another rule in this policy map. The Insert Before Policy Rule field appears. b. If you chose True, in the Insert Before Policy Rule field, choose the rule that you want the current rule to precede. 14-78 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 5 In the Insert Before field, indicate whether or not this rule is to precede another rule for this policy map: • N/A—This option is not configured. • False—This rule is not to precede another rule in this policy map. Table 14-30 RTSP Policy Map Match Conditions Match Condition Description RTSP Header RTSP header information that is used for matching criteria. Do the following: a. In the Header Name field, specify the header to match in one of the following ways: – To specify an RTSP header that is not one of the standard RTSP headers, choose the first radio button, then enter the RTSP header name in the Header Name field. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. – To specify a standard RTSP header, click the second radio button, then choose an RTSP header from the list. b. In the Header Value (Bytes) field, enter the header value expression string to compare against the value in the specified field in the RTSP header. Valid entries are text strings with a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching. If the string includes spaces, enclose the string with quotes. All headers in the header map must be matched. See Table 14-33 for a list of the supported characters that you can use in regular expressions. RTSP URL URL or portion of a URL that is used for match criteria. Do the following: a. In the URL Expr field, enter a URL, or portion of a URL, to match. The ACE performs matching on whatever URL string appears after the RTSP method, regardless of whether the URL includes the host name. The ACE supports regular expressions for matching URL strings. See Table 14-33 for a list of the supported characters that you can use in regular expressions. b. In the Method Expr field, enter the RTSP method to match. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. The method can be either one of the standard RTSP method names (DESCRIBE, ANNOUNCE, GET_PARAMETER, OPTIONS, PAUSE, PLAY, RECORD, REDIRECT, SETUP, SET_PARAMETER, TEARDOWN) or a text string that must be matched exactly (for example, STINGRAY). Source Address Source IP address that is used for match criteria. Do the following: a. In the IP Address Type field, choose either IPv4 or IPv6. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. b. In the Source Address field, enter the source IP address for this match condition in the format based on the address type (IPv4 or IPv6). c. Depending of the IP address type that you chose, do one of the following: – For IPv4, In the Source Netmask field, choose the subnet mask for the source IP address. – For IPv6, in the Source Prefix-length field, enter the prefix length for the address. 14-79 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps • True—This rule is to precede another rule in this policy map. The Insert Before Policy Rule field appears. If you chose True, in the Insert Before Policy Rule field, choose the rule that you want the current rule to precede. Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The window refreshes and the Action table appears. Continue with Step 7. • Click Cancel to exit this procedure without saving your entries and to return to the Rule table. • Click Next to deploy your entries and to add another rule. Note If you chose the Insert Before option in Table 14-30 and specified True, perform the following steps to refresh the Rule tab before adding an action for this rule: 1. Click the Rule tab to refresh the Rule table. 2. In the Rule table, choose the newly added rule. When the window refreshes, an empty action list appears. Step 7 In the Action table, click Add to add an entry, or choose an existing entry to modify and click Edit. Step 8 In the Id field, accept the automatically incremented entry or assign a unique identifier for this action. Step 9 In the Action Type field, configure actions for this rule using the information in Table 14-17. Step 10 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Action table. • Click Next to deploy your entries and to configure another action. Related Topics • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Rules and Actions for Policy Maps, page 14-34 Setting Policy Map Rules and Actions for SIP Server Load Balancing You can configure the rules and actions for SIP traffic received by the ACE. Assumptions This topic assumes the following: 14-80 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps • A SIP server load balancing traffic policy map has been configured. • A class map has been defined for a class map rule if you do not want to use the class-default class map. Procedure Step 1 Choose Config > Devices > context > Expert > Policy Maps. The Policy Maps table appears. Step 2 In the Policy Maps table, choose the SIP server load balancing policy map that you want to set rules and actions for. The Rule table appears. Step 3 In the Rule table, click Add to add a new rule, or choose the rule that you want to modify and click Edit. The Rule window appears. Step 4 In the Type field of the Rule window, configure rules using the information in Table 14-31. Table 14-31 SIP Server Load Balancing Policy Map Rules Option Description Class Map Class map to use for this traffic policy. From the Use Class Map field, do one of the following: • To use the default class map, choose class-default. The class-default class map is a reserved, well-known class map created by the ACE. You cannot delete or modify this class. All traffic that fails to meet the other matching criteria in the named class map belongs to the default traffic class. If none of the specified classifications matches the traffic, then the ACE performs the action specified by the class-default class map. The class-default class map has an implicit match any statement that enables it to match all traffic. • To use a previously created class map, do the following: 1. Choose others. 2. In the Class Map Name field, choose the class map to use. 14-81 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Match Condition Match condition to use for this traffic policy. Do the following: a. In the Match Condition field, enter a name for this match condition. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. b. In the Match Condition Type field, choose the type of match condition to use for this policy map and configure any type-specific options using the information in Table 14-32. Note Fields and information related to IPv6 require ACE module and ACE appliance software Version A5(1.0) or later. Insert Before Order of the rules in the policy map. Do the following: a. Indicate whether or not this rule is to precede another rule for this policy map. Choices are as follows: – N/A—This option is not configured. – False—This rule is not to precede another rule in this policy map. – True—This rule is to precede another rule in this policy map. The Insert Before Policy Rule field appears. b. If you chose True, in the Insert Before Policy Rule field, choose the rule that you want the current rule to precede. Table 14-31 SIP Server Load Balancing Policy Map Rules (continued) Option Description 14-82 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 5 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The window refreshes and the Action table appears so you can enter actions for this rule. Continue with Step 6. • Click Cancel to exit this procedure without saving your entries and to return to the Rule table. • Click Next to deploy your entries and to add another rule. Step 6 In the Action table, click Add to add an entry, or choose an existing entry to modify and click Edit. Step 7 In the Id field, accept the automatically incremented entry or assign a unique identifier for this action. Step 8 In the Action Type field, configure actions for this rule using the information in Table 14-17. Table 14-32 SIP Server Load Balancing Policy Map Match Conditions Match Condition Description SIP Header SIP header information that is used for matching criteria. Do the following: a. In the Header Name field, specify the header to match in one of the following ways: – To specify a SIP header that is not one of the standard SIP headers, choose the first radio button, then enter the SIP header name in the Header Name field. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. – To specify a standard SIP header, click the second radio button, then choose an SIP header from the list. b. In the Header Value (Bytes) field, enter the header value expression string to compare against the value in the specified field in the SIP header. Valid entries are text strings with a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching. If the string includes spaces, enclose the string with quotes. All headers in the header map must be matched. See Table 14-33 for a list of the supported characters that you can use in regular expressions. Source Address Source IP address is used for match criteria. Do the following: a. In the IP Address Type field, choose either IPv4 or IPv6. This field appears only for ACE module and ACE appliance software Version A5(1.0) or later, which supports IPv4 and IPv6. b. In the Source Address field, enter the source IP address for this match condition in the format based on the address type (IPv4 or IPv6). c. Depending on the IP address type that you chose, do one of the following: – For IPv4, in the Source Netmask field, choose the subnet mask for the source IP address. – For IPv6, in the Source Prefix-length field, enter the prefix length for the address. 14-83 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Step 9 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit the procedure without saving your entries and to return to the Action table. • Click Next to deploy your entries and to configure another action. Note If you chose the Insert Before option in Table 14-31 and specified True, perform the following steps to refresh the Rule tab before adding an action for this rule: 1. Click the Rule tab to refresh the Rule table. 2. In the Rule table, choose the newly added rule. When the window refreshes, an empty action list appears. Related Topics • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Rules and Actions for Policy Maps, page 14-34 14-84 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Rules and Actions for Policy Maps Special Characters for Matching String Expressions Table 14-33 identifies the special characters that can be used in matching string expressions. Related Topics • Configuring Traffic Policies, page 14-1 • Configuring Virtual Context Class Maps, page 14-6 • Configuring Virtual Context Policy Maps, page 14-32 • Configuring Rules and Actions for Policy Maps, page 14-34 Table 14-33 Special Characters for Matching String Expressions Convention Description . One of any character. .* Zero or more of any character. \. Period (escaped). \xhh Non-printable character. [charset] Match any single character from the range. [^charset] Do not match any character in the range. All other characters represent themselves. () Expression grouping. expr1 | expr2 OR of expressions. (expr)* 0 or more of expression. (expr)+ 1 or more of expression. .\a Alert (ASCII 7). .\b Backspace (ASCII 8). .\f Form-feed (ASCII 12). .\n New line (ASCII 10). .\r Carriage return (ASCII 13). .\t Tab (ASCII 9). .\v Vertical tab (ASCII 11). .\0 Null (ASCII 0). .\\ Backslash. .\x## Any ASCII character as specified in two-digit hexadecimal notation. 14-85 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Actions Lists Configuring Actions Lists An action list is a named group of actions that you associate with a Layer 7 policy map. The ACE supports the following types action lists: • An HTTP optimization action list groups a series of individual application acceleration and optimization operations that you want the ACE to perform. The HTTP optimization action list is associated with a Layer 7 HTTP optimization policy map (see the “Setting Policy Map Rules and Actions for Layer 7 HTTP Optimization” section on page 14-57). • An HTTP header modify action list performs the following operations: – Groups a series of individual functions to insert, rewrite, or delete HTTP headers. – Configures the SSL URL rewrite function. – Inserts SSL session parameters, client certificate fields, and server certificate fields into the HTTP requests that the ACE receives over the connection. The HTTP header action list is associated with a Layer 7 server load-balancing policy map (see the “Setting Policy Map Rules and Actions for Layer 7 Server Load-Balancing Traffic” section on page 14-61). Table 14-34 lists the action lists that you can configure using the ACE. Configuring an HTTP Header Modify Action List An HTTP header modify action list groups a series of individual functions to insert, rewrite, or delete HTTP headers. It can also be used to configure the SSL URL rewrite function. This section includes the following topics: • Configuring HTTP Header Insertion, Deletion, and Rewrite, page 14-85 • Configuring SSL URL Rewrite, page 14-88 • Configuring SSL Header Insertion, page 14-89 Configuring HTTP Header Insertion, Deletion, and Rewrite You can configure an HTTP header modify action list that inserts, rewrites, or deletes HTTP headers. Procedure Step 1 Choose Config > Devices > context > Expert > HTTP Header Modify Action Lists. The HTTP Header Modify Action Lists table appears. Step 2 In the HTTP Header Modify Action Lists table, click Add to add a new action list, or choose an existing action list and click Edit to modify it. Table 14-34 Action Lists Action List Topic Optimization Action List Configuring an HTTP Optimization Action List, page 15-3 HTTP Header Modify Action List Configuring an HTTP Header Modify Action List, page 14-85 14-86 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Actions Lists Step 3 For a new action list, in the Action List Name field, enter a unique name for the action list. Valid entries are unquoted text strings with a maximum of 64 alphanumeric characters. Click Deploy Now when completed to save the configuration and display the editing tabs. Step 4 Click the Header Action tab. The Header Action table appears. Step 5 In the Header Action table, click Add to add a new entry to the table. The Header Action configuration window appears. Enter the required information as shown in Table 14-35. Table 14-35 Header Action Configuration Window Fields Header Action Field Description / Action Operator HTTP header modify action that the ACE is to take in an HTTP request from a client, a response from a server, or both. Choices are as follows: • Delete—Deletes an HTTP header in a request from a client, in a response from a server, or both. • Insert—Insert a header name and value in an HTTP request from a client, a response from a server, or both. When the ACE uses Network Address Translation (NAT) to translate the source IP address of a client to a VIP, servers need a way to identify that client for the TCP and IP return traffic. To identify a client whose source IP address has been translated using NAT, you can instruct the ACE to insert a generic header and string value of your choice in the client HTTP request. • Rewrite—Rewrite an HTTP header in request packets from a client, response packets from a server, or both. 14-87 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Actions Lists Direction HTTP header modify action that the ACE is to take with respect to the selected operator (Insert, Delete, or Rewrite). Choices are as follows: Insert: • Both—Specifies that the ACE insert an HTTP header in both HTTP request packets and response packets. • Request—Specifies that the ACE insert an HTTP header only in HTTP request packets from clients. • Response—Specifies that the ACE insert an HTTP header only in HTTP response packets from servers. Delete: • Both—Specifies that the ACE delete the header in both HTTP request packets and response packets. • Request—Specifies that the ACE delete the header only in HTTP request packets from clients. • Response—Specifies that the ACE delete the header only in HTTP response packets from servers. Rewrite: • Both—Specifies that the ACE rewrite an HTTP header string in both HTTP request packets and response packets. • Request—Specifies that the ACE rewrite an HTTP header string only in HTTP request packets from clients. • Response—Specifies that the ACE rewrite an HTTP header string only in HTTP response packets from servers. Header Name Identifier of an HTTP header. Enter an unquoted text string with a maximum of 255 alphanumeric characters. Header Value Value of the HTTP header that you want to insert or replace in request packets, response packets, or both. Enter an unquoted text string with no spaces and a maximum of 255 alphanumeric characters. You can also use the following dynamic replacement strings: • %is—Inserts the source IP address in the HTTP header • %id—Inserts the destination IP address in the HTTP header • %ps—Inserts the source port in the HTTP header • %pd—Inserts the destination port in the HTTP header The ACE supports regular expressions for matching. To include spaces in the string, enclose the entire string in quotes. All headers in the header map must be matched. See Table 14-33 for a list of the supported characters that you can use in regular expressions. Replace Pattern string that you want to substitute for the header value regular expression. For dynamic replacement of the first and second parenthesized expressions from the header value, use %1 and %2, respectively. Table 14-35 Header Action Configuration Window Fields (continued) Header Action Field Description / Action 14-88 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Actions Lists Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries. • Click Next to save your entries. Related Topics Setting Policy Map Rules and Actions for Layer 7 Server Load-Balancing Traffic, page 14-61, Table 14-26 Configuring SSL URL Rewrite You can configure an HTTP header modify action list that performs SSL URL rewrite. When a client sends encrypted traffic to the ACE in an SSL termination configuration, the ACE terminates the SSL traffic and then sends clear text to the server. Because the server is unaware of the encrypted traffic flowing between the client and the ACE, the server may return to the client a URL in the Location header of HTTP redirect responses (301: Moved Permanently or 302: Found) in the form http://www.cisco.com instead of https://www.cisco.com. In this case, the client makes a request to the unencrypted insecure URL, even though the original request was for a secure URL. Because the client connection changes to HTTP, the requested data may not be available from the server using a clear text connection. To solve this problem, the ACE provides SSLURL rewrite, which changes the redirect URL from http:// to https:// in the Location response header from the server before sending the response to the client. By using URL rewrite, you can avoid nonsecure HTTP redirects. All client connections to the web server will be SSL, ensuring the secure delivery of HTTPS content back to the client. The ACE uses regular expression matching to determine whether the URL needs rewriting. If a Location response header matches the specified regular expression, the ACE rewrites the URL. In addition, the ACE provides parameters to add or change the SSL and the clear port numbers. Procedure Step 1 Choose Config > Devices > context > Expert > HTTP Header Modify Action Lists. The HTTP Header Modify Action Lists table appears. Step 2 In the HTTP Header Modify Action Lists table, click Add to add a new action list, or choose an existing action list and click Edit to modify it. Step 3 For a new action list, in the Action List Name field enter a unique name for the action list. Valid entries are unquoted text strings with a maximum of 64 alphanumeric characters. Click Deploy Now when completed to save the configuration and display the editing tabs. Step 4 Click the SSL Action tab. The SSL Action table appears. Step 5 In the SSL Action table, click Add to add a new entry to the SSL Action table. The SSL Action configuration window appears. Enter the required information as shown in Table 14-36. 14-89 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Actions Lists Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries. • Click Next to save your entries. Related Topics • Setting Policy Map Rules and Actions for Layer 7 Server Load-Balancing Traffic, page 14-61, Table 14-26 Configuring SSL Header Insertion Note This option is available only for the ACE module A2(3.0), ACE appliance A4(1.0), and later releases of either device type. You can configure an HTTP header modify action list that performs SSL header insertion. When a client sends encrypted traffic to the ACE in an SSL termination configuration, the ACE terminates the SSL traffic and then sends clear text to the server, which is unaware of the encrypted traffic flowing between the client and the ACE. Using an action list associated with a Layer 7 HTTP load-balancing policy map, you can instruct the ACE to perform SSL HTTP header insertion. The ACE provides the server with the following SSL session information by inserting HTTP headers into the HTTP requests that it receives over the connection: Table 14-36 SSL Action Configuration Window Fields Header Action Field Description / Action URL Expression Field that specifies the rewriting of the URL in the Location response header based on a URL regular expression match. If the URL in the Location header matches the URL regular expression string that you specify, the ACE rewrites the URL from http:// to https:// and rewrites the port number. Enter an unquoted text string with no spaces and a maximum of 255 alphanumeric characters. Alternatively, you can enter a text string with spaces if you enclose the entire string in quotation marks (“). The location regex that you enter must be a pure URL (for example, www\.cisco\.com) with no port or path designations. To match a port, use the SSL Port and Clear Port parameters. If you need to match a path, use the HTTP header rewrite feature to rewrite the string. For information about the HTTP header rewrite feature, see the “Configuring HTTP Header Insertion, Deletion, and Rewrite” section on page 14-85. The ACE supports regular expressions for matching. To include spaces in the string, enclose the entire string in quotes. All headers in the header map must be matched. See Table 14-33 for a list of the supported characters that you can use in regular expressions. SSL Port SSL port number from which the ACE translates a clear port number before sending the server redirect response to the client. Enter a value from 1 to 65535. The default is 443. Clear Port Clear port number to which the ACE translates the SSL port number before sending a server redirect response to the client. Enter a value from 1 to 65535. The default is 80. 14-90 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Actions Lists • Session Parameters—SSL session parameters that the ACE and client negotiate during the SSL handshake. • Server Certificate Fields—Information regarding the SSL server certificate that resides on the ACE. • Client Certificate Fields—Information regarding the SSL client certificate that the ACE retrieves from the client when you configure the ACE to perform client authentication. Note To prevent HTTP header spoofing, the ACE deletes any incoming HTTP headers that match one of the headers that it is going to insert into the HTTP request. By default, the ACE inserts the SSL header information into the first HTTP request only that it receives over the connection. When the ACE and client need to renegotiate their connection, the ACE updates the HTTP header information that it send to the server to reflect the new session parameters. You can also instruct the ACE to insert the session information into every HTTP request that it receives over the connection by creating an HTTP parameter map with either the Header Modify Per-Request or HTTP Persistence Rebalance options enabled (see the “Configuring HTTP Parameter Maps” section on page 10-9). Note The maximum amount of data that the ACE can insert is 512 bytes. The ACE truncates the data if it exceeds this limit. Procedure Step 1 Choose Config > Devices > context > Expert > HTTP Header Modify Action Lists. The HTTP Header Modify Action Lists table appears. Step 2 In the HTTP Header Modify Action Lists table, do one of the following: • To add a new action list, click Add. In the Action List Name field, enter a unique name for the action list. Valid entries are unquoted text strings with a maximum of 64 alphanumeric characters. Click Deploy Now when completed to save the configuration and display the editing tabs. • To edit an existing action list, choose the action list and click Edit to display the editing tabs. Step 3 Click the SSL Header Insert tab. The SSL Header Insert table appears. Step 4 In the SSL Header Insert table, click Add to add a new entry to the SSL Header Insert table. The SSL Header Insert configuration window appears. Enter the required information as shown in Table 14-37. Table 14-37 SSL Action Configuration Window Fields Header Action Field Description / Action Request Type of SSL header information to insert into the HTTP request: • Client-Certificate—Information about the client certificate that the ACE retrieves from the client. • Server-Certificate—Information about the server certificate that resides on the ACE. • Session—Information about the session parameters that the ACE and client negotiated during the SSL handshake. 14-91 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Actions Lists Algorithm Field that appears only when the Request field is set to either Client-Certificate or Server-Certificate. Specify the following certificate field information to insert into the HTTP request: • Authority-Key-Id—X.509 authority key identifier. • Basic-Constraints—X.509 basic constraints. • Certificate-Version—X.509 certificate version. • Data-Signature-Algorithm—X.509 hashing and encryption method. • Fingerprint-SHA1—SHA1 hash of the certificate. • Issuer—X.509 certificate issuer's distinguished name. • Issuer-CN—X.509 certificate issuer's common name. • Not-After—Date after which the certificate is not valid. • Not-Before—Date before which the certificate is not valid. • Public-Key-Algorithm—Algorithm used for the public key. • RSA-Exponent—Public RSA exponent. • RSA-Modulus—RSA algorithm modulus. • RSA-Modulus-Size—Size of the RSA public key. • Serial-Number—Certificate serial number. • Signature—Certificate signature. • Signature-Algorithm—Certificate signature algorithm. • Subject—X.509 subject's distinguished name. • Subject-CN—X.509 subject's common name. • Subject-Key-Id—X.509 subject key identifier. For more information, see the Cisco Application Control Engine Module SSL Configuration Guide. Table 14-37 SSL Action Configuration Window Fields (continued) Header Action Field Description / Action 14-92 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Actions Lists CipherKey Field that appears only when the Request field is set to Session. Indicate the following session parameters to insert into the HTTP request: • Cipher-Key-Size—Symmetric cipher key size. • Cipher-Name—Symmetric cipher suite name. • Cipher-Use-Size—Symmetric cipher use size. • Id—SSL Session ID. The default is 0. • Protocol-Version—Version of SSL or TLS. • Step-Up—Use of SGC or StepUp cryptography to increase the level of security by using 128-bit encryption. • Verify-Result—SSL session verify result. Possible values are as follows: – ok—The SSL session is established. – certificate is not yet valid—The client certificate is not yet valid. – certificate is expired—The client certificate has expired. – bad key size—The client certificate has a bad key size. – invalid not before field—The client certificate notBefore field is in an unrecognized format. – invalid not after field—The client certificate notAfter field is in an unrecognized format. – certificate has unknown issuer—The client certificate issuer is unknown. – certificate has bad signature—The client certificate contains a bad signature. – certificate has bad leaf signature—The client certificate contains a bad leaf signature. – unable to decode issuer public key—The ACE is unable to decode the issuer public key. – unsupported certificate—The client certificate is not supported. – certificate revoked— The client certificate has been revoked. – internal error—An internal error exists. For more information, see the Cisco Application Control Engine Module SSL Configuration Guide. Value Field that appears only when the Request field is set to either Client-Certificate or Server-Certificate. Choose one of the following options: • N/A—Specifies that the selected algorithm or cipher key is inserted without adding a prefix to it or renaming it. • Prefix—Enables you to specify a prefix string to place before the specified certificate or session field name. For example, if you specify the prefix Acme-SSL for the SSL session field name Cipher-Name, then the field name becomes Acme-SSL-Session-Cipher-Name. • Rename—Enables you to specify a new name for the specified certificate or session field name. Prefix Field that appears only when the Value field is set to Prefix. Enter a quoted text string to place before the specified certificate or session field name. The maximum combined number of prefix string and field name characters that the ACE permits is 32. Rename Field that appears only when the Value field is set to Rename. Enter a new name to the specified certificate or session field name. The name must be an unquoted text string with no spaces. The maximum number of field name string characters that the ACE permits is 32. Table 14-37 SSL Action Configuration Window Fields (continued) Header Action Field Description / Action 14-93 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Actions Lists Step 5 Repeat Step 4 for each certificate field or session parameter that you want the ACE to insert. Step 6 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. • Click Cancel to exit this procedure without saving your entries. • Click Next to deploy your entries and to add another entry to the SSL Header Insert table. Related Topics Setting Policy Map Rules and Actions for Layer 7 Server Load-Balancing Traffic, page 14-61, Table 14-26 14-94 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 14 Configuring Traffic Policies Configuring Actions Lists CHAPTER 15-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 15 Configuring Application Acceleration and Optimization Date: 3/28/12 With application acceleration and optimization features on ACE appliances, you can configure application delivery and application acceleration options that increase productivity and efficiency. The application acceleration features optimize network performance and improve access to critical business information. This capability accelerates the performance of Web applications, including customer relationship management, portals, and online collaboration by up to 10 times. Note Application acceleration performance on the ACE appliance is 50 to 100 Mbps throughput. With typical page sizes and browser usage patterns, this equates to roughly 1,000 concurrent connections. Subsequent connections bypass the application acceleration engine. This limitation applies only to traffic that is explicitly configured to receive application acceleration processing (for example, FlashForward, Delta Optimization). Traffic that is not configured to receive application acceleration processing is not subject to these limitations. Also, because the ACE HTTP compression is implemented separately in hardware, it is not subject to these limitations. For example, if you have a mix of application-accelerated and non-application-accelerated traffic, the former is limited; the latter is not. If you have 50 Mbps of application-accelerated traffic, the ACE can still deliver up to 1.9 Gbps throughput for the non-application-accelerated traffic. Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • Optimization Overview, page 15-2 • Optimization Traffic Policies and Typical Configuration Flow, page 15-2 • Configuring an HTTP Optimization Action List, page 15-3 • Configuring Optimization Parameter Maps, page 15-6 15-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 15 Configuring Application Acceleration and Optimization Optimization Overview • Configuring Traffic Policies for HTTP Optimization, page 15-6 • Enabling HTTP Optimization Using Virtual Servers, page 15-9 • Configuring Global Application Acceleration and Optimization, page 15-9 Optimization Overview The application acceleration functions of the ACE appliance apply several optimization technologies to accelerate application performance. This functionality enables enterprises to optimize network performance and improve access to critical business information. The ACE appliance provides the following application acceleration and optimization functionality: • Delta optimization eliminates redundant traffic on the network by computing and transmitting only the changes that occur in a Web page between successive downloads of the same page or similar pages. • FlashForward object acceleration technology eliminates network delays associated with embedded Web objects able to be cached. such as images, style sheets, and JavaScript files by placing the responsibility for validating object freshness on the ACE appliance, rather than on the client, making the client more efficient. • Just-in-time object acceleration enables acceleration of non-cacheable embedded objects, resulting in improved application response time by eliminating the need for clients to download these objects on each request. • Adaptive dynamic caching accelerates enterprise application performance and improves server system scalability by enabling the ACE appliance itself to fulfill requests for dynamic content, which offloads application servers and databases. Refer to Configuring Application Acceleration and Optimization, page 15-1 or the Cisco 4700 Series Application Control Engine Appliance Application Acceleration and Optimization Configuration Guide for more information about application acceleration and optimization. Related Topics • Optimization Traffic Policies and Typical Configuration Flow, page 15-2 • Configuring Traffic Policies for HTTP Optimization, page 15-6 • Configuring Global Application Acceleration and Optimization, page 15-9 Optimization Traffic Policies and Typical Configuration Flow To define the different optimization and application acceleration functions that you want the ACE appliance to perform, you must configure at least one each of the following: • HTTP optimization action list—This action list specifies the actions that the ACE is to perform for application acceleration and optimization. You can configure action lists when configuring a virtual server, or as a separate procedure. See: – Configuring Application Acceleration and Optimization, page 7-53 – Configuring an HTTP Optimization Action List, page 15-3 15-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 15 Configuring Application Acceleration and Optimization Configuring an HTTP Optimization Action List • Layer 7 server load-balancing class map—This class map identifies the Layer 7 server load-balancing match criteria to apply to incoming traffic, such as URL, HTTP cookie, HTTP header, or source IP address. See Configuring Virtual Context Policy Maps, page 14-32 • Layer 7 HTTP optimization policy map—This policy map applies the HTTP optimization action list and optionally an optimization parameter map to Layer 7 HTTP traffic. See Configuring Virtual Context Policy Maps, page 14-32. • Layer 3 and Layer 4 class map—By using match criteria, this class map identifies the network traffic that can pass through the ACE appliance. The match criteria includes the VIP address for the network traffic. The ACE appliance uses these Layer 3 and Layer 4 traffic classes to perform server load balancing. See Configuring Virtual Context Policy Maps, page 14-32. • Layer 3 and Layer 4 policy map—This policy map associates server load-balancing actions and HTTP optimization action lists with the VIP. See Setting Policy Map Rules and Actions for Layer 3/Layer 4 Network Traffic, page 14-41 and Configuring Traffic Policies for HTTP Optimization, page 15-6. • Layer 7 server load-balancing policy map—This policy map specifies the server load-balancing actions that the ACE appliance is to perform. See Configuring Virtual Context Policy Maps, page 14-32. You can also configure: • Optimization parameter maps—Optimization parameter maps allow you to configure specific options for action list items. You can configure optimization parameter maps when configuring a virtual server or as a separate procedure. When you configure a parameter map with an action list for a class map, the ACE appliance validates the action list and parameter map configurations before deploying them. See: – Configuring Application Acceleration and Optimization, page 7-53 – Configuring Optimization Parameter Maps, page 10-12. • Global application acceleration and optimization options—The acceleration and optimization options allow you to apply specific acceleration and optimization features for logging and debugging on a global level on the ACE appliance. See Configuring Global Application Acceleration and Optimization, page 15-9. Related Topics • Configuring Traffic Policies for HTTP Optimization, page 15-6 • Optimization Overview, page 15-2 Configuring an HTTP Optimization Action List An HTTP optimization action list groups a series of individual application acceleration and optimization operations that you want the ACE to perform. Use this procedure to configure an HTTP optimization action list. Tip You can also configure action lists when configuring a virtual server. For more information, see “Configuring Application Acceleration and Optimization” section on page 7-53. 15-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 15 Configuring Application Acceleration and Optimization Configuring an HTTP Optimization Action List Procedure Step 1 Choose Config > Devices > context > Expert > Optimization Action List. The Action List table appears. Step 2 Click Add to add a new optimization action list, or choose an existing action list and click Edit to modify it. Step 3 Configure the optimization action list using the information in Table 15-1. Table 15-1 Action List Configuration Options Field Description Action List Name Unique name for the action list. Valid entries are unquoted text strings with a maximum of 64 alphanumeric characters. Enable Delta Check box that enables delta optimization for the specified URLs. Delta optimization dynamically updates client browser caches directly with content differences, or deltas, resulting in faster page downloads. Uncheck the check box to disable delta optimization for the specified URLs. Note The ACE restricts you from enabling delta optimization if you have previously specified either Cache Dynamic or Dynamic Dynamic Entity Tag. Enable AppScope Check box that enables AppScope performance monitoring for use with the ACE appliance. AppScope runs on the Management Console of the optional Cisco AVS 3180A Management Station and measures end-to-end application performance. Uncheck the check box to disable AppScope performance monitoring for use with the ACE appliance. Flash Forward Feature that reduces bandwidth usage and accelerates embedded object downloading by combining local object storage with dynamic renaming of embedded objects, thereby enforcing object freshness within the parent HTML page. Specify how the ACE appliance is to implement FlashForward: • N/A—Indicates that this feature is not enabled. • FlashForward—Indicates that FlashForward is to be enabled for the specified URLs and that embedded objects are to be transformed. • FlashForward Object—Indicates that FlashForward static caching is to be enabled for the objects that the corresponding URLs refer to, such as Cascading Style Sheets (CSS), JPEG, and GIF files. Cache Dynamic Check box that enables Adaptive Dynamic Caching for the specified URLs even if the expiration settings in the response indicate that the content is dynamic. The expiration of cache objects is controlled by the cache expiration settings based on time or server load. Uncheck the check box to disable this feature. Note The ACE restricts you from enabling Cache Dynamic if you have previously specified either Enable Delta or Dynamic Dynamic Entity Tag. 15-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 15 Configuring Application Acceleration and Optimization Configuring an HTTP Optimization Action List Step 4 Do one of the following: • Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The ACE appliance validates the action list configuration. • Click Cancel to exit this procedure without saving your entries. • Click Next to save your entries and to configure another action list. Related Topics • Optimization Traffic Policies and Typical Configuration Flow, page 15-2 • Configuring Optimization Parameter Maps, page 15-6 • Configuring Traffic Policies for HTTP Optimization, page 15-6 • Configuring Global Application Acceleration and Optimization, page 15-9 Cache Forward Check box that enables the cache forward feature for the corresponding URLs. Cache forward allows the ACE to serve the object from its cache (static or dynamic) even when the object has expired if the maximum cache TTL time period has not yet expired (set by specifying the Cache Time-To-Live Duration (%): field in an Optimization parameter map). At the same time, the ACE sends an asynchronous request to the origin server to refresh its cache of the object. Uncheck this check box to disable this feature. Dynamic Dynamic Entity Tag Check box that enables the acceleration of noncacheable embedded objects, which results in improved application response time. When enabled, this feature eliminates the need for users to download noncacheable objects on each request. Check the check box to indicate that the ACE appliance is to implement just-in-time object acceleration for noncacheable embedded objects. Uncheck this check box to disable this feature. Note The ACE restricts you from enabling Dynamic Dynamic Entity Tag if you have previously specified either Enable Delta or Cache Dynamic. Table 15-1 Action List Configuration Options Field Description 15-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 15 Configuring Application Acceleration and Optimization Configuring Optimization Parameter Maps Configuring Optimization Parameter Maps You can configure an Optimization parameter map for use with a Layer 3/Layer 4 policy map. Tip You can also configure optimization parameter maps when configuring a virtual server. For more information, see “Configuring Application Acceleration and Optimization” section on page 7-53. Procedure Step 1 Choose Config > Devices > context > Load Balancing > Parameter Maps > Optimization Parameter Maps. The Optimization Parameter Maps table appears. Step 2 Click Add to add a new parameter map, or choose an existing parameter map and click Edit to modify it. The Optimization Parameter Maps configuration window appears. Step 3 In the Parameter Name field, enter a unique name for this parameter map. Valid entries are unquoted text strings with no spaces and a maximum of 64 alphanumeric characters. Step 4 Configure optimization using the information in Table 10-6. Step 5 Do one of the following: • Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. The ACE validates the parameter map configuration and deploys it. This option appears for virtual contexts. • Click Cancel to exit this procedure without saving your entries and to return to the Parameter Map table. • Click Next to accept your entries and to add another parameter map. Related Topics • Optimization Traffic Policies and Typical Configuration Flow, page 15-2 • Configuring an HTTP Optimization Action List, page 15-3 • Configuring Traffic Policies for HTTP Optimization, page 15-6 • Configuring Global Application Acceleration and Optimization, page 15-9 Configuring Traffic Policies for HTTP Optimization Table 15-2 provides a high-level overview of the steps required to configure HTTP optimization on an ACE appliance. Note Table 15-2 includes only the significant steps in each task. For detailed information on configuring these items, select the links provided, click Help in the ANM GUI, or refer to Configuring Traffic Policies, page 14-1. 15-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 15 Configuring Application Acceleration and Optimization Configuring Traffic Policies for HTTP Optimization Assumption A virtual IP address has been configured for the context in which you configure HTTP optimization. Table 15-2 Configuring Traffic Policies for HTTP Optimization Task Procedure Step 1 Create a Layer 7 class map for server load balancing. a. Choose Config > Devices > context > Expert > Class Maps. b. Click Add to add a new class map. c. In the Class Map Type field, choose Layer 7 Server Load Balancing. d. In the Match Type field, choose the method the ACE appliance is to use to evaluate multiple match statements when multiple match conditions exist in the class map. e. Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. f. Configure match conditions for this class map. For more information, see: • Configuring Virtual Context Class Maps, page 14-6 • Setting Match Conditions for Layer 7 Server Load Balancing Class Maps, page 14-14 Step 2 Create an HTTP optimization action list to specify the optimization actions that are to be performed. a. Choose Config > Devices > context > Expert > Action Lists. b. Click Add to add a new action list. c. Configure the action list using the information in Table 15-1. d. Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. For more information, see Configuring an HTTP Optimization Action List, page 15-3. Step 3 Create a Layer 7 HTTP optimization policy map and associate it with the server load-balancing class map in Step 1 and the action list configured in Step 2. a. Choose Config > Devices > context > Expert > Policy Maps. b. Click Add to add a new policy map. c. In the Type field, choose Layer 7 HTTP Optimization. d. Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. e. In the Rules table, add the server load-balancing class map created in Step 1. f. In the Action table, add the action list created in Step 2. For more information, see: • Configuring Virtual Context Policy Maps, page 14-32 • Setting Policy Map Rules and Actions for Layer 7 HTTP Optimization, page 14-57 15-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 15 Configuring Application Acceleration and Optimization Configuring Traffic Policies for HTTP Optimization Step 4 Create a Layer 3/Layer 4 class map for server load balancing. a. Choose Config > Devices > context > Expert > Class Maps. b. Click Add to add a new class map. c. In the Class Map Type field, choose Layer 3/4 Network Traffic. d. In the Match Type field, choose the method the ACE appliance is to use to evaluate multiple match statements when multiple match conditions exist in the class map. e. Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. f. Configure Virtual Address match conditions for this class map. For more information, see: • Configuring Virtual Context Class Maps, page 14-6 • Setting Match Conditions for Layer 3/Layer 4 Network Traffic Class Maps, page 14-9 Step 5 Create a Layer 7 policy map for server load balancing and associate it with the Layer 7 server load-balancing class map from Step 1. a. Choose Config > Devices > context > Expert > Policy Maps. b. Click Add to add a new policy map. c. In the Type field, choose Layer 7 Server Load Balancing. d. Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. e. Associate the Layer 7 server load-balancing class map configured in Step 1 with this policy map by adding it to the Rule table. For more information, see: • Configuring Virtual Context Policy Maps, page 14-32 • Setting Policy Map Rules and Actions for Layer 7 Server Load-Balancing Traffic, page 14-61 Step 6 Create a Layer 3/Layer 4 network traffic policy map and associate it with the: • Layer 3/Layer 4 server load-balancing class map configured in Step 4 • Layer 7 server load-balancing policy map configured in Step 5 • HTTP optimization policy map configured in Step 3 a. Choose Config > Devices > context > Expert > Policy Maps. b. Click Add to add a new policy map. c. In the Type field, choose Layer 3/4 Network Traffic. d. Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. e. In the Rule table, add the Layer 3/Layer 4 server load-balancing class map configured in Step 4. f. In the Action table, add the: – Layer 7 server load-balancing policy map created in Step 5 – HTTP optimization policy map created in Step 3 For more information, see: • Configuring Virtual Context Policy Maps, page 14-32 • Setting Policy Map Rules and Actions for Layer 3/Layer 4 Network Traffic, page 14-41 Table 15-2 Configuring Traffic Policies for HTTP Optimization (continued) Task Procedure 15-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 15 Configuring Application Acceleration and Optimization Enabling HTTP Optimization Using Virtual Servers Related Topics • Optimization Traffic Policies and Typical Configuration Flow, page 15-2 • Configuring an HTTP Optimization Action List, page 15-3 • Optimization Overview, page 15-2 Enabling HTTP Optimization Using Virtual Servers You can configure HTTP optimization using virtual servers. Procedure Step 1 Create a virtual server by following the instructions in “Configuring Virtual Servers” section on page 7-2. Step 2 Configure HTTP optimization by following the instructions in “Configuring Application Acceleration and Optimization” section on page 7-53. Related Topics • Configuring Traffic Policies for HTTP Optimization, page 15-6 • Optimization Traffic Policies and Typical Configuration Flow, page 15-2 Configuring Global Application Acceleration and Optimization Note This functionality is available for Admin contexts only and only on ACE appliances. ANM allows you to configure global application acceleration and optimization options for logging and debugging as performed by the ACE appliance. Procedure Step 1 Choose Config > Virtual Contexts > admin_context > System > Application Acceleration And Optimization. The Application Acceleration And Optimization configuration window appears. Step 2 In the Debug Level field, enter the maximum level of system log messages to be sent to the syslog server, using the values in Table 6-5. The severity level that you specify indicates that you want syslog messages at that level and the more severe levels. For example, if you enter 3 for Error, syslog displays Error, Critical, Alert, and Emergency messages. Step 3 Check the AppScope Log check box to indicate that the ACE appliance is to upload optimization statistical log information to the optional AVS 3180A Management station. Clear the check box to indicate that the ACE appliance is not to upload this information. Step 4 Click Deploy Now to immediately deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files. 15-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 15 Configuring Application Acceleration and Optimization Configuring Global Application Acceleration and Optimization Related Topics • Optimization Overview, page 15-2 • Optimization Traffic Policies and Typical Configuration Flow, page 15-2 CHAPTER 16-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 16 Using Configuration Building Blocks Date: 3/28/12 Note Beginning with ANM software Version 5.1, the building block feature by default is hidden. If you have used the building block feature in the past and want to continuing using it after upgrading to ANM 5.1, you must enable it (see the “Enabling the Building Block Feature” section on page 16-5). Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. Building blocks allow authorized users to create and design reusable configuration attributes which can then be applied to virtual contexts. The ANM also allows you to extract the configuration of an existing virtual context and tag it as a building block. In many cases, the same configuration settings can be used in several virtual contexts (for example, it can offer the same service bundle to many customers). To avoid repeating virtual context configuration and testing each time you create a virtual context, you can create a building block of many configuration attributes that can be applied to virtual contexts as appropriate or as needed. With building blocks, you can also create a variety of configurations that address customers’ differing needs. The ability to customize configurations to customer needs also allows you to use network resources most efficiently. Benefits of configuration building blocks include: • You can establish baseline versions of working configurations. • Users can make real-time changes to configurations and roll back to a previously working configuration, if needed. • Building blocks can be extracted from proven, working configurations. • Building blocks can be placed under version control, with tagged versions that cannot be modified. 16-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 16 Using Configuration Building Blocks Table 16-1 lists the configuration options that are available for each building block type and provides links to related topics. For descriptive information about the menu options, see “Configuring Virtual Contexts” section on page 6-8. Table 16-1 Building Block Configuration Options Menu Option Building Block Type ACE 2.0 Related Topic ACE 4710 Appliance System Primary Attributes X X Configuring Building Block Primary Attributes, page 16-8 Syslog X X Configuring Virtual Context Syslog Settings, page 6-19 SNMP X X Configuring SNMP for Virtual Contexts, page 6-27 Global Policies X X Applying a Policy Map Globally to All VLAN Interfaces, page 6-35 Licenses Application Acceleration and Optimization Resource Classes Checkpoints Backup/Restore1 Load Balancing Virtual Servers Real Servers X X Configuring Real Servers, page 8-5 Server Farms X X Configuring Server Farms, page 8-30 Health Monitoring X X Configuring Health Monitoring for Real Servers, page 8-51 Stickiness X X Configuring Sticky Groups, page 9-7 HTTP Parameter Map X X Configuring HTTP Parameter Maps, page 10-9 Connection Parameter Maps X X Configuring Connection Parameter Maps, page 10-3 Optimization Parameter Maps X Configuring Optimization Parameter Maps, page 10-12 Generic Parameter Maps X X Configuring Generic Parameter Maps, page 10-8 RTSP Parameter Maps X X Configuring RTSP Parameter Maps, page 10-20 SIP Parameter Maps X X Configuring SIP Parameter Maps, page 10-21 Skinny Parameter Maps X X Configuring Skinny Parameter Maps, page 10-23 DNS Parameter Maps X X Secure KAL-AP X X Configuring Secure KAL-AP, page 8-77 SSL Setup Sequence Certificates Keys X X Using SSL Keys, page 11-10 16-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 16 Using Configuration Building Blocks Parameter Maps X X Configuring SSL Parameter Maps, page 11-18 Chain Group Parameters CSR Parameters X X Configuring SSL CSR Parameters, page 11-24 Proxy Service Auth Group Parameters X X Configuring SSL Authentication Groups, page 11-31 Certificate Revocation Lists (CSL) X X Configuring CRLs for Client Authentication, page 11-33 Security ACLs X X Creating ACLs, page 6-79 Object Groups X X Configuring Object Groups, page 6-89 Network Port Channel Gigabit Ethernet Interfaces VLAN Interfaces X X Configuring Virtual Context VLAN Interfaces, page 12-6 BVI Interfaces X X Configuring Virtual Context BVI Interfaces, page 12-19 NAT Pools2 X Configuring VLAN Interface NAT Pools, page 12-26 Static Routes X X Configuring Virtual Context Static Routes, page 12-28 Global IP DHCP X X Configuring Global IP DHCP, page 12-29 Static NAT Overwrite X Configuring Static VLANs for Over 8000 Static NAT Configurations, page 12-31 High Availability Setup HA Tracking and Failure Detection Interfaces Hosts HSRP Groups Role-Based Access Control Users X X Configuring Device RBAC Users, page 5-53 Roles X X Configuring Device RBAC Roles, page 5-56 Domains X X Configuring Device RBAC Domains, page 5-61 Expert Class Map X X Configuring Virtual Context Class Maps, page 14-6 Policy Map X X Configuring Virtual Context Policy Maps, page 14-32 HTTP Header Modify Action Lists X X Configuring an HTTP Header Modify Action List, page 14-85 Table 16-1 Building Block Configuration Options (continued) Menu Option Building Block Type ACE 2.0 Related Topic ACE 4710 Appliance 16-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 16 Using Configuration Building Blocks Information About Building Block Versions and Tagging This chapter includes the following sections: • Information About Building Block Versions and Tagging, page 16-4 • Enabling the Building Block Feature, page 16-5 • Creating Building Blocks, page 16-5 • Extracting Building Blocks from Virtual Contexts, page 16-6 • Configuring Building Blocks, page 16-7 • Tagging Building Blocks, page 16-9 • Applying Building Blocks, page 16-9 • Displaying Building Block Use, page 16-11 Information About Building Block Versions and Tagging The ANM maintains version history for the building blocks that you create, design, and tag. You can tag a working building block version at any point during design or configuration, and reuse any tagged version of a building block. A building block is not available for deployment until it has been tagged. When you tag a building block, the ANM publishes it with a version tag, such as 1.0 or 1.1. You cannot edit tagged versions of a building block. After a building block is tagged, it is “frozen” and can no longer be modified in any way. When you open a tagged building block for editing, the ANM does not modify the tagged version, but instead creates a new working copy of the building block for you to work in. Any changes you make to the working copy are not available for deployment until you tag the building block under a new version tag. Related Topics • Enabling the Building Block Feature, page 16-5 • Using Configuration Building Blocks, page 16-1 • Creating Building Blocks, page 16-5 • Extracting Building Blocks from Virtual Contexts, page 16-6 • Applying Building Blocks, page 16-9 • Tagging Building Blocks, page 16-9 • Displaying Building Block Use, page 16-11 Optimization Action Lists X Configuring an HTTP Optimization Action List, page 15-3 Building Block Audit 1. Backup/Restore is only supported for software version A2(3.0) and higher for the ACE module. 2. NAT pools as a selection under Network is only supported for software version A2(3.0) and higher for the ACE module. Table 16-1 Building Block Configuration Options (continued) Menu Option Building Block Type ACE 2.0 Related Topic ACE 4710 Appliance 16-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 16 Using Configuration Building Blocks Enabling the Building Block Feature Enabling the Building Block Feature Beginning with ANM software Version 5.1, the building block feature by default is hidden because it has been replaced with the application template feature introduced in the same release. The application template feature provides a more efficient and easier way of configuring ACE devices (see Chapter 4, “Using Application Template Definitions”). If you have used the building block feature in the past and want to continuing using it after upgrading to ANM 5.1, you must enable it. This procedure shows how to enable the building block feature on ANM server and ANM Virtual Appliance. Procedure Step 1 Enable the building block feature as follows: • ANM Server—Open the /opt/CSCOanm/etc/cs-config.properties file in a text editor and add the following line: web.buildingblocks.enable=true • ANM Virtual Appliance—Enter the following command: anm-property set web.buildingblocks.enable true Step 2 Restart ANM as follows: • ANM Server—Enter the following command: /opt/CSCOanm/bin/anm-tool restart • ANM Virtual Appliance—Enter the following command: anm-tool restart Step 3 From the ANM client devices, close all open ANM browser instances, clear the browser cache, and log in again. Failure to clear the browser cache after enabling the building block feature can result in the Extract Building Block function buttons not displaying. Creating Building Blocks Use this procedure to create a building block without using an existing configuration. To create a building block from an existing virtual context, see Extracting Building Blocks from Virtual Contexts, page 16-6. Procedure Step 1 Choose Config > Building Blocks. The All Building Blocks table appears. Step 2 In the All Building Blocks table, click Add. The New Building Block window appears. Step 3 In the Name field of the New Building Block window, enter a unique name for this building block. 16-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 16 Using Configuration Building Blocks Extracting Building Blocks from Virtual Contexts Step 4 In the Type field, choose the type of building block to create: • ACE v1.0—Use with virtual contexts on ACE modules using the specified software version. • ACE v2.0—Use with virtual contexts on ACE modules using the specified software version. • ACE v2.3—Use with virtual contexts on ACE modules using the specified software version. • ACE v4.1—Use with virtual contexts on ACE modules using the specified software version. • ACE v4.2—Use with virtual contexts on ACE modules using the specified software version. • ACE4710 V 1.0—Use with virtual contexts on ACE appliances using the specified software version. • ACE4710 V 2.0—Use with virtual contexts on ACE appliances using the specified software version. • ACE4710 V 4.1—Use with virtual contexts on ACE appliances using the specified software version. • ACE4710 V 4.2—Use with virtual contexts on ACE appliances using the specified software version. See Table 16-1 for a list of the available configuration options for each building block type. Step 5 In the Description field, enter a brief description for this building block. Step 6 Do one of the following: • Click Save to save your entries and to continue with building block configuration. The Primary Attributes configuration window appears. • Click Cancel to exit this procedure without saving your entries and to return to the All Building Blocks table. • Click Tag to save your entries and tag the building block. After you tag a building block, the window refreshes and provides fields for applying the building block. For more information, see Applying Building Blocks, page 16-9. Related Topics • Enabling the Building Block Feature, page 16-5 • Using Configuration Building Blocks, page 16-1 • Extracting Building Blocks from Virtual Contexts, page 16-6 • Information About Building Block Versions and Tagging, page 16-4 • Applying Building Blocks, page 16-9 • Tagging Building Blocks, page 16-9 • Displaying Building Block Use, page 16-11 Extracting Building Blocks from Virtual Contexts An alternative to creating a new configuration building block and configuring each attribute individually is to extract a configuration building block from an existing virtual context. By extracting a building block from a virtual context, you can reduce the time you spend configuring and testing the configuration. 16-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 16 Using Configuration Building Blocks Configuring Building Blocks Use this procedure to create a working building block from a virtual context configuration. Procedure Step 1 Choose Config > Devices. The device tree appears. Step 2 In the device tree, choose the ACE with the virtual context whose configuration you want to use as a building block. The Virtual Contexts table appears. Step 3 In the Virtual Contexts table, choose the context with the configuration that you want to extract, and click Extract Building Block. A popup window appears, asking for a building block name. Step 4 In the Name field of the popup window, enter a name for this building block, and click OK. The window refreshes with the Primary Attributes window for the newly created building block (Config > Global > building_block). Step 5 Modify the building block as desired using the information in Table 16-1, or tag and deploy it as described in “Tagging Building Blocks” section on page 16-9 and “Applying Building Blocks” section on page 16-9). Related Topics • Enabling the Building Block Feature, page 16-5 • Applying Building Blocks, page 16-9 • Tagging Building Blocks, page 16-9 • Displaying Building Block Use, page 16-11 Configuring Building Blocks You can modify a working version of a configuration building block. Note You can modify only working versions of building blocks; you cannot modify tagged versions of building blocks. If you select a tagged building block version, and then select a configuration option (such as Load Balancing > Health Monitoring), you can view the entries for that tagged version, but you cannot modify them. Procedure Step 1 Choose Config > Building Blocks. The All Building Blocks table appears. Step 2 Choose the working version of the building block that you want to modify, then choose the attributes that you want to configure. For information about building block configuration options, see Table 16-1. 16-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 16 Using Configuration Building Blocks Configuring Building Blocks Note While it is possible to configure VLAN and BVI interfaces in a building block, we recommend that you do not do so. Applying a building block with these attributes configured to a virtual context with different settings can disrupt network traffic. Step 3 To apply this building block, tag it, and deploy it as described in “Tagging Building Blocks” section on page 16-9 and “Applying Building Blocks” section on page 16-9. Related Topics • Enabling the Building Block Feature, page 16-5 • Using Configuration Building Blocks, page 16-1 • Information About Building Block Versions and Tagging, page 16-4 • Creating Building Blocks, page 16-5 • Extracting Building Blocks from Virtual Contexts, page 16-6 • Tagging Building Blocks, page 16-9 • Displaying Building Block Use, page 16-11 Configuring Building Block Primary Attributes Use this procedure to change the description of a configuration building block. Procedure Step 1 Choose Config > Building Blocks. The All Building Blocks table appears. Step 2 In the All Building Blocks table, choose the building block that you want to modify, and choose System > Primary Attributes. The Primary Attributes window appears. Step 3 In the Description field of the Primary Attributes window, modify the description as desired. Step 4 Do one of the following: • Click Save to save your entries. The window refreshes with the saved information. • Click Tag to tag the building block. To deploy the tagged building block, see “Applying Building Blocks” section on page 16-9. Related Topics • Enabling the Building Block Feature, page 16-5 • Creating Building Blocks, page 16-5 • Configuring Building Blocks, page 16-7 • Tagging Building Blocks, page 16-9 16-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 16 Using Configuration Building Blocks Tagging Building Blocks Tagging Building Blocks You can tag a working copy of a building block. After creating a building block, you must tag it before you can apply it to virtual contexts. Procedure Step 1 Choose Config > Building Blocks. The All Building Blocks table appears. Step 2 In the All Building Blocks table, choose the working copy of the building block that you want to tag, and click Tag. The All Building Blocks table refreshes with the newly tagged building block identified by its version, such as 1.2 or 1.3. A working copy of the building block remains available so that you can use it for future building block versions. To apply the tagged building block to virtual contexts on your network, see “Applying Building Blocks” section on page 16-9. Related Topics • Enabling the Building Block Feature, page 16-5 • Using Configuration Building Blocks, page 16-1 • Information About Building Block Versions and Tagging, page 16-4 • Creating Building Blocks, page 16-5 • Applying Building Blocks, page 16-9 • Extracting Building Blocks from Virtual Contexts, page 16-6 • Displaying Building Block Use, page 16-11 Applying Building Blocks You can apply building blocks in two ways: • By selecting a virtual context, then applying the building block. See “Applying a Building Block to a Single Virtual Context” section on page 16-10. • By selecting the tagged building block, then applying it to one or more virtual contexts. See “Applying a Building Block to Multiple Virtual Contexts” section on page 16-10. 16-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 16 Using Configuration Building Blocks Applying Building Blocks Applying a Building Block to a Single Virtual Context You can apply a tagged building block to a virtual context using virtual context configuration screens. Note Before applying a building block to a virtual context, confirm that the VLAN and BVI interfaces are defined correctly for the virtual context. If needed, remove VLAN and BVI interface configuration information from the building block and then apply it. Procedure Step 1 Choose Config > Devices > All Devices. The device tree appears. Step 2 Choose the virtual context that you want to apply a building block to, and choose System > Primary Attributes. The Primary Attributes window appears. Step 3 In the Tagged Building Block to Apply field, choose the building block you want to apply to the virtual context. Step 4 Click Deploy Now. Related Topics • Enabling the Building Block Feature, page 16-5 • Applying a Building Block to Multiple Virtual Contexts, page 16-10 • Using Configuration Building Blocks, page 16-1 • Information About Building Block Versions and Tagging, page 16-4 • Extracting Building Blocks from Virtual Contexts, page 16-6 • Tagging Building Blocks, page 16-9 Applying a Building Block to Multiple Virtual Contexts You can apply a tagged building block to one or more contexts by using the building block configuration screens. Note Before applying a building block to a virtual context, confirm that the VLAN and BVI interfaces are defined correctly for the virtual context. If needed, remove VLAN and BVI interface configuration information from the building block and then apply it. Procedure Step 1 Choose Config > Building Blocks. The All Building Blocks table appears. 16-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 16 Using Configuration Building Blocks Displaying Building Block Use Step 2 In the All Building Blocks table, choose the tagged building block that you want to apply to one or more virtual contexts. Step 3 Choose System > Primary Attributes. The Primary Attributes configuration window appears. Step 4 In the Push Building Block to VCs field of the Primary Attributes configuration window, choose the contexts that you want to apply the building block to in the Available Items list, and click Add. They appear in the Selected Items list. To remove contexts that you do not want to apply the building block to, choose them in the Selected Items list, then click Remove. They items appear in the Available Items list. Step 5 Click Save. A progress bar reports status and the window refreshes when the operation is complete. Related Topics • Enabling the Building Block Feature, page 16-5 • Applying a Building Block to a Single Virtual Context, page 16-10 • Using Configuration Building Blocks, page 16-1 • Information About Building Block Versions and Tagging, page 16-4 • Creating Building Blocks, page 16-5 Displaying Building Block Use You can identify the virtual contexts using a building block. Procedure Step 1 Choose Config > Devices. The device tree appears. Step 2 In the device tree, choose All VC. The Virtual Contexts table appears. Step 3 In the Virtual Contexts table, use one of the following methods to display the building blocks being used: • For a small number of contexts, scan the Building Block column to see which building blocks are in use on virtual contexts. • For a large number of contexts, click Filter. The window refreshes so that you can enter search criteria. In the field beneath the Building Block column heading, enter a building block name or search string, then click Go. The table refreshes with entries that match the search criteria. Related Topics • Enabling the Building Block Feature, page 16-5 • Using Configuration Building Blocks, page 16-1 • Information About Building Block Versions and Tagging, page 16-4 16-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 16 Using Configuration Building Blocks Displaying Building Block Use • Creating Building Blocks, page 16-5 • Extracting Building Blocks from Virtual Contexts, page 16-6 • Tagging Building Blocks, page 16-9 CHAPTER 17-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 17 Monitoring Your Network Date: 3/28/12 Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. The ANM Monitor function allows you to monitor key areas of system usage. The following functionality is provided under Monitor in ANM: • Dashboards—Operate as a central location for you to view monitoring results and track potential issues. There are three types of dashboards in ANM: ANM/Group Dashboard, ACE Dashboard, and Context Dashboard. Each dashboard provides quick access to all relevant monitoring pages. See “Using Dashboards to Monitor Devices and Virtual Contexts” section on page 17-4. • Events—Lists events originated from devices through syslog, SNMP traps. See “Monitoring Events” section on page 17-55. • Alarm Notifications—Allows you to define thresholds and view alarms. See “Configuring Alarm Notifications on ANM” section on page 17-57 and “Displaying Alarm Notifications” section on page 17-65. • Settings—Allows you to do the following: – Display the current polling status of all the objects that ANM manages. See the “Displaying the Polling Status of All Managed Objects” section on page 17-44. – Set global polling and SMTP configurations. See “Setting Polling Parameters” section on page 17-46. – Export historical data. See “Exporting Historical Data” section on page 52. • Topology maps—Allows you to display a network topology map based on a selected virtual or real server. See “Displaying Network Topology Maps” section on page 68. • Tools—Allows you to verify connectivity (using the ping command) between a virtual context and an IP address that you specify. See “Testing Connectivity” section on page 71. 17-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Setting Up Devices for Monitoring Note When ANM is unable to retrieve information for a monitored statistic, it displays one of the following status conditions in the table cell: • N/A (Not Available)—Indicates that ANM was unable to poll the device for the information for one of the following reasons: – ANM is experiencing polling errors with the device. – ANM is not able to communicate with the device. – If a poll was recently initiated, ANM is in the process of gathering information from the device. • Not Supported—Indicates that the device does not have the capability to provide the information. This condition can be caused when the device does not have the necessary SNMP instrumentation. It is possible that another similar device type is able to provide the statistical information because it has been updated with the necessary SNMP instrumentation. • Not Applicable—Indicates that the particular information is not valid or not applicable for the device type, or ANM is unable to retrieve the information from the device because the information is not available through SNMP for the device type. Before using the Monitoring functions, make sure that your devices are properly configured for polling (see “Setting Up Devices for Monitoring” section on page 17-2). Setting Up Devices for Monitoring In order for ANM to successfully monitor your devices, you must configure the devices correctly for polling as show in Table 17-1. Table 17-1 Configuring Devices for Monitoring Device Type How to Configure Parameters to Configure ACE modules Configure parameters on the Admin context only. • All devices must have a routable IP address from the ANM. • The management policy with the SNMP protocol must be associated to the IP address. • You must enable SNMPv2c with a matching SNMP community string between ANM and the devices to be polled. (See the “Configuring Virtual Contexts” section on page 6-1.) • Before using the Monitoring functions, you must enable monitoring on all devices that you want ANM to monitor (see the “Setting Polling Parameters” section on page 17-46). ACE appliances Configure parameters on the Admin context only. 17-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Device Monitoring Features Related Topics • Device Monitoring Features, page 17-3 • Using Dashboards to Monitor Devices and Virtual Contexts, page 17-4 • Monitoring Devices, page 17-24 Device Monitoring Features ANM provides several features that allow you to monitor your devices when you click Monitor: • Dashboards—Operate as a central location for you to view device and context monitoring results and track potential issues. There are three types of Dashboards in ANM: ANM/Group Dashboard, ACE Dashboard, and ACE Virtual Context Dashboard. Each Dashboard provides quick access to all relevant monitoring pages. See “Using Dashboards to Monitor Devices and Virtual Contexts” section on page 17-4. • System View—Provides device information and a general overview of your system as a whole, including High Availability (HA) information and licensing information. System View is available only for CSS and CSM devices. See “Monitoring the System” section on page 17-25. • Resource Usage—Provides resource usage information on connections and features. See “Monitoring Resource Usage” section on page 17-26. Resource usage is not available for CSS or CSM devices. • Traffic Summary—Provides traffic information for your devices. Traffic Summary is available only for the ACE module, ACE appliance, and CSS. See “Monitoring Traffic” section on page 17-30. • Load Balancing—Provides virtual server information and load balancing statistics. See “Monitoring Load Balancing” section on page 17-33 and “Monitoring Load Balancing Statistics” section on page 17-41. CSS Configure parameters on the CSS devices that you want ANM to monitor. You cannot use ANM to configure the CSS. • All devices must have a routable IP address from the ANM. • For CSS devices, you must enable SNMPv2c with a matching SNMP community string between ANM and the devices to be polled. (See the “Configuring CSS Primary Attributes” section on page 5-35.) • For CSM devices, you must enable SNMPv2c with a matching SNMP community string on the Cat6K chassis in which the CSM resides. (See the “Configuring CSM Primary Attributes” section on page 5-34.) • Before using the Monitoring functions, you must enable monitoring on all devices that you want ANM to monitor (see the “Setting Polling Parameters” section on page 17-46). CSM Configure parameters on the Cat6K chassis (in which the CSM resides) that you want ANM to monitor. You cannot use ANM to configure the CSM. Table 17-1 Configuring Devices for Monitoring (continued) Device Type How to Configure Parameters to Configure 17-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts • Application Acceleration—Displays optimization statistics for ACE appliances on which you have configured application acceleration functions. See the “Monitoring Application Acceleration” section on page 17-43. This feature is only available on ACE appliances. • Polling Settings—Allows you to set polling parameters. See the “Setting Polling Parameters” section on page 17-46. • Historical Graphs—Allows you to view historical data for a group of monitoring page statistics. See the “Configuring Historical Trend and Real Time Graphs for Devices” section on page 17-48. Using Dashboards to Monitor Devices and Virtual Contexts ANM dashboards allow for faster and more accurate assessment and analysis of device and virtual context health and usage, as well as performance. Corresponding monitoring views allow for quick access to details for further investigation into potential problems highlighted in the dashboards. Graphs, as well as monitoring screens, allow you to view historical data and compare the performance with the peer objects. Note All client browsers require that you enable Adobe Flash Player 9 to properly display the monitoring graphs provided in ANM. Dashboards in ANM provide: • A central location for you to view monitoring highlights. • Emphasis on potential issues that require your attention. • Quick access to relevant ANM pages for more detailed monitoring data. In each dashboard, there are a relevant set of dashboard panes. The information shown in the dashboard panes differ based on the device or groups that you select in the device tree. The dashboard panes are moveable element inside the dashboard that can be minimized/maximized, moved, and, if desired, removed from view. You can also display a larger (full) window view for a dashboard window. Note Changes made to dashboard layout or pane selections are only applicable for the current session. Those changes are not maintained by ANM the next time you access an ANM dashboard. The dashboard tables and graphs autorefresh every two minutes. If desired, you can disable autofreshing by clicking the Pause Autofresh button in the upper-right corner of the dashboard. Note All dashboard contents are under Role-Based Access Control (RBAC). Options will be grayed or not displayed if proper permission has not been granted to the logged in user by the administrator. See the “How ANM Handles Role-Based Access Control” section on page 18-8 for more information about RBAC in ANM. This section includes the following topics: • ACE Dashboard, page 17-5 • ACE Virtual Context Dashboard, page 17-12 • ANM Group Dashboard, page 17-16 17-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts ACE Dashboard The ACE Dashboard displays the information related to the ACE module or ACE appliance that is selected in the device tree. You access the ACE Dashboard by selecting Monitor > Devices > ACE > Dashboard. Figure 17-1 illustrates the individual components of the ACE Dashboard. Note The ANM software version that displays across the top of the window varies depending on your version of ANM. Figure 17-1 Example ACE Device Dashboard To enhance your viewing of the monitoring information in the ACE Dashboard, you can perform the following actions: • Click and drag an individual dashboard pane to move it to another location within the ACE Dashboard. • Use the Collapse/Expand buttons at the top right side of each dashboard pane to minimize/maximize a pane within the ACE Dashboard. • Click the Remove button to remove a dashboard pane from the ACE Dashboard. Click the Bring Back Closed Dashboard Panes button at the top of the ACE Dashboard to open the closed dashboard pane. Note When you close any of the panes in a dashboard by clicking the Remove button, all of the headers in the other dashboard panes turn black to indicate that a pane has been closed. To return the dashboard panes to normal, click the Bring Back Closed Dashboard Panes button to reload the removed dashboard pane. • Click the Screen View (Full)/Screen View (Normal) buttons to display a larger (full) window view for the ACE Dashboard. 17-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts Changes made to dashboard layout or pane selections are only applicable for the current session. Those changes are not maintained by ANM the next time you access the ACE Dashboard. The components of the individual ACE Dashboard panes are described in the following sections. • Device Information Table, page 17-6 • License Status Table, page 17-6 • High Availability Table, page 17-7 • ACE Device Configuration Summary Table, page 17-7 • Context With Denied Resource Usage Detected Table, page 17-8 • Device Resource Usage Graph, page 17-9 • Top 10 Current Resources Table, page 17-10 • Control Plane CPU/Memory Graphs, page 17-11 Device Information Table The Device Information table lists the details that will identify the status of the selected ACE. It includes the following fields: • Host Name—Host name of the ACE module or ACE appliance. • Device Status—Device reachability status through SNMP and XML connectivity (Up or Down). • Device Type—ACE device specifics for the ACE module or ACE appliance. • Management IP—Management IP address of the admin virtual context. • Number of Contexts—Number of configured contexts, including the Admin context and configured user contexts. • Software Version—Release software version of the ACE module or ACE appliance. • Last Boot Reason—Reason for the last reboot of the ACE (if available). • Uptime—Length of time that the ACE has been up and running. The data shown in this table is collected during device discovery as well as during periodic monitor polling. The timestamp shown in the status bar is from the last polled time of the Admin virtual context. License Status Table The License Status table lists the license status of the selected ACE device. ANM uses the ACE show license status CLI command to obtain the license details. The timestamp shown in the status bar is from the last polled time of the Admin virtual context. 17-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts High Availability Table The HA Peer Information table lists the details of the HA peer, if configured in HA mode. It includes the following information: • HA/FT Interface State—State of the local ACE. See the “ACE High Availability Polling” section on page 13-7. • My IP Address—IP address of the local ACE. • Peer IP Address—IP address of the peer ACE. • Software Compatibility—Status of whether the software version of the local ACE and the software version of the peer ACE are compatible. Possible states are the INIT, COMPATIBLE, or INCOMPATIBLE state. • License Compatibility—Status of whether the license of the local ACE and the license of the peer ACE are compatible. Possible states are the INIT, COMPATIBLE, or INCOMPATIBLE state. • Number of FT Groups—Number of configured FT groups. • Number of Heartbeats Transmitted—Total number of heartbeat packets transmitted. • Number of Heartbeats Received—Total number of heartbeat packets received. This data is collected during periodic monitoring polling. The timestamp shown in the status bar is from the last polled time of the Admin virtual context. ACE Device Configuration Summary Table The Device Configuration Summary table displays the following information: • Virtual Servers—Total count of virtual servers configured in all contexts and the count of virtual servers that are in the In Service or Out of Service state. ANM also identifies virtual servers that have a Status Not Available state (due to polled failing, polled disable, and so on) and have a Status Not Supported state (due to a lack of ACE SNMP support). A hyperlink enables you to view load balancing virtual server monitoring information based on the identified state (see the “Monitoring Load Balancing on Virtual Servers” section on page 17-33). For example, if you click the In Service hyperlink, you will see only the virtual servers that are currently in service. • Real Servers—Total count of real servers configured in all contexts and the count of real servers that are in In Service and Out of Service. A hyperlink enables you to view load balancing real server monitoring information based on the identified state (see the “Monitoring Load Balancing on Real Servers” section on page 17-37). For example, if you click the In Service hyperlink, you will see only the real servers that are currently in service. • Probes—Total count of probes configured in all contexts and the count of probes that are in the In Service and Out of Service state. A hyperlink enables you to view load balancing probe monitoring information based on the identified state (see the “Monitoring Load Balancing on Probes” section on page 17-40). For example, if you click the In Service hyperlink, you will see only the probes that are currently in service. • Gigabit Ethernets—(ACE appliance only) Total count of Gigabit Ethernet physical interfaces configured on the ACE appliance based on their operational status of Up and Down. A hyperlink enables you to view traffic summary information based on the identified state (see the “Monitoring Traffic” section on page 17-30). For example, if you click the Up hyperlink, you will see only the Gigabit Ethernet physical interfaces that currently have an operational status of Up. 17-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts • VLANs—Total count of VLANs configured and the count of VLANs based on operational status - Up and Down. A hyperlink enables you to view traffic summary information based on the identified state (see the “Monitoring Traffic” section on page 17-30). For example, if you click the Up hyperlink, you will see only the VLAN interfaces that currently have an operational status of Up. • Port Channels—(ACE appliance only) Total count of port channels configured on the ACE appliance based on their operational status of Up and Down. A hyperlink enables you to view traffic summary information based on the identified state (see the “Monitoring Traffic” section on page 17-30). For example, if you click the Up hyperlink, you will see only the port channels that currently have an operational status of Up. • BVIs—Total count of BVI interfaces and the count of BVI interfaces based on their operational status of Up and Down. A hyperlink enables you to view traffic summary information based on the identified state (see the “Monitoring Traffic” section on page 17-30). For example, if you click the Up hyperlink, you will see only the BVI interfaces that currently have an operational status of Up. • Certificates—Total count of SSL certificates and the count of SSL certificates that are expiring beyond 30 days, expired, or that are expiring within 30 days. A hyperlink accesses a popup window for you to view the SSL certificates list based on the selection, displaying the certificate name, device name, days to expire, expiration date, and the date it was evaluated for you to determine the days to expire. Certificates are considered expired it their expiration date is within the next day (rounded down the next day). A hyperlink in the device name allows you to navigate to the context-based SSL Certificate configuration page (see the “Using SSL Certificates” section on page 11-5). This data is collected during discovery as well as during periodic monitoring polling. The timestamp shown in the status bar indicates a varying poll time; that is, different virtual contexts were polled and those context had different time stamps. The earliest time stamp of the polled virtual contexts is displayed in the status bar. All counts shown in the Device Configuration Summary table are based on the operational status of the monitored objects listed above. • Out Of Service—Indicates any status other than In Service (for example, Out Of Service, Failed, or Disabled). • Status not available—Indicates that ANM was unable to poll the operational status of this object. The display of this operational status could be due to polling errors or the device was unreachable. Also, if a poll was recently initiated, this operational status could indicate that ANM is in the process of collecting data. • Status not supported—Indicates that the device does not have the capability to provide an operational status of this object. The display of this operational status could be due to missing SNMP instrumentation on earlier ACE devices. Context With Denied Resource Usage Detected Table The Context With Denied Resource Usage Detected table lists all contexts for which the resource request is denied after reaching the maximum limit. An increase in the deny count (that is, the deny rate) results in the relevant context resource type appearing in this table. ANM obtains the count information by using the ACE show resource usage CLI command, which collects the information from the following MIBs: crlResourceLimitReqsDeniedCount and crlRateLimitResourceReqsDeniedCount. This table includes the following information: • Context—Name of the configured context that contains a denied resource. • Resource Type—Type of system resource in the context. 17-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts • Denies/Second—Number of denied resources (per second) as a result of oversubscription or resource depletion. • Total Deny Count—Number of denied uses of the resource since the resource statistics were last cleared. • Last Polled Count—Date and time of the last time that ANM polled the device to display the current values. Note The Context With Denied Resource Usage Detected table does not display the sticky denied resource count because this count does not increment when the ACE sticky resources are exhausted. The ACE’s sticky table can hold a maximum of four million entries (four million simultaneous users). When the table reaches the maximum number of entries, additional sticky connections cause the table to wrap and the first users become unstuck from their respective servers. A hyperlink allows you to access the Resource Usage monitoring page to view a detailed list of resources used and denied counts (see the “Monitoring Resource Usage” section on page 17-26). Device Resource Usage Graph For each resource type, the ACE Dashboard displays the Top 3 virtual contexts that consume the resources in the Device Resource Usage graph (Figure 17-2). A tooltip is added to display the Top 3 context names and their consumption, consumption of the resource by rest of the contexts and the total consumption by all contexts. This data is collected by ANM by using the ACE show resource usage CLI command. The timestamp shown in the status bar indicates a varying poll time; that is, different virtual contexts were polled and those context had different time stamps. The earliest time stamp of the polled virtual contexts is displayed in the status bar. Figure 17-2 Device Resource Usage Graph To toggle the display of the Device Resource Usage graph in the monitoring window: • Click View As Chart to display the object data as a graph. • Click View As Grid to display the object data as a numerical line grid. Note If you want to save the graph as a JPEG file for archive or other purposes, click the Show As Image button. When you mouse over the graph, the Image Toolbar appears. From the Image Toolbar, you can save the graph as a JPEG or send it in an email. You can also print the graph if desired. If you want to export object data to Microsoft Excel for archive or other purposes, click the Export to Excel link in the View As Grid object display. 17-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts Hyperlinks allow you to access the individual resource usage page for more details (see the “Monitoring Resource Usage” section on page 17-26). Note ACL Memory (for ACE module and ACE appliance) and Application Acceleration (for ACE appliance only) do not appear in the Device Resource Usage graph. To view the detailed counters, click the hyperlink to access individual resource usage page. Top 10 Current Resources Table The Top 10 Resource Usage table (Figure 17-3) displays the Top 10 resource types that have been evaluated for high resource utilization. The resource with highest utilization appears at the top. This data is collected by ANM by using the ACE show resource usage CLI command. Figure 17-3 Top 10 Current Resources Table—ACE Dashboard This table includes the following information: • Last Hour—Plot of high resource utilization during the past hour. • Resource Name—Type of system resource in the context. • Used By—Name of the virtual context that is placing the high demands on the resource. The Global Pool usage is critical in the setup where one or more contexts are configured to make use of the global pool once their reserved resource are depleted and resource is free in the global pool. In this situation, if the global pool is depleted, multiple contexts may be starved for resource. Note Contexts configured to make use of the global pool will not be evaluated for the Top 10 Resource Usage table. • Current Usage—Active concurrent instances or the current rate of the resource. • Average—Average value of resource usage (based on the last hour). • Max.—Highest value of resource usage (based on the last hour). • Last Polled Time—Date and time of the last time that ANM polled the device to display the current values. Hyperlinks allow you to access the individual resource usage page for more details (see the “Monitoring Resource Usage” section on page 17-26). You can choose to show or hide the syslog buffer information that displays in the Top 10 Current Resources pane. You may want to hide this information because it will always show 100 percent after the buffer becomes full and starts to wrap. For more information, see the “Managing the Syslog Buffer Display in the All Devices Dashboard” section on page 18-66. 17-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts Control Plane CPU/Memory Graphs The Control Plane CPU/Memory graphs (Figure 17-4) show the utilization of the ACE CPU. This data consists of two graphs: • The Control Plane CPU Usage graph shows the utilization of the ACE CPU as a percentage. • The Control Plane Memory graph displays the consumed memory on Kbytes. A tooltip is added to display the Cache Memory, Total Memory, Shared Memory, Buffer Memory, and Free Memory usage as a percentage. To toggle the display of the Control Plane CPU/Memory graph in the monitoring window: • Click View As Chart to display the object data as a graph. • Click View As Grid to display the object data as a numerical line grid. Note If you want to save the graph as a JPEG file for archive or other purposes, click the Show As Image button. When you mouse over the graph, the Image Toolbar appears. From the Image Toolbar, you can save the graph as a JPEG or send it in an email. You can also print the graph if desired. If you want to export object data to Microsoft Excel for archive or other purposes, click the Export to Excel link in the View As Grid object display. Figure 17-4 Control Plane CPU/Memory Graphs 17-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts ACE Virtual Context Dashboard The ACE Virtual Context Dashboard displays monitoring information for an ACE virtual context selected from the device tree,. You access the ACE Virtual Context Dashboard by selecting Monitor > Devices > virtual_context > Dashboard. Figure 17-5 illustrates the individual components of the ACE Virtual Context Dashboard. Note The ANM software version that displays across the top of the window varies depending on your version of ANM. Figure 17-5 ACE Virtual Context Dashboard To enhance your viewing of the monitoring information in the ACE Virtual Context Dashboard, you can perform the following actions: • Click and drag an individual dashboard pane to move it to another location within the ACE Virtual Context Dashboard. • Use the Collapse/Expand buttons at the top right side of each dashboard pane to minimize/maximize a pane within the ACE Virtual Context Dashboard. • Click the Remove button to remove a dashboard pane from the ACE Virtual Context Dashboard. Click the Bring Back Closed Dashboard Panes button at the top of the ACE Virtual Context Dashboard to open the closed dashboard pane. Note When you close any of the panes in a dashboard by clicking the Remove button, all of the headers in the other dashboard panes turn black to indicate that a pane has been closed. To return the dashboard panes to normal, click the Bring Back Closed Dashboard Panes button to reload the removed dashboard pane. • Click the Screen View (Full)/Screen View (Normal) buttons to display a larger (full) window view for the ACE Dashboard. 17-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts Changes made to dashboard layout or pane selections are only applicable for the current session. Those changes are not maintained by ANM the next time you access the ACE Virtual Context Dashboard. The components of the individual ACE Virtual Context Dashboard panes are described in the following sections. • ACE Virtual Context Device Configuration Summary Table, page 17-13 • Context With Denied Resource Usage Detected Table, page 17-14 • Context Resource Usage Graph, page 17-15 • Load Balancing Servers Performance Graphs, page 17-15 ACE Virtual Context Device Configuration Summary Table The Device Configuration Summary table displays the following information: • Virtual Servers—Total count of virtual servers configured in all contexts and the count of virtual servers that are in the In Service and Out of Service state. ANM also identifies virtual servers that have a Status Not Available state (due to polled failing, polled disable, and so on) and have a Status Not Supported state (due to a lack of ACE SNMP support). A hyperlink enables you to view load balancing virtual server monitoring information based on the identified state (see the “Monitoring Load Balancing on Virtual Servers” section on page 17-33). For example, if you click the In Service hyperlink, you will see only the virtual servers that are currently in service. • Real Servers—Total count of real servers configured in all contexts and the count of real servers that are in In Service and Out of Service. A hyperlink enables you to view load balancing real server monitoring information based on the identified state (see the “Monitoring Load Balancing on Real Servers” section on page 17-37). For example, if you click the In Service hyperlink, you will see only the real servers that are currently in service. • Probes—Total count of probes configured in all contexts and the count of probes that are in the In Service and Out of Service state. A hyperlink enables you to view load balancing probe monitoring information based on the identified state (see the “Monitoring Load Balancing on Probes” section on page 17-40). For example, if you click the In Service hyperlink, you will see only the probes that are currently in service. • Gigabit Ethernets—(ACE appliance only) Total count of Gigabit Ethernet physical interfaces configured on the ACE appliance based on their operational status of Up and Down. A hyperlink enables you to view traffic summary information based on the identified state (see the “Monitoring Traffic” section on page 17-30). For example, if you click the Up hyperlink, you will see only the Gigabit Ethernet physical interfaces that currently have an operational status of Up. • VLANs—Total count of VLANs configured and the count of VLANs based on operational status - Up and Down. A hyperlink enables you to view traffic summary information based on the identified state (see the “Monitoring Traffic” section on page 17-30). For example, if you click the Up hyperlink, you will see only the VLAN interfaces that currently have an operational status of Up. • Port Channels—(ACE appliance only) Total count of port channels configured on the ACE appliance based on their operational status of Up and Down. A hyperlink enables you to view traffic summary information based on the identified state (see the “Monitoring Traffic” section on page 17-30). For example, if you click the Up hyperlink, you will see only the port channels that currently have an operational status of Up. • BVIs—Total count of BVI interfaces and the count of BVI interfaces based on their operational status of Up and Down. A hyperlink enables you to view traffic summary information based on the identified state (see the “Monitoring Traffic” section on page 17-30). For example, if you click the Up hyperlink, you will see only the BVI interfaces that currently have an operational status of Up. 17-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts • Certificates—Total count of SSL certificates and the count of SSL certificates that are expiring beyond 30 days, expired, or that are expiring within 30 days. A hyperlink accesses a popup window for you to view the SSL certificates list based on the selection, displaying the certificate name, device name, days to expire, expiration date, and the date it was evaluated for you to determine the days to expire. Certificates are considered expired it their expiration date is within the next day (rounded down the next day). A hyperlink in the device name allows you to navigate to the context-based SSL Certificate configuration page (see the “Using SSL Certificates” section on page 11-5). Counts are based on the selected ACE virtual context and not for all ACE virtual contexts. This data is collected during discovery as well as during periodic monitoring polling. The timestamp shown in the status bar indicates a varying poll time; that is, different virtual contexts were polled and the contexts had different time stamps. The earliest time stamp of the polled virtual contexts is displayed in the status bar. All counts shown in the Device Configuration Summary table are based on the operational status of the monitored objects listed above. • Out Of Service—Indicates any status other than In Service (for example, Out Of Service, Failed, or Disabled). • Status not available—Indicates that ANM was unable to poll the operational status of this object. The display of this operational status could be due to polling errors or the device was unreachable. Also, if a poll was recently initiated, this operational status could indicate that ANM is in the process of collecting data. • Status not supported—Indicates that the device does not have the capability to provide an operational status of this object. The display of this operational status could be due to missing SNMP instrumentation on earlier ACE devices. Context With Denied Resource Usage Detected Table The Context With Denied Resource Usage Detected table lists all contexts for which the resource request is denied after reaching the maximum limit. An increase in the deny count (that is, the deny rate) will result in the relevant context resource type to appear in this table. This data is collected by ANM by using the ACE show resource usage CLI command. This table includes the following information: • Context—Name of the configured context that contains a denied resource. • Resource Type—Type of system resource in the context. • Denies/Second—Number of denied resources (per second) as a result of oversubscription or resource depletion. • Total Deny Count—Number of denied uses of the resource since the resource statistics were last cleared. • Last Polled Count—Date and time of the last time that ANM polled the device to display the current values. Note This information is collected from the following MIBs: crlResourceLimitReqsDeniedCount and crlRateLimitResourceReqsDeniedCount. A hyperlink allows you to access the Resource Usage monitoring page to view a detailed list of resources used and denied counts (see the “Monitoring Resource Usage” section on page 17-26). 17-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts Context Resource Usage Graph The Context Resource Usage graph (see Figure 17-5) displays the details of each resource type utilized by the selected contexts. For each resource type, the graph includes the following monitoring statistics: Used, Global Available, and Guaranteed. This data is collected by ANM by using the ACE show resource usage CLI command. To toggle the display of the Context Resource Usage graph in the monitoring window: • Click View As Chart to display the object data as a graph. • Click View As Grid to display the object data as a numerical line grid. Note If you want to save the graph as a JPEG file for archive or other purposes, click the Show As Image button. When you mouse over the graph, the Image Toolbar appears. From the Image Toolbar, you can save the graph as a JPEG or send it in an email. You can also print the graph if desired. If you want to export object data to Microsoft Excel for archive or other purposes, click the Export to Excel link in the View As Grid object display. Hyperlinks allow you to access the individual resource usage page for more details (see the “Monitoring Resource Usage” section on page 17-26). Note ACL Memory (for ACE module and ACE appliance) and Application Acceleration (for ACE appliance only) do not appear in the Device Resource Usage graph. To view the detailed counters, click the hyperlink to access individual resource usage page. Load Balancing Servers Performance Graphs The Load Balancing Servers Performance graphs (Figure 17-6) include: • Top 5 Virtual Servers—Displays the top five virtual servers in the selected virtual context. You can select from server statistics (such as High Connection Rate, Dropped Connection Rate, and so on) that are collected by ANM polling for top performance evaluation. • Top 5 Real Servers—Displays the top five real servers in the selected virtual context. You can select from server statistics (such as High Connection Rate, Dropped Connection Rate, and so on) that are collected by ANM polling for top performance evaluation. You select the statistic from the Select Statistics drop-down list. To toggle the display of a Load Balancing Servers Performance graph in the monitoring window: • Click View As Chart to display the object data as a graph. • Click View As Grid to display the object data as a numerical line grid. Note If you want to save the graph as a JPEG file for archive or other purposes, click the Show As Image button. When you mouse over the graph, the Image Toolbar appears. From the Image Toolbar, you can save the graph as a JPEG or send it in an email. You can also print the graph if desired. If you want to export object data to Microsoft Excel for archive or other purposes, click the Export to Excel link in the View As Grid object display. 17-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts Hyperlinks allow you to access the corresponding monitoring screens for more details: • Monitoring Load Balancing on Virtual Servers, page 17-33 • Monitoring Load Balancing on Real Servers, page 17-37 Figure 17-6 Load Balancing Servers Performance Graphs ANM Group Dashboard The ANM Group Dashboard displays overall information of the ANM server. You can specify to view details for the ANM-created All Devices Group and for a user-defined ANM device group (see the “Monitoring Device Groups” section on page 17-23). You access the ANM Group Dashboard by choosing Monitor > Devices > Groups > All Devices > Dashboard. Figure 17-7 illustrates the individual components of the ANM Group Dashboard. Note The ANM software version that displays across the top of the window varies depending on your version of ANM. Figure 17-7 ANM Group Dashboard 17-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts To enhance your viewing of the monitoring information in the ANM Group Dashboard, you can perform the following actions: • Click and drag an individual dashboard pane to move it to another location within the ANM Group Dashboard. • Use the Collapse/Expand buttons at the top right side of each dashboard pane to minimize/maximize a pane within the ANM Group Dashboard. • Click the Remove button to remove a dashboard pane from the ANM Group Dashboard. Click the Bring Back Closed Dashboard Panes button at the top of the ANM Group Dashboard to open the closed dashboard pane. Note When you close any of the panes in a dashboard by clicking the Remove button, all of the headers in the other dashboard panes turn black to indicate that a pane has been closed. To return the dashboard panes to normal, click the Bring Back Closed Dashboard Panes button to reload the removed dashboard pane. • Click the Screen View (Full)/Screen View (Normal) buttons to display a larger (full) window view for the ACE Dashboard. Changes made to dashboard layout or pane selections are only applicable for the current session. Those changes are not maintained by ANM the next time you access the ANM Group Dashboard. The components of the individual ANM Group Dashboard panes are described in the following sections. • Managed Devices Table, page 17-17 • Context With Denied Resource Usage Detected Table, page 17-18 • ANM Group Device Configuration Summary Table, page 17-18 • Top 10 Current Resources Table, page 17-20 • Latest 5 Alarms Notifications Table, page 17-21 • Latest 5 Critical Events Table, page 17-21 • Contexts Performance Overview Graph, page 17-22 Managed Devices Table The Managed Devices table displays the total count of devices in the selected ANM device group and the count based on the state (Up or Down) of the imported ACE modules, ACE appliances, CSM, GSS, and CSS devices. The data shown in this table are collected during device discovery as well as during periodic monitor polling. The state of the individual device is identified from its XML connectivity and SNMP status (whichever is applicable). The most recent information is used to identify device status. Click the Device Details hyperlink to view a popup window containing the following device information: • Device Name—Name of the device managed by ANM. • State—Operational state of the device (Up or Down). If the State is Down, ANM displays whether the state has been detected through SNMP or XML. • Device Type—Device type assigned to the imported device by ANM (for example, ACE v 2.0). • # of VCs—Number of configured ACE virtual contexts, including the Admin context and configured user contexts. This value is only applicable for the ACE module and ACE appliance. 17-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts • Last Polled Time—Date and time of the last time that ANM polled the device to display the current values. The data shown in this table is collected during device discovery as well as during periodic monitor polling. The timestamp shown in the status bar indicates a varying poll time; that is, different virtual contexts were polled and the contexts had different time stamps. The earliest time stamp of the polled virtual contexts is displayed in the status bar. Hyperlinks in the popup window allow you to access the individual ACE Device Dashboard for more details (see the “ACE Dashboard” section on page 17-5). Context With Denied Resource Usage Detected Table The Context With Denied Resource Usage Detected table lists all contexts for which the resource request is denied after reaching the maximum limit. An increase in the deny count (that is, the deny rate) will result in the relevant context resource type to appear in this table. This data is collected by ANM by using the ACE show resource usage CLI command. This table includes the following information: • Context—Name of the configured context that contains a denied resource. • Resource Type—Type of system resource in the context. • Denies/Second—Number of denied resources (per second) as a result of oversubscription or resource depletion. • Total Deny Count—Number of denied uses of the resource since the resource statistics were last cleared. • Last Polled Count—Date and time of the last time that ANM polled the device to display the current values. Note This information is collected from the following MIBs: crlResourceLimitReqsDeniedCount and crlRateLimitResourceReqsDeniedCount. A hyperlink allows you to access to Resource Usage monitoring page to view a detailed list of resources used and denied counts (see the “Monitoring Resource Usage” section on page 17-26). ANM Group Device Configuration Summary Table The Device Configuration Summary table displays the following information: • Virtual Servers—(ACE only) Total count of virtual servers configured in all contexts and the count of virtual servers that are in the In Service and Out of Service state. ANM also identifies virtual servers that have a Status Not Available state (due to polled failing, polled disable, and so on) and have a Status Not Supported state (due to a lack of ACE SNMP support). A hyperlink enables you to view load balancing virtual server monitoring information based on the identified state (see the “Monitoring Load Balancing on Virtual Servers” section on page 17-33). For example, if you click the In Service hyperlink, you will see only the virtual servers that are currently in service. • Real Servers—(ACE only) Total count of real servers configured in all contexts and the count of real servers that are in In Service and Out of Service. A hyperlink enables you to view load balancing real server monitoring information based on the identified state (see the “Monitoring Load Balancing on Real Servers” section on page 17-37). For example, if you click the In Service hyperlink, you will see only the real servers that are currently in service. 17-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts • Probes—(ACE only) Total count of probes configured in all contexts and the count of probes that are in the In Service and Out of Service state. A hyperlink enables you to view load balancing probe monitoring information based on the identified state (see the “Monitoring Load Balancing on Probes” section on page 17-40). For example, if you click the In Service hyperlink, you will see only the probes that are currently in service. • Gigabit Ethernets—(ACE appliance only) Total count of Gigabit Ethernet physical interfaces configured on the ACE appliance based on their operational status of Up and Down. A hyperlink enables you to view traffic summary information based on the identified state (see the “Monitoring Traffic” section on page 17-30). For example, if you click the Up hyperlink, you will see only the Gigabit Ethernet physical interfaces that currently have an operational status of Up. • VLANs—(ACE only) Total count of VLANs configured and the count of VLANs based on operational status - Up and Down. A hyperlink enables you to view traffic summary information based on the identified state (see the “Monitoring Traffic” section on page 17-30). For example, if you click the Up hyperlink, you will see only the VLAN interfaces that currently have an operational status of Up. • Port Channels—(ACE appliance only) Total count of port channels configured on the ACE appliance based on their operational status of Up and Down. A hyperlink enables you to view traffic summary information based on the identified state (see the “Monitoring Traffic” section on page 17-30). For example, if you click the Up hyperlink, you will see only the port channels that currently have an operational status of Up. • BVIs—(ACE only) Total count of BVI interfaces and the count of BVI interfaces based on their operational status of Up and Down. A hyperlink enables you to view traffic summary information based on the identified state (see the “Monitoring Traffic” section on page 17-30). For example, if you click the Up hyperlink, you will see only the BVI interfaces that currently have an operational status of Up. • Certificates—(ACE only) Total count of SSL certificates and the count of SSL certificates that are valid, expired, or that are expiring within 30 days. A hyperlink accesses a popup window for you to view the SSL certificates list based on the selection, displaying the certificate name, device name, days to expire, expiration date, and the date it was evaluated for you to determine the days to expire. Certificates are considered expired it their expiration date is within the next day (rounded down the next day). A hyperlink in the device name allows you to navigate to the context-based SSL Certificate configuration page (see the “Using SSL Certificates” section on page 11-5). • GSS VIP Answers—(GSS only) Total number of configured VIP answers and their operating state, which is either Active or Other. The Other state can indicate any of the following states: Suspended, Operational Suspended, Unknown, Failed, or N/A. • GSS DNS Rules—(GSS only) Total number of configured DNS rules and their operating state, which is either Active or Other. The Other state can indicate either the Suspended or N/A states. This data is collected during discovery as well as during periodic monitoring polling. The timestamp shown in the status bar indicates a varying poll time; that is, different virtual contexts were polled and the contexts had different time stamps. The earliest time stamp of the polled virtual contexts is displayed in the status bar. All counts shown in the Device Configuration Summary table are based on the operational status of the monitored objects listed above. • Out Of Service—Indicates any status other than In Service (for example, Out Of Service, Failed, or Disabled). 17-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts • Status not available—Indicates that ANM was unable to poll the operational status of this object. The display of this operational status could be due to polling errors or the device was unreachable. Also, if a poll was recently initiated, this operational status could indicate that ANM is in the process of collecting data. • Status not supported—Indicates that the device does not have the capability to provide an operational status of this object. The display of this operational status could be due to missing SNMP instrumentation on the CSS or on earlier ACE devices. Top 10 Current Resources Table The Top 10 Resource Usage table (Figure 17-8) displays the top 10 resource types that have been evaluated for high resource utilization. The resource with highest utilization appears at the top. This data is collected by ANM by using the ACE show resource usage CLI command. Figure 17-8 Top 10 Current Resources Table—ANM Group Dashboard This table includes the following information: • Last Hour—Plot of high resource utilization during the past hour. • Resource Name—Type of system resource in the context. • Used By—Name of the virtual context that is placing the high demands on the resource. The Global Pool usage is critical in the setup where one or more contexts are configured to make use of the global pool once their reserved resource are depleted and resource is free in the global pool. In this situation, if the global pool is depleted, multiple contexts may be starved for resource. Note Contexts configured to make use of the global pool will not be evaluated for the Top 10 Resource Usage table. • Current Usage—Active concurrent instances or the current rate of the resource. • Average—Average value of resource usage (based on the last hour). 17-21 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts • Max.—Highest value of resource usage (based on the last hour). • Last Polled Time—Date and time of the last time that ANM polled the device to display the current values. Hyperlinks allow you to access the individual resource usage page for more details (see the “Monitoring Resource Usage” section on page 17-26). You can choose to show or hide the syslog buffer information that displays in the Top 10 Current Resources pane. You may want to hide this information because it will always show 100 percent after the buffer becomes full and starts to wrap (see the “Managing the Syslog Buffer Display in the All Devices Dashboard” section on page 18-66). Latest 5 Alarms Notifications Table The Latest 5 Alarm Notification table (Figure 17-9) displays the most recent five alarms for ANM along with a summary that explains the number of Critical, Major, Minor, and Informational alarms. This function interacts with the user-configured ANM alarm and threshold features (see the “Configuring Alarm Notifications on ANM” section on page 17-57). Figure 17-9 Latest 5 Alarms Notifications Table Note By default, no thresholds are configured in ANM. This table includes the following information: • Device—Name of the ACE device (appliance or module). • Severity— Severity level of the threshold, which can be one of the following: Info, Critical, Major, Minor. • Time—ANM timestamp at which the alarm occurred. • Category—Alarm name. • Details—Additional information about the alarm. A hyperlink allow you to view alarm notifications (see the “Displaying Alarm Notifications” section on page 17-65). Latest 5 Critical Events Table The Latest 5 Critical Events table display most recent five critical events that ANM receives from devices, including traps and high severity syslogs. ANM displays a summary that explains the number of Emergency, Alert, and Critical alarms. ANM displays critical events if the imported ACE device has been configured to send syslogs and traps to ANM. For information about configuring the ACE to send syslogs and traps, see either the Cisco Application Control Engine Module System Message Guide or the Cisco 4700 Series Application Control Engine Appliance System Message Guide. 17-22 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Using Dashboards to Monitor Devices and Virtual Contexts Figure 17-10 Latest 5 Critical Events Table The following details are shown in the Critical Events table: • Device/Context—ACE device name and virtual context where the event occurred. • Time—ANM timestamp at which the alarm occurred. • Type—Displays if the event appears in a syslog or a trap. • Details—Additional information about the critical event. A hyperlink allow you to view all events collected by ANM (see the “Monitoring Events” section on page 17-55). Contexts Performance Overview Graph The Contexts Performance Overview graph displays the top five virtual contexts based on user-configurable resource statistic such as ACL Memory, Bandwidth, and so on. You select the resource from the Select Statistics drop-down list. This data is collected by ANM by using the ACE show resource usage CLI command. Figure 17-11 Context Performance Graph To toggle the display of the top five virtual context chart in the Contexts Performance Overview graph: • Click View As Chart to display the resource statistic as a graph. • Click View As Grid to display the resource statistic as a numerical line grid. Note If you want to save the graph as a JPEG file for archive or other purposes, click the Show As Image button. When you mouse over the graph, the Image Toolbar appears. From the Image Toolbar, you can save the graph as a JPEG or send it in an email. You can also print the graph if desired. If you want to export object data to Microsoft Excel for archive or other purposes, click the Export to Excel link in the View As Grid object display. 17-23 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Device Groups Monitoring Device Groups You can display monitoring information for device groups that you create in Cisco License Manager (see Configuring User-Defined Groups, page 5-72). When you choose Monitor > Devices > Groups > device_group, all monitoring features that are supported on any of the devices in the device group are displayed. Because some monitoring features, for example, Application Acceleration, are not supported on all device types, you can click the following buttons at the bottom of the Monitor screens to change what information appears: • Show Polled Devices—By default, only the devices in the device group that support the specified feature are displayed. • Show All Devices—All devices in the device group are shown on the Monitoring results window, whether or not the feature you selected is supported on all the devices. For example, if you create a device group that contains an ACE appliance and several other different device types, then choose Monitor > Devices > Groups > device_group > Application Acceleration, by default, only the ACE appliance appears in the Application Acceleration window because the other device types in the device group do not support this feature. If you click Show Polled Devices, all devices in the device group are displayed. When viewing monitoring information, you might see N/A, which indicates that ACE Device Manager was not able to obtain the specified value. In addition, the monitoring window displays N/A in certain fields for which polling has not been executed. Related Topics • Setting Up Devices for Monitoring, page 17-2 • Device Monitoring Features, page 17-3 • Using Dashboards to Monitor Devices and Virtual Contexts, page 17-4 • Monitoring Devices, page 17-24 17-24 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Devices Monitoring Devices ANM monitors activities on ACE, CSS, and CSM devices. When you choose Monitor > Devices, you can view device information. Using SNMP and CLI commands, ANM gathers information about your devices and displays the information. Note If you get a warning message indicating that monitoring is not enabled or functioning, you must enable statistic monitoring on the device. See the “Setting Polling Parameters” section on page 17-46. Table 17-2 lists the features that appear under Monitor > Devices, depending on which device type you choose in the device tree. Related Topics • Using Dashboards to Monitor Devices and Virtual Contexts, page 17-4 • Monitoring the System, page 17-25 • Setting Up Devices for Monitoring, page 17-2 • Device Monitoring Features, page 17-3 • Setting Polling Parameters, page 17-46 • Configuring Historical Trend and Real Time Graphs for Devices, page 17-48 Table 17-2 Supported Features According to Device Type Device Type Selected in the Device Tree Supported Features Displayed Under Dashboard System View Resource Usage1 1. See the “Monitoring Resource Usage” section on page 17-26 for information about the options available under Resource Usage. Traffic Summary Load Balancing Application Acceleration Polling Settings ACE module X – X X X – – Admin context X – X X X – X User context X – X X X – X ACE appliance X – X X X X – Admin context X – X X X X X User context X – X X X X X CSS – X – X X2 2. CSS devices support Virtual Servers only, so you do not see the Load Balancing > Statistics menu option. – X CSM – X – – X – X GSS – – – – – – X Groups3 3. By default, all monitoring features that are supported on any of the devices in the device group appear when you select a device group. See the “Using Dashboards to Monitor Devices and Virtual Contexts” section on page 17-4 for more information about monitoring various device types within a device group. X – X X X X – 17-25 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring the System Monitoring the System Cisco License Manager provides a System View that displays device information and a general overview of your system as a whole. System View is available only for CSS and CSM devices. If a CSM has crashed, you can use the System View to find out when and why the crash occurred and display information that affects the module. The System View also displays High Availability (HA) information and licensing information. Note To monitor the ACE module or appliance, use the Device Dashboard function of ANM. See the “Using Dashboards to Monitor Devices and Virtual Contexts” section on page 17-4 for details. Note ANM does not support monitoring of chassis. Procedure Step 1 Choose Monitor > Devices > device > System View. The information that appears depends on what device type you select in the device tree. The System View displays the following information: • Device Information • High Availability • License Status • Module Information (for CSS devices only) Note You can sort the information displayed in the table by clicking on a column heading. Step 2 Click Poll Now to instruct ANM to poll the devices and display the current values. Step 3 Click OK when asked if you want to poll the devices for data now. Related Topics • Setting Up Devices for Monitoring, page 17-2 • Device Monitoring Features, page 17-3 • Setting Polling Parameters, page 17-46 • Monitoring Traffic, page 17-30 • Configuring Historical Trend and Real Time Graphs for Devices, page 17-48 17-26 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Resource Usage Monitoring Resource Usage ANM provides resource usage so that you can easily determine if you need to reallocate resources to a particular virtual context, view traffic usage in your contexts, or determine available usage for your contexts. There are three modes in which ANM provides resource usage for ACEs: • Virtual-context based resource usage—You must select a virtual context from the device tree to view resource usage specific to the context (see the “Monitoring Virtual Context Resource Usage” section on page 17-26). • System-wide resource usage—You must select an ACE module or appliance from the device tree to view system-wide information and to display the following options: – Connections—Displays traffic resource usage information. See the “Monitoring System Traffic Resource Usage” section on page 17-27. – Features—Displays non-connection based resource usage information. See the “Monitoring System Non-Connection Based Resource Usage” section on page 17-29. • Dashboard usage—You can select an ACE module, ACE appliance, or ACE virtual context from the device tree, and then choose Monitor > Devices > ACE > Dashboard. See the “Using Dashboards to Monitor Devices and Virtual Contexts” section on page 17-4. See the “Configuring Virtualization” chapter of either the Cisco Application Control Engine Module Virtualization Configuration Guide or the Cisco 4700 Series Application Control Engine Appliance Virtualization Configuration Guide for the maximum resource usage value for each attribute. Monitoring Virtual Context Resource Usage ANM displays resource usage for virtual contexts as explained in the following steps. See the “Configuring Virtualization” chapter of either the Cisco Application Control Engine Module Virtualization Configuration Guide or the Cisco 4700 Series Application Control Engine Appliance Virtualization Configuration Guide for the maximum resource usage value for each attribute. Procedure Step 1 Choose Monitor > Devices > virtual_context > Resource Usage. The information in Table 17-3 appears in the Resource Usage window. Table 17-3 Virtual Context Resource Usage Field Descriptions Field Description ACL Memory (Bytes) ACL memory usage Application Acceleration (Connections) Number of application acceleration connections. Note This field displays if you selected an ACE appliance in the device tree. Bandwidth (Bytes/Sec) Bandwidth in bytes per second. Concurrent Connections (Connections) Number of simultaneous connections. Connection Rate (Connections/Sec) Connections per second. 17-27 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Resource Usage Step 2 (Optional) Click Poll Now to instruct ANM to poll the devices and display the current values, and click OK when prompted if you want to poll the devices for data now. Step 3 (Optional) To display a historical trend graph of resource data for the virtual context, select up to four resources from the list and click Graph. The Resource Usage Graph appears (see the “Configuring Historical Trend and Real Time Graphs for Devices” section on page 17-48 for details). Related Topics • Monitoring System Traffic Resource Usage, page 17-27 • Monitoring System Non-Connection Based Resource Usage, page 17-29 • Configuring Historical Trend and Real Time Graphs for Devices, page 17-48 Monitoring System Traffic Resource Usage ANM displays system-wide traffic resource usage as explained in the following steps. See the “Configuring Virtualization” chapter of either the Cisco Application Control Engine Module Virtualization Configuration Guide or the Cisco 4700 Series Application Control Engine Appliance Virtualization Configuration Guide for the maximum resource usage value for each attribute. HTTP-comp rate HTTP compression rate. Note This field displays when you select one of the following device types from the device tree: An ACE appliance (any version) or an ACE module version A4(1.0) or later. Inspect Connection Rate (Connections/Sec) RTSP/FTP inspection connections per second. MAC Miss Rate (Connections/Sec) MAC miss traffic punted to CP packets per second. Management Connection Rate (Connections) Number of management connections. Management Traffic Rate (Connections/Sec) Management traffic bytes per second. Proxy Connection Rate (Connections) Proxy connections. Regular Expression Memory (Bytes) Regular expressions usage in bytes. SSL Connection Rate (Transactions/Sec) SSL (Secure Sockets Layer) connections per second. Sticky Entries Number of sticky table entries. Syslog Buffer Size (Bytes) Syslog message buffer size in bytes. Syslog Message Rate (Messages/Sec) Syslog messages transmitted in messages per seconds. Throughput (Bytes/Sec) Displays through-the-ACE traffic. This is a derived value (you cannot configure it directly) and it is equal to the bandwidth rate minus the mgmt-traffic rate for the 1-Gbps and 2-Gbps licenses. Translation Entries Current number of network and port address translations. Table 17-3 Virtual Context Resource Usage Field Descriptions (continued) Field Description 17-28 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Resource Usage Note You must select an ACE module or appliance from the device tree to view system-wide traffic resource usage information as shown in the following steps. Procedure Step 1 Choose Monitor > Devices > ACE > Resource Usage > Connections. The current resource usage information appears as shown in Table 17-4. Note There might be a slight delay because the resource usage information is gathered in real-time. Note If any of the percentages that display in the Resource Usage Connections table exceed 100 percent, this is an indication that a license on the ACE was recently installed or uninstalled using either ANM or the CLI. To correct the display problem, manually synchronize the Admin context of the ACE with the CLI (see the “Synchronizing Virtual Context Configurations” section on page 6-105). Step 2 Click Poll Now to instruct ANM to poll the devices and display the current values. Table 17-4 Resource Usage Connections Field Descriptions Field Description Context Name of the virtual context Conc. Conn. % Number of simultaneous connections Mgmt. Conn. % Number of management connections Proxy Conn. % Proxy connections Bandwidth (Bytes/S) % Bandwidth in bytes per second Throughput (Bytes/S) Note This field appears when you select an ACE in the device tree. Throughput in bytes per second Conn. Rate (Conn./S) % Connections per second SSL Conn. Rate (Trans./S) % SSL (Secure Sockets Layer) connections per second Mgmt. Traffic Rate (Conn./S) % Management traffic connections per second MAC Miss Rate (Conn./S) % MAC miss traffic punted to CP packets per second Insp. Conn. Rate (Conn./S) % RTSP/FTP inspection connections per second App. Acc. Conn. % Number of application acceleration connections. Note This field appears when you select an ACE appliance in the device tree. HTTP-Comp Rate % HTTP compression rate. Note This field appears when you select one of the following device types from the device tree: An ACE appliance (any version) or an ACE module version A4(1.0) or later. 17-29 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Resource Usage Step 3 Click OK when asked if you want to poll the devices for data now. Related Topics • Monitoring Virtual Context Resource Usage, page 17-26 • Monitoring System Non-Connection Based Resource Usage, page 17-29 Monitoring System Non-Connection Based Resource Usage ANM displays system-wide, non-connection-based resource usage as explained in the following steps. Note You must select an ACE module or appliance from the device tree to view the non-connection based resource usage information as shown in the following steps. Step 1 Choose Monitor > Devices > ACE > Resource Usage > Features. The current resource usage information appears shown in Table 17-5. Note There might be a slight delay because the resource usage information is gathered real-time. Step 2 Click Poll Now to instruct ANM to poll the devices and display the current values. Step 3 Click OK when asked if you want to poll the devices for data now. Related Topics • Monitoring Virtual Context Resource Usage, page 17-26 • Monitoring System Traffic Resource Usage, page 17-27 • Configuring Historical Trend and Real Time Graphs for Devices, page 17-48 Table 17-5 Resource Usage Features Field Descriptions Field Description Context Name of the virtual context Translation Entries % Current number of network and port address translations ACL Memory (Bytes) % ACL memory usage in bytes RegEx Memory (Bytes) % Regular expressions memory usage in bytes Syslog Buffer Size (Bytes) % Syslog message buffer size in bytes Syslog Message Rate (Messages/S) % Syslog messages per second 17-30 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Traffic Monitoring Traffic ANM determines traffic information for your ACE module, ACE appliance, or CSS devices by calculating the delta traffic values since the last polling cycle and displays the resulting values. You can view traffic summary information as shown in the steps below. Note To get traffic data polled directly from a device, click on an interface name that appears in the Interface column. See Displaying Device-Specific Traffic Data, page 17-31. Procedure Step 1 Choose Monitor > Devices > device > Traffic Summary. The information shown in Table 17-6 appears in the Traffic Summary page. Note You can click on any column heading to sort the table by that column. Table 17-6 Traffic Summary Fields Field Description Device Fully-qualified device name. This field does not appear for CSS devices. Interface Name of the interface. Click the interface hyperlink to get traffic data polled directly from the device as shown in Table 17-7. Admin Status User-specified status of the device, which can be one of the following states: • Up • Down • Testing, which indicates that no operational packets can be passed. Operational Status Current operational status of the device, which can be one of the following states: • Up • Down • Testing, which indicates that no operational packets can be passed • Unknown • Dormant, which indicates the interface is waiting for external actions (such as a serial line waiting for an incoming connection) • Not present, which indicates the interface has missing components Packets In / Sec This field appears for ACEs only. Per second, the number of packets delivered by this sub-layer to a higher (sub-)layer, which were not addressed to a multicast or broadcast address at this sub-layer. Packets Out / Sec This field appears for ACEs only. Per second, the total number of packets that higher-level protocol requested be transmitted, and which were not addressed to a multicast or broadcast address at this sub-layer, including those that were discarded or not sent. 17-31 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Traffic Step 2 (Optional) Click Poll Now to instruct ANM to poll the devices and display the current values and click OK when prompted if you want to poll the devices for data now. Step 3 (Optional) To display a historical trend graph of traffic information, select up to four interfaces from the list and click Graph. The Resource Usage Graph appears (see the “Configuring Historical Trend and Real Time Graphs for Devices” section on page 17-48 for details). Step 4 (Optional) Choose a device, and click Details to see specific traffic information for the selected device (see the “Displaying Device-Specific Traffic Data” section on page 17-31). Related Topic • Displaying Device-Specific Traffic Data, page 17-31 • Configuring Historical Trend and Real Time Graphs for Devices, page 17-48 Displaying Device-Specific Traffic Data You can display device-specific traffic data. Procedure Step 1 Choose Monitor > Devices > device > Traffic Summary. Hyperlinked device names appear in the Interface column. Step 2 Choose a hyperlinked device name. The Traffic Summary Details window appears. The information shown in Table 17-7 appears. Note You can click on a column heading to sort the table by that column. Bytes In / Sec Number of octets received, including framing characters, per second. Bytes Out / Sec Number of octets per second transmitted out of the interface, including framing characters. Errors In / Sec Number of inbound packets discarded per second because they contained errors or because of an unknown or unsupported protocol. Errors Out / Sec Number of outbound packets discarded per second because they contained errors or because of an unknown or unsupported protocol. Last Polled Date and time of the last time that ANM polled the device to display the current values. This field appears if viewing traffic summary data at a device level or at a device group level in the device tree. Note The Last Polled time stamp appears in the table heading if viewing traffic summary data at a virtual context level. Table 17-6 Traffic Summary Fields (continued) Field Description 17-32 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Traffic Step 3 Click OK to close the window and return to the Traffic Summary window. Related Topic Monitoring Traffic, page 17-30 Table 17-7 Traffic Summary Details Window Description Device Type Field Description ACE and CSS Bytes In Total number of octets received on the interface, including framing characters Bytes Out Total number of octets transmitted out of the interface, including framing characters Discarded Inbound Packets Number of inbound packets which were discarded even though no errors were detected to prevent their being delivered to a higher-layer protocol Discarded Outbound Packets Number of outbound packets which were discarded even though no errors were detected to prevent their being transmitted Inbound Packet Errors Total number of inbound packet errors Inbound Packets with Unknown Protocol Total number of packets received via the interface which were discarded because of an unknown or unsupported protocol Outbound Packet Errors Total number of outbound packet errors Packets In Number of packets delivered by this sub-layer to a higher (sub-)layer, which were not addressed to a multicast or broadcast address at this sub-layer. Packets Out Number of packets that higher-level protocols requested be transmitted, and which were not addressed to a multicast or broadcast address at this sub-layer, including those that were discarded or not sent. CSS only Active TCP Current number of active TCP flows on the interface Active UDP Current number of active UDP flows on the interface FCB Count Number of unused fastpath flow control blocks for the interface TCP Average Five second moving average of TCP flows per second on the interface TCP Current Number of new TCP flows within last second on the interface TCP High Maximum number of TCP flows in any one second interval on the interface TCP Total Total TCP flows on the interface UDP Average Five second moving average of UCP flows per second on the interface UDP Current Number of new UDP flows within last second on the interface UDP High Maximum number of UDP flows in any one second interval on the interface UDP Total Total UDP flows on the interface 17-33 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Load Balancing Monitoring Load Balancing ANM monitors load balancing and allows you to view the information associated with virtual servers, real servers, probes, and load balancing statistics. This section includes the following topics: • Monitoring Load Balancing on Virtual Servers, page 17-33 • Monitoring Load Balancing on Real Servers, page 17-37 • Monitoring Load Balancing on Probes, page 17-40 • Monitoring Load Balancing Statistics, page 17-41 Monitoring Load Balancing on Virtual Servers ANM monitors load balancing and allows you to display the associated virtual server information as shown in the following steps. Note You can display additional load-balancing information about real servers, such as the number of servers that are functioning properly, and probes, such as viewing if an excessing number of probes are failing, by clicking the hyperlink in the respective columns in Table 17-8. Procedure Step 1 Choose Monitor > Devices > device > Load Balancing > Virtual Servers. Depending on the device type you selected in the device tree, the information described in Table 17-8 appears. Note For the ACE appliance and the ACE module running A2(3.0), click the Advanced Editing Mode button to show/hide additional load balancing virtual server monitoring fields. Note If you select a CSS device from the device tree, the navigation path does not include Load Balancing; the path is Monitor > Devices > CSS_device > Virtual Servers. 17-34 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Load Balancing Table 17-8 Load Balancing Virtual Server Monitoring Information Device Type Field Description All Virtual Server Name of the virtual server. Note If a virtual server is associated with primary and backup server farms, two entries appear in the table: One for the primary server farm and one for the backup server farm. To view statistics for a selected virtual server, click the virtual server hyperlink. The Virtual Server Details popup window appears containing the individual statistic, associated counter value, and a description of the statistic. Click OK to close the popup window. IP Address IP address of the virtual server. Port Port to be used for the specified protocol. # Rservers Up Number of servers up/Number of total servers configured. Note You can click on the hyperlink in this column to view statistics for the real servers configured for the specified virtual server. See the “Monitoring Load Balancing on Real Servers” section on page 17-37. ACEs, CSM # Probes Failed For the ACE, this field displays Number of probes failed/Number of probes configured. For the CSM, this field displays Number of probes failed. Note For an ACE, you can click on the number displayed to view the statistics for the probes configured for the specified virtual server. See the “Monitoring Load Balancing on Probes” section on page 17-40. Operational Status The state of the server, which can be: • Inservice—Indicates the server is in service. • Out of Service—Indicates the server is out of service. Current Connections Current number of connections. Conns/Sec. Number of connections per second that the device receives. 17-35 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Load Balancing ACEs only Device Fully-qualified device name. Protocol Protocol the virtual server supports, which can be: • Any—Indicates the virtual server is to accept connections using any IP protocol. • TCP—Indicates that the virtual server is to accept connections that use TCP. • UDP—Indicates that the virtual server is to accept connections that use UDP. Service Policy Policy map applied to the device. DWS Operating state of the Dynamic Workload Scaling feature for the associated server farm, which can be: • N/A—Not applicable; the virtual server’s server farm is not configured for Dynamic Workload Scaling. • Local—The server farm is configured for Dynamic Workload Scaling, but the ACE is load-balancing traffic to the local VM Controller VMs only. • Expanded—The server farm is configured for Dynamic Workload Scaling and the ACE is sending traffic to the local and remote VM Controller VMs. Dropped Conns/Sec. Number of connections per second that the ACE discarded. Server Farm Name of the server farm associated with the virtual server. Action Indicates if the device is functioning as a primary server (Primary) or a backup server (Backup). Algorithm Type of predictor algorithm specified on the load balancer, which can be: • Roundrobin • Leastconn • Hash URL • Hash Address • Hash Cookie • Hash Header Last Polled Date and time of the last time that ANM polled the device to display the current values. This field appears if viewing virtual server data at a device level or at a device group level in the device tree. Note The Last Polled time stamp appears in the table heading if viewing virtual server data at a virtual context level. Table 17-8 Load Balancing Virtual Server Monitoring Information (continued) Device Type Field Description 17-36 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Load Balancing Step 2 (Optional) Use the display toggle button ( ) located above the table to control which virtual servers ANM displays as follows: • Show ANM Recognized Virtual Servers—Displays only virtual servers that match ANM’s virtual server definition (see the “Virtual Server Configuration and ANM” section on page 7-2). • Show All Virtual Servers—Displays virtual servers that match ANM’s virtual server definition and those that do not match this definition but that ANM can recognize as virtual servers using SNMP polling. Note The display toggle button displays only when you have the “Display All Virtual Servers in Monitoring & Operations page” advanced setting feature enabled (see the “Managing the Display of Virtual Servers in the Operations and Monitoring Windows” section on page 18-66). Step 3 (Optional) Use the function buttons described in Table 17-9 to update the virtual server information displayed, view graph information, or view the topology map. ACE appliance, ACE module running A2(3.0) (Advanced Editing Mode button) Client Packets/Sec Number of packets per second received from the client. Client Bytes/Sec Number of bytes per second received from the client. Server Packets/Sec Number of packets per second received from the server. Server Bytes/Sec Number of bytes per second received from the server. Drops/Sec Conn Rate Limit Number of active connection drops per second based on the connection rate limit of the real server Drops/Sec Max Conn Limit Number of active connection drops per second based on the maximum allowable number of active connections to a real server. ACEs, CSS, CSM Admin Status User-specified status of the virtual server, which can be: • In Service—Indicates the server is in service. • Out of Service—Indicates the server is out of service. Table 17-8 Load Balancing Virtual Server Monitoring Information (continued) Device Type Field Description 17-37 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Load Balancing Related Topics • Monitoring Load Balancing on Real Servers, page 17-37 • Monitoring Load Balancing on Probes, page 17-40 • Configuring Historical Trend and Real Time Graphs for Devices, page 17-48 Monitoring Load Balancing on Real Servers ANM monitors load balancing and allows you to view the associated real server information. Procedure Step 1 Choose Monitor > Devices > device > Load Balancing > Real Servers. Depending on the device type you selected in the device tree, the information described in Table 17-10 appears. Table 17-9 Virtual Server Monitoring Window Function Buttons Function Button Description Poll Now Instructs ANM to poll the devices and display the current values. Choose one or more virtual servers and click Poll Now. Graph Displays a historical trend graph of virtual server information for a specific virtual server. Choose 1 to 4 virtual servers and click Graph. For more information, see the “Configuring Historical Trend and Real Time Graphs for Devices” section on page 17-48. Topology Displays the network topology map for a specific virtual server. Choose a virtual server and click Topology. Note The topology map feature is not available when the Virtual Server table is set to Show All Virtual Servers. Use the display toggle button ( ) to ensure that the Virtual Servers table is set to Show ANM Recognized Virtual Servers (see Step 2). The ANM Topology window appears, displaying the virtual server and associated network nodes. For information about using the topology map, see the “Displaying Network Topology Maps” section on page 17-68. 17-38 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Load Balancing Table 17-10 Load Balancing Real Server Monitoring Information Device Type Field Description All Real Server Name of the real server. To view statistics for a selected real server, click the real server hyperlink. The Real Server Details popup window appears containing the individual statistic, associated counter value, and a description of the statistic. Click OK to close the popup window. IP Address IP address of the real server. This field appears only for real servers specified as hosts. Port Port number used for the server port address translation (PAT). Admin Status The specified state of the server, which can be: • Inservice—Indicates the server is in service. • Out of Service—Indicates the server is out of service. • In Service Standby—Indicates the server is a backup server and remains inactive unless the primary server fails. If the primary server fails, the backup server becomes active and starts accepting connections. Operational Status The state of the server, which can be: • Inservice—Indicates the server is in service. • Out of Service—Indicates the server is out of service. • Inservice Standby—Indicates the server is a backup server and remains inactive unless the primary server fails. If the primary server fails, the backup server becomes active and starts accepting connections. • Probe Failed—Indicates that ANM did not receive a response to a health probe that it sent to the server. VM Indicator that the real server is, or is not, a VMware virtual machine as follows: • – (dash)—The real server is not a VMware VM. • Yes—The real server is a VMware VM. To view details about the VM, click Yes. The Virtual Machine Details popup window appears and provides the following information about the VM: – Full path—Full path to the VM. – DNS Name—DNS name of the VM. – IP Address—VM IP address. – State—Operating state of the VM (for example, poweredOn). – Guest OS—Guest operating system (for example, Red Hat Enterprise Linux 5 (32-bit)). – Host—Host IP address. – Memory (MB)—Amount of memory. – CPU (MHz)—CPU frequency. – Triggered Alarms—Number of recorded triggered alarm conditions. Click OK to close the Virtual Machine Details popup window. Weight Weight assigned to the real server. 17-39 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Load Balancing Step 2 (Optional) Use the function buttons described in Table 17-11 to update or change the real server information displayed. ACE, CSM Server Farm Primary server farm to use for load balancing. Current Connections Number of current connections to this server. If this field indicates N/A, the database does not have any information about current connections. If this field is 0, the database received an SNMP response of 0. Connections Rate Connections per second. Dropped Connections Rate Dropped connections per second. ACEs Only Device Fully qualified device name. Locality Field that pertains to the ACE module A4(2.0), ACE appliance A4(2.0), and later releases of either device type only. Locality also requires that you have the ACE configured for Dynamic Workload Scaling (see the “Configuring Dynamic Workload Scaling” section on page 8-26). Possible values for real server locality are as follows: • N/A—Not available; the ACE cannot determine the real server location (local or remote). A possible cause for this issue is that Dynamic Workload Scaling is not configured correctly. • Local—The real server is located in the local network. • Remote—The real server is located in the remote network. The ACE bursts traffic to this server when the local real server's CPU and/or memory usage reaches the specified maximum threshold value. Last Polled Date and time of the last time that ANM polled the device to display the current values. This field appears if viewing virtual server data at a device level or at a device group level in the device tree. Note The Last Polled time stamp appears in the table heading if viewing virtual server data at a virtual context level. CSSs Only Total Connections Total number of connections. Table 17-10 Load Balancing Real Server Monitoring Information (continued) Device Type Field Description 17-40 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Load Balancing Related Topics • Monitoring Load Balancing, page 17-33 • Monitoring Load Balancing on Probes, page 17-40 • Configuring Historical Trend and Real Time Graphs for Devices, page 17-48 Monitoring Load Balancing on Probes To check the health and availability of a real server, the ACE periodically sends a probe to the real server. If you notice an excessive number of probes failing, you can view the monitoring information as shown in the following steps. Procedure Step 1 Choose Monitor > Devices > ACE > Load Balancing > Probes. The probe information described in Table 17-12 appears. Table 17-11 Real Server Monitoring Window Function Buttons Function Button Description Poll Now Instructs ANM to poll the devices and display the current values. Choose one or more real servers and click Poll Now. Click OK when asked if you want to poll the devices for data now. Graph Displays a historical trend graph of real server information for the specified real servers. Choose 1 to 4 real servers and click Graph. Choosing multiple real servers allows you to compare information. For more information, see the “Configuring Historical Trend and Real Time Graphs for Devices” section on page 17-48. Topology Displays the network topology map for the specified real server. Choose a real server and click Topology. The ANM Topology window appears, displaying the real server and associated network nodes. For information about using the topology map, see the “Displaying Network Topology Maps” section on page 17-68. 17-41 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Load Balancing Step 2 (Optional) Click Poll Now to instruct ANM to poll the devices and display the current values. Step 3 (Optional) To view the details associated with a specific probe, choose a probe from the list and click Details. The show probe probe_name detail CLI command output appears in a popup window. Step 4 Click OK when asked if you want to poll the devices for data now. Related Topics • Monitoring Load Balancing, page 17-33 • Monitoring Load Balancing Statistics, page 17-41 • Configuring Historical Trend and Real Time Graphs for Devices, page 17-48 Monitoring Load Balancing Statistics You can monitor load balancing on your ACE and CSM devices as shown in the following procedure. Table 17-12 Load Balancing Probes Monitoring Information Field Description Device Name of the ACE managed by ANM. Probe Name of the probe. To view statistics for a selected probe, click the probe hyperlink. The Probe Details popup window appears containing the following probe statistics: • Failed Probes—Total number of failed probes. • Health of Probes—Health of the probe. Possible values are PASSED or FAILED. • Probes Passed—Total number of passed probes. Click OK to close the Probe Details popup window. Type Type of probe. For a complete list of probe types and their descriptions, see Table 8-11. Real Server Name of the real server that the probe is associated with. Server Farm Name of the server farm that the probe is associated with. Port Port number that the probe uses. By default, the probe uses the port number based on its type. Probe IP Address Destination or source address for the probe. Probed Port Source of the probe's port number. Probe Health Health of the probe. Possible values are PASSED or FAILED. Passed Rate Rate of passed probes Failed Rate Rate of failed probes Last Polled Time stamp for the last probe. This field appears if viewing probe data at a device level or at a device group level in the device tree. Note The Last Polled time stamp appears in the table heading if viewing probe data at a virtual context level. 17-42 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Load Balancing Procedure Step 1 Choose Monitor > Devices > device > Load Balancing > Statistics. The Load Balancing Statistics Monitoring Information window displays the information described in Table 17-13. Step 2 (Optional) Click Poll Now to instruct ANM to poll the devices and display the current values and click OK when prompted if you want to poll the devices for data now. Step 3 (Optional) To display a historical trend graph of load balancing statistics, select up to four objects from the list and click Graph. The Resource Usage Graph appears (see the “Configuring Historical Trend and Real Time Graphs for Devices” section on page 17-48 for details). Related Topic • Testing Connectivity, page 17-71 • Configuring Historical Trend and Real Time Graphs for Devices, page 17-48 Table 17-13 Load Balancing Statistics Monitoring Information Device Type Field Description ACEs only Device Name of the device L4 Policy Connections Number of Layer 4 policy connections L7 Policy Connections Number of Layer 7 policy connections Failed Connections Number of failed connections Dropped L4 Policy Connections Number of dropped Layer 4 policy connections Dropped L7 Policy Connections Number of dropped Layer 7 policy connections Rejected Connections Due To No Policy Match Number of connections rejected because they did not match policies Rejected Connections Due To ACL Deny Number of connections rejected due to ACL parameters Rejected Connections Due To L7 Config Changes Number of rejected connections due to Layer 7 configuration changes Connection Timed Out Number of times the connection timed out. Last Polled Date and time of the last time that ANM polled the device to display the current values. CSM only Statistic Name of the monitored statistic. Value Statistic value. Rate Statistic rate. Description Explanation of the monitored CSM statistic. 17-43 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Application Acceleration Monitoring Application Acceleration If you have configured application acceleration functions on the ACE, you can monitor the optimization statistics as shown in the following steps. Step 1 Choose Monitor > Devices > device > Application Acceleration. The Application Acceleration information appears as shown in Table 17-14. Note For connection-based syslogs, the following additional parameters are displayed: Source IP, Source Port, Destination IP, Destination Port, and Protocol Information. This allows you to sort and filter on these fields if desired. . Table 17-14 Application Acceleration Monitoring View Field Statistic Description Condenser Information Total HTTP Unoptimized Requests Received Total number of end-user HTTP request the condenser has received that cannot be optimized Accumulated Bytes Received Accumulated size (in bytes) of each end-user requested object Total Responses in Bytes Accumulated size (in bytes) of responses, both for condensable and non-condensable end-user HTTP requests Total Abandons of Delta Optimization Total number of abandons of delta optimization requests Cacheable Objects Statistics Total Objects Served from Cache Total number of cacheable objects served from the cache, excluding the not-modified replies Accumulated Bytes Served Accumulated size (in bytes) of the cacheable objects served from the cache, excluding not-modified replies Total Objects Not Found in Cache Total number of cacheable objects not found in the cache Accumulated Bytes Not Found Accumulated size (in bytes) of the cacheable objects not found in the cache Total IMS Requests for Valid Cache Total number of IMS requests for valid copies of objects in the cache Total Missed IMS Requests Total number of IMS request for objects that either do not exist or are stale in the cache Total Non-Cacheable Object Requests Total number of non-cacheable object requests Total Requests with Not Modified Responses Total number of requests for stale objects that have the response from the origin server as not modified 17-44 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Displaying the Polling Status of All Managed Objects Step 2 Click Poll Now to instruct ANM to poll the devices and display the current values. Step 3 Click OK when asked if you want to poll the devices for data now. Related Topics Configuring Application Acceleration and Optimization, page 15-1 Displaying the Polling Status of All Managed Objects You can display the polling status of the following objects that ANM manages: ACE virtual contexts and CSS, CSM, and GSS devices. Because ACE devices are partitioned into virtual contexts that can be polled individually, the polling status window displays the status of each ACE virtual context. From the polling status window, you have the option to restart polling to a virtual context or device that currently has polling disabled. Guidelines and Restrictions The time it takes the Polling Status window to reflect global changes that you make to the polling status or polling interval varies depending on the number of managed objects being polled. For information about making global polling changes, see the “Enabling Polling on All Devices” section on page 17-47. Procedure Step 1 Choose Monitor > Settings > Polling Status. The Polling Status window appears. Flash Forward Objects Statistics Successful Transformations Total number of successful transformations for FlashForward objects Unsuccessful Transformations Total number of unsuccessful transformations for FlashForward objects Total HTTP Requests Total number of HTTP requests (excluding the IMS requests) for the transformed FlashForward objects Total IMS Requests Total number of IMS requests for transformed FlashForward objects Table 17-14 Application Acceleration Monitoring View (continued) Field Statistic Description Table 17-15 Polling Status Window Field Description Name Name of the object polled. For all ACE devices, the context names associated with each ACE. For all other object types, such as a GSS, the device name. Type Type of object polled. The type will either be Virtual Context to indicate an ACE virtual context or a specific device type, such as GSS. 17-45 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Displaying the Polling Status of All Managed Objects Polling Config Polling configuration operational state: Enabled or Disabled. For more information, see the “Setting Polling Parameters” section on page 17-46. Polling Interval Frequency at which ANM polls the object. Polling Status Current polling status of the managed object: • Missing SNMP Credentials—SNMP credentials are not configured for this object; statistics are not collected. Add SNMPv2c credentials to fix this error. • Not Polled—SNMP polling has not started. For a virtual context, this problem might occur when the virtual context is first created from ANM and the SNMP credentials are not configured. Add SNMPv2c credentials to fix this error. • Polling Failed—SNMP polling failed due to some internal error. Try restarting polling to enable SNMP collection again. • Polling Started—No action is required. Everything is working properly. Polling states will display activity. • Polling Timed Out—SNMP polling has timed out. This problem might occur if the wrong credentials were configured or might be caused by an internal error (such as SNMP was configured incorrectly or the destination is not reachable). Verify that SNMP credentials are correct. If the problem persists, restart polling to enable SNMP collection again. • Unknown—SNMP polling is not working due to one of the above-mentioned conditions. Check the SNMPv2c credential configuration. Last Polled Time Time stamp of the last time ANM polled the object. CLI Sync Status (ACE virtual contexts only) Administrative configuration status of the context as follows: • Import Failed—The context did not import successfully. This problem could have occurred when the device was added to ANM or when the context was synchronized. Synchronize the context so that you can manage it (Config > Devices > ACE > context > Sync). • OK—The context is synchronized with the ACE CLI. • Out of Sync—The context is managed by ANM but the configuration for the context on the device differs from the configuration managed by ANM. For information on synchronizing contexts, see the “Synchronizing Virtual Context Configurations” section on page 6-105. • Unprovisioned—The context has been removed from the ACE using the CLI but has not been removed from ANM. To remove unprovisioned contexts, synchronize the associated Admin context. For all polled objects that are not virtual contexts, the value N/A appears in this column because ANM does not support auto synchronization for the CSS, CSM, or GSS devices. Last CLI Sync Status Change (ACE virtual contexts only) Time stamp of the last CLI synchronization with ANM. For all polled objects that are not virtual contexts, the value N/A appears in this column because ANM does not support auto synchronization for the CSS, CSM, or GSS devices. Table 17-15 Polling Status Window (continued) Field Description 17-46 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Setting Polling Parameters Step 2 (Optional) To restart polling of an object, check the check box associated with the object and click Restart Polling. Related Topics Setting Polling Parameters, page 17-46 Setting Polling Parameters You set polling parameters differently depending on the device type: • ACE devices—You set polling on specific virtual contexts or configure global polling. • CSM devices—You specify a single polling setting used by ANM. • CSS devices—You specify a single polling setting used by ANM. • GSS devices—You specify a single polling setting used by ANM for VIP Answers operation and configuration states and DNS Rules configuration states. When you choose Monitoring, the monitoring data for your devices is extracted from cache. The Monitoring window refreshes every two minutes as new monitoring data is gathered. When you import a context or device into ANM, the polling interval is set to 5 minutes by default. You can modify the polling parameter on each device (see the “Enabling Polling on Specific Devices” section on page 17-46) or you can modify the global parameter polling setting to change the polling parameters for all devices (see the “Enabling Polling on All Devices” section on page 17-47). This section includes the following topics: • Enabling Polling on All Devices, page 17-47 • Disabling Polling on Specific Devices, page 17-47 • Enabling Polling on Specific Devices, page 17-46 • Disabling Polling on All Devices, page 17-48 Enabling Polling on Specific Devices Procedure Step 1 Choose Monitor > Devices > context > Polling Settings. Step 2 In the Polling Stats field, click Enable. Step 3 From the Background Polling Interval field, choose a polling interval. Step 4 Click Deploy Now to save and apply the polling parameters. Related Topics • Disabling Polling on Specific Devices, page 17-47 • Enabling Polling on All Devices, page 17-47 • Disabling Polling on All Devices, page 17-48 17-47 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Setting Polling Parameters • Displaying the Polling Status of All Managed Objects, page 17-44 Disabling Polling on Specific Devices Procedure Step 1 Choose Monitor > Devices > context > Polling Settings. Step 2 In the Polling Stats field, click Disable. Step 3 Click Deploy Now to disable polling. Related Topics • Enabling Polling on Specific Devices, page 17-46 • Enabling Polling on All Devices, page 17-47 • Disabling Polling on All Devices, page 17-48 • Displaying the Polling Status of All Managed Objects, page 17-44 Enabling Polling on All Devices You can enable polling and set the polling interval for all devices as shown in the following procedure. Guidelines and Restrictions This topic includes the following guidelines and restrictions: • Currently this feature is available for any user under the ANM Inventory role task. When a user is assigned this task, global polling configuration changes made are applied to all devices, irrespective of the domains that are assigned for this user. • The time it takes the Polling Status window to reflect global changes that you make to the polling status or polling interval varies depending on the number of managed objects being polled. For information about viewing polling information, see the “Displaying the Polling Status of All Managed Objects” section on page 17-44. Procedure Step 1 Choose Monitor > Settings > Global Polling Configuration. Step 2 In the Polling Stats field, click Enable. Step 3 From the Background Polling Interval field, choose a polling interval. Step 4 Click OK to save and apply the polling parameters. Related Topics • Enabling Polling on Specific Devices, page 17-46 • Disabling Polling on Specific Devices, page 17-47 17-48 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Configuring Historical Trend and Real Time Graphs for Devices • Disabling Polling on All Devices, page 17-48 • Displaying the Polling Status of All Managed Objects, page 17-44 Disabling Polling on All Devices You can disable polling all devices as shown in the following steps. Procedure Step 1 Choose Monitor > Settings > Global Polling Configuration. Step 2 In the Polling Stats field, click Disable. Step 3 Click OK. Polling is disabled. Related Topics • Enabling Polling on Specific Devices, page 17-46 • Disabling Polling on Specific Devices, page 17-47 • Enabling Polling on All Devices, page 17-47 • Displaying the Polling Status of All Managed Objects, page 17-44 Configuring Historical Trend and Real Time Graphs for Devices ANM allows you to store historical data for a selected list of statistics calculated over the last hour, 2-hour, 4-hour, 8-hour, 24-hour, or month interval. You can view this historical data as a statistical graph from specific Monitor > Devices monitoring screens. For each monitoring page, default statistics are defined and the graph is drawn for the selected object(s) from the page. ANM also allows you to display real-time statistical information related to the selected monitoring window. Note All client browsers require that you enable Adobe Flash Player 9 to properly display the monitoring graphs provided in ANM. Historical graphs are available from the following Monitor > Device monitoring windows: • Traffic Summary window (CSS and ACE devices) • Load Balancing > Virtual Server window (CSM and ACE) • Load Balancing > Real Server window (CSM, CSS, and ACE devices) • Load Balancing > Statistics window (ACE and CSM devices) • Virtual Context-Based Resource Usage (ACE devices) In each monitoring view window, click the Graph button to view the Graph page. From this page, you can view up to a maximum of four individual graphs of object data. Tooltips appears within each graph to allow you to see the datapoint values used for plotting. 17-49 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Configuring Historical Trend and Real Time Graphs for Devices If you choose, you can overlay multiple objects for comparison on the same graph. Each graph grid provides a comma-separated list of select statistics. ANM supports a maximum of four lines per historical graph. The number of lines in a graph indicates the number of combinations of statistics and the objects (which can be a virtual server, real server, virtual context, and so on). For example, if you select two statistics and two real servers, then the number of possible combinations that can be displayed in a graph is four. Note The time displayed in all graphs is shown in ANM server time, not in client time. Procedure Step 1 Choose Monitor > Devices to view device information. Step 2 Choose the specific monitoring window from which you want to display historical data graphs for a selected list of items. Table 17-16 shows the different monitoring window types and how to select one. Step 3 Check the check boxes of up to four objects in the selected monitoring window that you want to view and click Graph. The graph window appears. ANM updates the monitoring window with the graph of the selected objects (see Figure 17-12). Note The ANM software version that displays across the top of the window varies depending on your version of ANM. Table 17-16 Selecting a Monitoring Window To Access.... Select... Resource Usage window Monitor > Devices > virtual_context > Resource Usage Traffic Summary window Monitor > Devices > Traffic Summary Virtual Servers window Monitor > Devices > Load Balancing > Virtual Servers Real Servers window Monitor > Devices > Load Balancing > Real Servers Statistics window Monitor > Devices > Load Balancing > Statistics 17-50 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Configuring Historical Trend and Real Time Graphs for Devices Figure 17-12 Displaying Historical Graphs Step 4 (Optional) To enhance your viewing of the graphs, use the Collapse/Expand buttons to minimize or maximize a graph in the monitoring window. Step 5 (Optional) Use the graphing tools described in Table 17-17 to modify the display. Table 17-17 Historical Graph Tools Tool Description Add Graph button Adds a graph to the selected monitoring window. View As Chart and View As Grid icons Toggles the display of an object graph in the monitoring window between a grid and a graph. The grid displays include the Export to Excel hyperlink that allows you to export object data to Microsoft Excel for archiving or other purposes. Show As Image icon Allows you to save the graph as a JPEG file for archiving or other purposes. When you mouse over the graph, the Image Toolbar appears. From the Image Toolbar, you can save the graph as a JPEG or send it in an e-mail. You can also print the graph if desired. 17-51 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Configuring Historical Trend and Real Time Graphs for Devices Select button (upper) Allows you to add one or more objects to a graph in the monitoring window to compare the performance of one object with its peer for the selected statistics. Do the following: a. In the graph that contains the object you want to replace, click the upper Select button. Note You cannot perform this function from the Resource Usage graph window, which contains only one Select button. This button is used for selecting multiple statistics (see Select button (lower)). The Objects Selector popup window appears. b. From the Objects Selector popup window, choose up to four objects and do one of the following: – Click OK to return to the graph window, which displays your selected objects. – Click Cancel to ignore any selections and return to the original graph. Select button (lower) To select multiple statistics for display in a graph in the monitoring window, perform the following steps: a. In the graph of the object that you want to add statistics, click the lower Select button within the graph. The Select Stats popup window appears. Note The Resource Usage graph window contains only one Select button; click this button. b. From the Select Stats popup window, choose the statistics to add to the graph. You can choose up to four statistics for display in a graph and the object statistics must be of the same unit of measure (for example, bytes/sec.). The selected statistics appear in the existing object graph in the monitoring window. Do one of the following: – Click OK to return to the graph window, which displays your selected statistics. – Click Set As Default And Draw Graph to set the current selections as the default objects to graph and return to the graph window, which displays your selected statistics. – Click Cancel to ignore any selections and return to the original graph. Table 17-17 Historical Graph Tools Tool Description 17-52 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Exporting Historical Data Step 6 To exit the display of graphs, click Exit Graph. Exporting Historical Data Note The data export feature requires either the ANM_ADMIN role or a role with a ANM_System privilege other than no-access. You can enable or disable the data export feature that allows ANM to export the historical data that it collects on the network devices that it manages. You create a data file purging policy to enable or disable the data export feature and define the purging attributes associated with this feature. By default, the data export feature is enabled, allowing ANM to export the raw statistical data that it collects during a polling session to the comma-separated values (CSV) data files in the following directory: /var/lib/anm/export/historical-data/date-stamp where date-stamp is the directory name, which is based on the date when the file was created and uses the format YYYY-MM-DD. For example, 2010-05-25. The exported data is saved to the files according to device type (for example, ACE_MODULE, CSS, or CSM) and its record type (for example, RT_INT or RT_CPU). Time drop-down list Modifies the time interval for the accumulated statistics displayed in a graph. Time interval choices include the average data calculated during the last hour, 2-hour, 4-hour, 8-hour, 24-hour, or 30-day (last month) interval. The time choices also include the Real Time option, which displays a maximum of 3 minutes of data at 10-second intervals (not configurable). Note the following usage considerations for the time interval for accumulated statistics: • When you specify to view average data calculated during the last hour, 2-hour, 4-hour, or 8-hour interval, raw data points collected by ANM within the selected time period will be displayed. For example, when you specify to view the data of the last hour, if ANM has been collecting data for over an hour at a default 5-minute interval, you will see 12 data points on the graph. • When you specify to view average data calculated during the last 24-hour interval, consolidated hourly data points will be displayed. For example, if ANM has been collecting data for more than 24 hours, you will see 24 data points on the graph. • When you specify to view average data calculated during the last 30-day interval, consolidated daily data points will be displayed. For example, if ANM has been collecting data for over 30 days, you will see 30 data points on the graph. Table 17-17 Historical Graph Tools Tool Description 17-53 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Exporting Historical Data The data export feature includes a data dictionary (stats-export.dict), which defines the device type and record type and can be used to interpret the data content and format of the exported files. You can download the data dictionary, which is written in XML, and display its content using IE browser or any XML editor/viewer, such as Stylus Studio. The data dictionary can be used as a tool when writing a script to extract specific data from a data file. For example, you can create a script that extracts data based on a device type, such as an ACE, that shows interface statistics for a virtual context within the ACE. Each record/row in the exported data file contains the following information: • Timestamp (in the format defined by the data dictionary) • Device-type • Optional record-type (defined in the data dictionary and used to define the format of each record) • Managed entity name (fully qualified name of the managed object with which the statistical data is associated; it should have the same name shown in the historical graph) • List of statistical data (list order is defined in the data dictionary associated with the record-type) The first line of each exported data file is a header describing the column of each row. Each field of the record is separated by the separator character, which is currently defined in the data dictionary as the comma. If the metric value is unknown, its value is left empty. Each record is separated by a new line character. The following data file content sample shows the data file header followed by the statistical information: DeviceType, RecordType, Timestamp, ManagedEntity, Current Connections, Total Connections, Dropped Connections, Total Client Packets, Total Server Packets, Total Client Bytes, Total Server Bytes, Total Drops Due To Maximum Connection Limit, Total Drops Due To Connection Rate Limit, Total Drops Due To Bandwidth Limit DT-ACE-VC,RT-VS,2010-05-28-14:21:08,172.23.244.130:2:Admin/test/global,0,0,0,0,0,0,0,0,0,0 DT-ACE-APPLIANCE-VC,RT-VS,2010-05-28-14:21:08,172.23.244.212:Admin/test_vs_3/global,0,0,0, 0,0,0,0,0,0,0 The header column names DeviceType, RecordType, Timestamp, and ManagedEntity are mandatory. The definitions of the mandatory headers can be found in the following data dictionary XML tags: • DeviceType definition is inside the device-type tag. • RecordType definition is inside the record-type tag. • ManagedEntity definition is inside the managed-entity tag. The column names that follow the mandatory names are the display names of the statistic. Guidelines and Restrictions: The data export guidelines and restrictions are as follows: • The time at which ANM exports the data file is not configurable. • By default, ANM exports raw historical data only. Snapshots and consolidated historical data (average, minimum, maximum) are not exported. The data export purging operation guidelines and restrictions are as follows: • ANM purges exported data according to the configurable purging policy. By default, the purging policy instructs ANM to purge the data file if it stays for more than 32 days or the total combined export data is bigger than 10000 M (10 G) of disk space or the disk usage is more than 80 percent. • You can configure ANM to send an email notification to up to five recipients when the disk space usage is higher than the defined threshold. • Each purge action removes at least one day of exported statistical data. 17-54 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Exporting Historical Data Procedure Step 1 Choose Monitor > Settings > Historical Data Export. The Historical Data Export window appears. Step 2 Configure the data export purging policy as shown in Table 17-18. Table 17-18 Historical Data Export Fields Item Description Retention Period (In Days) Maximum number of days that ANM is to keep the exported data files. The valid range is 1 to 365 days. The default is 32. Maximum Size Of Exported Data (In MBytes) Maximum allowable size of the data file to export. The valid range is 100 MB to 100000 MB. The default is 10000 MB. Current Size Of Exported Data (In MBytes) (Read only) Current size of the data file. Disk Space Utilization Threshold (In %) Percentage of disk space that the data file can utilize. Current Disk Space Utilization (In %) (Read only) Current amount of disk space that the data file is utilizing. Do You Want To Disable Data Export Check box for enabling or disabling the data export feature as follows: • Unchecked—Data export is enabled. This is the default setting. • Checked—Data export is disabled. E-mail Address To Send Notification When Disk Usage Is Greater Than Disk Space Utilization Threshold Setting Email addresses that ANM sends a notification to when the amount of disk space utilized by the data file exceeds the specified Disk Space Utilization Threshold value. ANM sends an email notification only once every 24 hours even when threshold-exceeding condition persists. Enter an email address and click the right arrow to add it to the list of email addresses to receive notifications. You can specify up to five email addresses. To edit or remove an address from the list, use the left arrow or double-click the address to move it to the edit box where you can modify or delete it. Note For email notifications, you must specify an SMTP server to use for outgoing emails (see the “Configuring SMTP for Email Notifications” section on page 17-68). Status Current status of the data export feature as follows: • RUNNING—Data export is enabled. An alert message may display in parenthesis next to the Running status. • STOP—Data export is disabled. To change the status, see the Do You Want To Disable Data Export checkbox. Statistical Data Last Purge At (Read only) Server time when ANM last purged the data file. Reason For Purging (Read only) Reason why ANM purged the data file; retention period, total size of the exported data file, or disk space usage. Location Of Exported Data (Read only) Path to the exported data files: /var/lib/anm/export/historical-data. 17-55 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Events Step 3 (Optional) To download a copy of the data dictionary in zip file format, click Download Data Dictionary. Step 4 To save the current data file purging policy, click Save. Related Topics • Configuring SMTP for Email Notifications, page 17-68 Monitoring Events The events captured in the Events table include both ACE syslog events and SNMP trap events. A procedure for viewing both types of events and details of information extracted from the syslog are shown below. Fields providing traffic-oriented sorting capability, specifically the information signified by the column heads in the Events Fields window, shown in Table 17-19 (Source IP, Source Port, Destination IP, Destination Port, and Protocol) are only available for the ACE syslogs. Note We do not recommend that you send a high volume of syslogs to ANM. ANM will only process and persist syslogs at 100 messages per second. Any additional syslogs sent to ANM beyond that rate will be discarded. To address this behavior, set the syslog severity level to a setting that is no higher than the warning level (a severity level of 4-Warning). See the “Configuring Virtual Context Syslog Settings” section on page 6-19 for details. Assumptions To receive events from devices, the devices must have syslog and SNMP traps configured correctly. See the “Configuring Virtual Context Syslog Settings” section on page 6-19 and the “Configuring SNMP for Virtual Contexts” section on page 6-27. Procedure Step 1 Choose Monitor > Events. ANM displays all events received from ACE for Syslog and SNMP traps for all virtual contexts. See Table 17-19 for a description of the displayed information, which is extracted from the syslog. You can sort information in the table by clicking on a column heading. This allows you to group events and help troubleshooting traffic information. Table 17-19 Monitor > Events Fields Field Description Syslog ID/SNMP ID Displays the Syslog ID and SNMP ID. If the event is a trap, this field is empty. Severity Indicates the syslog severity level as described in Table 6-5. Origination Time Date and time that the event was last changed in the database. Source IP Displays the source name that is reporting the event, for example, :virtual_context. Source Port Displays the source port. Destination IP Displays the IP address of the destination if available. 17-56 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Monitoring Events Table 17-20 displays the complete list of published ACE syslogs where source and destination IP, ports and protocols are parsed so that the designated table fields populate. Note Only the ACE syslog messages shown in this table will populate the Events window fields explained in Table 17-19. Syslogs and traps not in this table will populate fields with a 0. Destination Port Displays the destination port if available. Protocol Protocol used in the syslog. Detail Provides additional detail about the event. Table 17-19 Monitor > Events Fields (continued) Field Description 17-57 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Configuring Alarm Notifications on ANM Related Topics • Monitoring Devices, page 17-24 • Performing Device Audit Trail Logging, page 18-59 Configuring Alarm Notifications on ANM To set up Monitoring alarm notifications, you define a threshold group and specify the statistics to be monitored by ANM for the threshold group. When the value for a specific statistic rises above the setting you specify, an alarm is issued to alert you. Note CISCO-EPM-NOTIFICAITON-MIB is used for ANM alarms notification. Table 17-20 ACE Syslogs Fields with Perishable Traffic Oriented Sorting Information Syslog Message Contents ACE-1-106021 Deny protocol reverse path check from source_address to dest_address on interface interface_name ACE-4-106023 Deny protocol number | name src incoming-interface:src-ip dst outgoing-interface:dst-ip by access-group "acl-name" (hash 1, hash 2) ACE-6-302022 Built TCP connection id for interface:real-address/real-port (mapped-address/mapped-port) to interface:real-address/real-port (mapped-address/mapped-port) ACE-6-302023 Teardown TCP connection id for interface:real-address/real-port to interface:real-address/real-port duration hh:mm:ss bytes bytes [reason] ACE-6-302024 Built UDP connection id for interface:real-address/real-port (mapped-address/mapped-port) to interface:real-address/real-port (mapped-address/mapped-port) ACE-6-302025 Teardown UDP connection id for interface:real-address/real-port to interface:real-address/real-port duration hh:mm:ss bytes bytes ACE-6-302026 Built ICMP connection for faddr/NATed_ID gaddr/icmp_type laddr/icmpID ACE-6-302027 Teardown ICMP connection for faddr/NATed ID gaddr/icmp_type laddr/icmpID ACE-6-302028 Built TCP connection id for interface: real-address/real-port (mapped-address/mapped-port) to interface: real-address/real-port (mapped-address/mapped-port) ACE-6-302029 Teardown TCP connection id for interface: real-address/real-port to interface: real-address/real-port duration hh:mm:ss bytes bytes [reason] ACE-6-302030 Built UDP connection id for interface: real-address/real-port (mapped-address/mapped-port) to interface: real-address/real-port (mapped-address/mapped-port) ACE-6-302031 Teardown UDP connection id for interface: real-address/real-port to interface: real-address/real-port duration hh:mm:ss bytes bytes ACE-4-313004 Denied ICMP type=icmp_type, from source_address on interface interface_name to dest_address:no matching session ACE-4-410001 Dropped UDP DNS packet_type from source_interface:source_address/source_port to dest_interface:dest_address/dest_port; error_length_type length length bytes exceeds max_length_type limit of maximum_length bytes. 17-58 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Configuring Alarm Notifications on ANM You can specify how you are notified when thresholds are crossed: • Alarm notification, which you view at Monitor > Alarm Notifications > Alarms. • Email notification. • Traps. • Mobile device alarm notification. This method requires ANM 5.1 or later and a supported mobile device with the Cisco ANM Mobile app. For more information about ANM Mobile, see Chapter 19, “Using ANM Mobile.” Note Threshold crossing is detected using periodic polling. If a threshold is crossed between polling cycles, it is possible that ANM License Manager might not issue an alert if the condition recovers before the next polling cycle. Guidelines and Restrictions For certificates that you have loaded on the ACE, you can configure ANM to issue an alarm notification when the certificate expiration date is approaching. ANM performs certificate expiration computations every 24 hours. The computation begins each time ANM is started. Every subsequent computation occurs 24 hours thereafter. Note The Certificates window (Config > Devices > context > SSL > Certificates) contains the Expiry Date field, which displays the certificate expiration date. Due to a known issue with the ACE module and appliance, it is possible that this field displays either “Null” or characters that cannot be parsed or that are unreadable. When this issue occurs, ANM cannot track the certificate expiration date. If the certificate is defined in a threshold group configured for certificate expiration alarm notifications and this issue occurs, ANM may not issue an expiration alarm when expected or it may issue a false alarm. If you encounter this issue, remove the certificate from the ACE, reimport it, and then verify that the correct expiration date appears in the Certificates window. Prerequisites For email notifications, you have specified an SMTP server to use for outgoing emails (see the “Configuring SMTP for Email Notifications” section on page 17-68). Procedure Step 1 Choose Monitor > Alarm Notifications > Threshold Groups, and click Add. Step 2 In the Properties section, enter the name and description for the threshold group. Step 3 In the Threshold Settings section, click Add and then enter the following information shown in Table 17-21. 17-59 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Configuring Alarm Notifications on ANM Table 17-22 provides details for the Category field found in Table 17-21. Table 17-21 Threshold Settings Fields Field Description Device Type Choose the device type to include in the threshold group. VC indicates ACE virtual context. Category Choose a statistic to include in the threshold group. Table 17-22 identifies and describes the types of statistics available for each device type. Note We do not recommend that you include ACL Memory (ACE module and ACE appliance) or Current Application Acceleration Connections (ACE appliance only) as statistics in a threshold group. The values provide through the associated show resource usage CLI command regarding the utilization of these two threshold parameters does not accurately reflect the real usage of these two resources. Assert on Value Enter a value to define the threshold. When the statistic exceeds this value, an alarm is issued. Some values are displayed as percentages as indicated by the percent sign (%). In the case of SSL certificate expiration, assert on value indicates the number of days before certificate expiration. Alarms will be updated daily to indicate the number of days remaining until certificate expiration. If the email is configured, you will be sent email daily alerting you to the number of days left before expiration. Clear Value Enter a value on which to clear the alarm. In the case of SSL certificate expiration, the setting has no relevance. When an expired certificate is deleted, the alarm is removed from ANM on the subsequent certificate evaluation. This happens every 24 hours. Notify on Clear Check the Notify on Clear check box to receive an email notification to the specified address when the alarm is cleared. Severity Choose a severity level for this threshold, which can be Critical, Info, Major, or Minor. 17-60 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Configuring Alarm Notifications on ANM Table 17-22 Monitoring Thresholds by Device Type Category Threshold Description ACE 4710 Appliance ACL Memory Percentage of memory allocated for ACLs. Note We do not recommend that you include ACL Memory as a statistic in a threshold group. The value provided through the associated show resource usage CLI command regarding the utilization of ACL memory does not accurately reflect the real usage of this resource. Bandwidth Percentage of throughput. Concurrent Connections Percentage of simultaneous connections. Current Application Acceleration Connections Percentage of application acceleration connections. Note We do not recommend that you include Current Application Acceleration Connections as a statistic in a threshold group. The value provided through the associated show resource usage CLI command regarding the utilization of application acceleration connections does not accurately reflect the real usage of this resource. Current Connection Rate Percentage of connections of any kind. Current HTTP Compression Rate Percentage of compression for HTTP data. Inspect Connection Rate Percentage of application protocol inspection connections. MAC Miss Rate Percentage of messages destined for the ACE that are sent to the control plane when the encapsulation is not correct in packets. Management Connections Percentage of management connections. Management Traffic Rate Percentage of management traffic connections. Proxy Connections Rate Percentage of proxy connections. Regular Expression Memory Percentage of regular expression memory. SSL Connection Rate Percentage of SSL connections. Syslog Buffer Size Percentage of the syslog buffer. Syslog Message Rate Percentage of syslog messages per second. Translation Entries Percentage of network and port address translations. Device Device Status ACE operating status changes from Up to Down and vice versa. ACE 4710 Appliance VC Application Acceleration Condenser State State of the condenser. 17-61 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Configuring Alarm Notifications on ANM HA Redundancy State ACE virtual context HA or fault tolerance (FT) state changes. Possible FT states are Active, Standby Hot, and Other, which represents all other FT states, including the following: • Non-Redundant—Virtual context is not included in any FT group. • Unknown—Virtual context becomes inaccessible, for example if the ACE that it resides in becomes unresponsive. Interface Interface Operational State Operational state of the interface. Probes Probe Health State Operational health of the health monitoring probe. Real Server1 Real Server Current Connections Number of current connections on a real server. Real Server Operational State Operational state of a real server. SLB Stat Layer 4 Policy Connections Number of Layer 4 policy connections. Layer 7 Policy Connections Number of Layer 7 policy connections. SSL Certificate Management SSL certificate expiration (in days) Number of days left before SSL certificate expires whose value minus one will send a warning email with the specified severity. ANM updates this field daily. Virtual Server1 Virtual Server Current Connections Number of active virtual server connections. Virtual Server Operational State Operational state of a virtual server. Table 17-22 Monitoring Thresholds by Device Type (continued) Category Threshold Description 17-62 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Configuring Alarm Notifications on ANM ACE Module ACL Memory Percentage of memory allocated for ACLs. Note We do not recommend that you include ACL Memory as a statistic in a threshold group. The value provided through the associated show resource usage CLI command regarding the utilization of ACL memory does not accurately reflect the real usage of this resource. Bandwidth Percentage of bandwidth. Concurrent Connections Percentage of simultaneous connections. Current Connection Rate Percentage of connections of any kind. Current HTTP Compression Rate Percentage of compression for HTTP data. This field appears only for an ACE module version A4(1.0) or later. Inspect Connection Rate Percentage of application protocol inspection connections. MAC Miss Rate Percentage of messages destined for the ACE that are sent to the control plane when the encapsulation is not correct in packets. Management Connections Percentage of management connections. Management Traffic Rate Percentage of management traffic connections. Proxy Connections Rate Percentage of proxy connections. Regular Expression Memory Percentage of regular expression memory. SSL Connection Rate Percentage of SSL connections. Syslog Buffer Size Percentage of the syslog buffer. Syslog Message Rate Percentage of syslog messages per second. Throughput Percentage of throughput. Translation Entries Percentage of network and port address translations. Device Device Status ACE operating status changes from Up to Down and vice versa. ACE VC HA Redundancy State ACE virtual context HA or fault tolerance (FT) state changes. Possible FT states are Active, Standby Hot, and Other, which represents all other FT states, including the following: • Non-Redundant—Virtual context is not included in any FT group. • Unknown—Context becomes inaccessible, for example if the ACE that it resides in becomes unresponsive. Interface Interface Operational State Operational state of the interface. Table 17-22 Monitoring Thresholds by Device Type (continued) Category Threshold Description 17-63 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Configuring Alarm Notifications on ANM Probes Probe Health State Operational health of the health monitoring probe. Real Server1 Real Server Current Connections Number of current connections on a real server. Real Server Operational State Operational state of a real server. SLB Stat Layer 4 Policy Connections Number of Layer 4 policy connections. Layer 7 Policy Connections Number of Layer 7 policy connections. SSL Certificate Management SSL certificate expiration (in days) Number of days left before SLL certificate expires whose value minus one will send a warning email with the specified severity. ANM updates this field daily. Virtual Server1 Virtual Server Current Connections Number of active virtual server connections. Virtual Server Operational State Operational state of a virtual server. CSM Module Real Server Real Server Connections Number of real server connections. Real Server Current State Operational state of a real server. SLB Stat Current Opened Connections Number of open connections. Layer 4 Policy Connections Number of Layer 4 policy connections. Layer 7 Policy Connections Number of Layer 7 policy connections. SLB Virtual Server Virtual Server Connections Number of virtual server connections. Virtual Server State Operational state of a virtual server. System CSM Fault Tolerance State Fault tolerance state of the CSM. Device Device Status CSM operating status changes from Up to Down and vice versa. CSS Interface Average TCP Packets Average number of TCP packets. Interface Operational State Operational state of the interface. Max TCP Packets Maximum number of TCP packets. Real Server Active Service Connections Number of active real server connections. Real Server State State of a real server. System CSS Fault Tolerance State Fault tolerance state of the CSS. CSS Module State State of a CSS module. Virtual Server Virtual Server State Current state of a virtual server. Device Device Status CSS operating status changes from Up to Down and vice versa. GSS Device Device Status GSS operating status changes from Up to Down and vice versa. 1. Category choices support mobile device notifications. Table 17-22 Monitoring Thresholds by Device Type (continued) Category Threshold Description 17-64 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Configuring Alarm Notifications on ANM Step 4 Click OK. Step 5 In Device Selection, choose the device type to include in the threshold group. The available devices appear in the Available Items field. Note Make sure that the device type you select in this field is supported by the threshold that you selected in the Category field in Step 3. If the device type you select is not supported by the threshold you selected, you will not receive alarm notifications. Step 6 Click on a device in the Available Items field, and then the arrow (>) to move the device to the Selected Items field. Step 7 In the Notify By section, do the following: a. In the E-mail field, enter the email address that you want to receive notification email. See the “Displaying Email Notifications” section on page 17-66 for information contained in the email notifications. If you do not select this field, you must view alarm notifications by selecting Monitor > Alarm Notifications > Alarm. Note You must configure the required host parameters, IP address and port, to send email notifications. See the “Configuring SMTP for Email Notifications” section on page 17-68. b. Check the Domain sensitive email notification check box to receive filtered email about certificate expirations for the certificates defined in the current domain only. The emails are sent to the email address configured for the RBAC user definition (see the “Managing User Accounts” section on page 18-17). Uncheck this check box to disable this feature. Note This attribute appears only when the selected device type is either the ACE 4710 VC or the ACE VC and the category type is set to SSL Certificate expirations (in days). c. In the Traps field, enter the host IP Address and port number of the machine to which the traps are sent. See the “Displaying Traps” section on page 17-67 for information contained in the traps. d. Check the Mobile Notifications check box to allow ANM to send alarm notifications to supported smart devices that use the ANM Mobile app. This notification option is available when you choose threshold settings in Step 3 for real or virtual servers for device types ACE 4710 VC and ACE VC. See the “Setting Up and Viewing Mobile Device Alarm Notifications” section on page 19-13 for information about setting up alarm notifications on your mobile device. Step 8 Do one of the following: • Click Save to save the threshold group settings. • Click Cancel to cancel the threshold group settings and return to the Threshold Groups page. Related Topics • Configuring SMTP for Email Notifications, page 17-68 • Displaying Alarm Notifications, page 17-65 17-65 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Displaying Alarm Notifications Displaying Alarm Notifications You can display the alarm notification that ANM issues when the value for a statistic exceeds a specified threshold value. Depending on how you specified to be notified when a threshold is crossed, you can view all alarm notifications, email notifications, or alarm traps. Guidelines and Restrictions Threshold crossing is detected using periodic polling. If a threshold is crossed between polling cycles, it is possible that ANM License Manager might not issue an alert if the condition recovers before the next polling cycle. Prerequisites You have configured alarm notifications as described in the “Configuring Alarm Notifications on ANM” section on page 17-57. This section includes the following topics: • Displaying Alarms in ANM, page 17-65. • Displaying Email Notifications, page 17-66. • Displaying Traps, page 17-67. Displaying Alarms in ANM You can display the alarms that ANM issues when the value for a statistic exceeds a specified threshold value. Guidelines and Restrictions This topic includes the following guidelines and restrictions: • ANM displays only the alarms for the devices that are in the domain definition of the RBAC user logged into ANM. • If an alarm has been cleared, it does not appear on the Monitor > Alarm Notifications > Alarms page. This page displays active alarms only. Prerequisites You have configured alarm notifications as described in the “Configuring Alarm Notifications on ANM” section on page 17-57. Procedure Step 1 Choose Monitor > Alarm Notifications > Alarms. The Alarms window appears, displaying the list of alarm notifications issued by ANM. Table 17-23 describes the information displayed for each notification. 17-66 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Displaying Alarm Notifications : Step 2 (Optional) To view a statistical graph of a component with an issue, choose an alarm notification and click Graph The Component With Issue. The Graph popup window appears, showing an analysis of the default statistical units being measured (y-axis) to date and time (x-axis). The component type determines the default statistical units being measured. For example, the units being measured for the real server component type is the number of connections. Note This button can only be used with alarm notifications for the following component types: real server, virtual server, or interface. Related Topics • Configuring SMTP for Email Notifications, page 17-68 • Configuring Alarm Notifications on ANM, page 17-57 • Displaying Email Notifications, page 17-66 Displaying Email Notifications After you configure alarm notifications (see the “Configuring Alarm Notifications on ANM” section on page 17-57) and specify to receive notification email, when the value for a specific statistic rises above the setting you specify, ANM sends an email to alert you. Table 17-24 describes the information contained in the email alarm notification. Table 17-23 ANM Alarm Notification Content Field Description Source ID ANM server IP address that issued the alarm Severity Specified severity level of the threshold, which can be one of the following: • Info • Critical • Major • Minor Origination Time Time the alarm was issued Threshold Group Specified threshold group name Category Alarm name Component Component name, for example, VLAN20 State/Value Specified state or value of the alarm Detail Displays additional information about the alarm. Notes Allows you to add any notes to this alarm. 17-67 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Displaying Alarm Notifications Related Topics • Configuring Alarm Notifications on ANM, page 17-57 • Displaying Alarm Notifications, page 17-65 Displaying Traps After you configure alarm notifications (see the “Configuring Alarm Notifications on ANM” section on page 17-57) and specify to send traps to a trap receiver, when the value for a specific statistic rises above the setting you specify, ANM issues a trap to alert you. Related Topics • Configuring Alarm Notifications on ANM, page 17-57 • Displaying Alarm Notifications, page 17-65 Table 17-24 Email Alarm Notification Content Field Description ANM Server Host Name ANM server host name ANM Server IP Address ANM server IP address Device ID Device name Component Name Component name, for example, VLAN20 Severity Specified severity level of the threshold, which can be one of the following: • Info • Critical • Major • Minor Time Time the alarm was issued Alarm Name Specified name of the alarm Alarm Value Specified value of the alarm Threshold Assert Value Specified value on when to issue the alarm Threshold Group Name Specified threshold group name Alarm State State of the alarm which can be one of the following: • Active • Clear 17-68 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Configuring SMTP for Email Notifications Configuring SMTP for Email Notifications You can specify that email notifications be sent each time a monitoring threshold is crossed. You can request alert emails when configuring a threshold group (Monitor > Alarm Notifications > Threshold Groups) or when enabling the historical data export feature (Monitor > Settings > Historical Data Export). Note You must configure ANM with your SMTP server information to receive email notifications. Assumption You have configured threshold crossing alerts (see the “Configuring Alarm Notifications on ANM” section on page 17-57) or enabled the historical data export feature (see the “Exporting Historical Data” section on page 17-52). Procedure Step 1 Choose Monitor > Settings > SMTP Configuration. Step 2 In the SMTP Server to Send E-mail Notifications field, enter your SMTP server. Step 3 (Optional) In the MAIL FROM for all Email notifications field, enter the source email address to use for email notifications. By default, the Mail From address is anm@hostname. Step 4 Click Deploy Now to apply the SMTP configuration. Related Topics • Exporting Historical Data, page 17-52 • Monitoring Events, page 17-55 • Configuring Alarm Notifications on ANM, page 17-57 • Displaying Email Notifications, page 17-66 Displaying Network Topology Maps This section shows how to display and use the network topology maps that display the nodes on your network based on the virtual or real server that you select. Figure 17-13 shows a sample network topology map. Note The ANM software version that displays across the top of the window varies depending on your version of ANM. 17-69 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Displaying Network Topology Maps Figure 17-13 Sample ANM Topology Map Table 17-25 describes the callouts shown in Figure 17-13. 279805 3 3a 3b 1 2 Table 17-25 Network Topology Map Components Item Description 1 Topology map tool bar that contains the following tools: • Layout—Changes the direction in which the network map appears. Choose one of the following options from the drop-down list: Top to Bottom or Left to Right. • Zoom—Modifies the size of the network map. Click and drag the slide bar pointer to adjust the map size. • Magnifier—Toggle button that enables or disables the magnifier tool. When enabled, moving your mouse over the the topology map magnifies the area that the mouse is over. • Fit Content—Fits the topology map to the window. • Overview—Toggle button that enables or disables the Overview Window tool (see Callout 3). • Undo—Sets the network node icons back to their previous positions. • Redo—Redoes the changes that you made before you clicked Undo. • Print—Sends the topology map to the network printer. • Exit—Closes the topology map and returns to the previous window. 17-70 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Displaying Network Topology Maps Table 17-26 shows the locations in the ANM GUI where you can access the topology maps for real servers and virtual servers. 2 Topology Map—Displays network node mapping. The node icons display the following information related to the node: • Name • IP address (virtual and real servers only) • Port (real servers only) • Operational state (virtual and real servers only) When you hover over a network node icon, the node type appears, for example ACE Virtual Server, Server Farm, or Real Server. Other possible operations when you hover over a network node icon are as follows: • Real servers only—When you have an ACE configured for Dynamic Workload Scaling and you mouseover an associated real server icon, information appears that identifies which data center the real server is located in: local or remote. A timestamp also appears that specifies when the information was obtained. • Server farms only—When you mouseover a server farm icon, the following Dynamic Workload Scaling status information appears: – Local—The ACE is using the server farm’s local real servers only for load balancing. A timestamp specifies when the information was obtained. – Burst—The ACE is bursting traffic to the server farm’s remote real servers because the load of the local real servers has exceeded the specified usage threshold (based on the average CPU and/or memory usage). A timestamp specifies when the information was obtained. – N/A—Not applicable (Dynamic Workload Scaling is not available). For more information about Dynamic Workload Scaling, see the “Dynamic Workload Scaling Overview” section on page 8-4. To view details about a network node, right-click on the node and choose Show Details from the popup menu. To reposition a node in the map, click and drag the node icon to a new position. The node interconnect lines move with the node. 3 Overview Window—Provides a combined functionality of the scroll bars and zoom tool as follows: • Position tool (a)—Click and drag the shaded box to move around the topology map. • Zoom tool (b)—Click and drag the shaded box handle (located in lower right corner) and to zoom in or out of the topology map. Click the Overview toggle button in the map tool bar to display or hide the Overview window. Table 17-25 Network Topology Map Components (continued) Item Description Table 17-26 ANM Topology Map GUI Locations GUI location For more information, see . . . Config > Operations > Real Servers Using the Real Server Topology Map, page 8-23 Config > Operations > Virtual Servers Using the Virtual Server Topology Map, page 7-85 Monitor > Devices > Loadbalancing > Real Servers This section. Monitor > Devices > Loadbalancing > Virtual Servers 17-71 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Testing Connectivity Procedure Step 1 Do one of the following: • Display the list of virtual servers by choosing Monitor > Devices > context > Loadbalancing > Virtual Servers. The Virtual Servers window appears with the table of configured virtual servers. • Display the list of real servers, choose Monitor > Devices > context > Loadbalancing > Real Servers. The Real Servers window appears with the table of configured virtual servers. Step 2 From the servers table, check the check box next to the server whose topology map you want to display. Step 3 From the servers window, click Topology. The ANM Topology window displays the topology map for the selected virtual or real server. For information about using the topology map tools, see Figure 17-13 and Table 17-25. Step 4 (Optional) To close the topology map and return to the previous window, from the ANM Topology window, click Exit. Testing Connectivity You can verify the connectivity (using the ping command) between ANM and the IP address you specify. Note The Ping feature is disabled if you have not imported any devices into the ANM server. Procedure Step 1 Choose Monitor > Tools > Ping. Step 2 From the object selector field, choose the device you want to test. Step 3 Enter the information shown in Table 17-27. Step 4 Click Start to run the connectivity test. Table 17-27 Ping Fields Field Description IP Address Type Choose either IPv4 or IPv6 for the address type of the real server. This field appears only for ACE module and ACE appliance software version A5(1.0) or later, which supports IPv4 and IPv6. IP Address IP address of the real server to which you want to ping. Elapsed Time Elapsed time before the ping request is declared a failure. Repeat Number of times to repeat the test. Datagram Size Value for the argument size (size of the packet) of the ping command. 17-72 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 17 Monitoring Your Network Testing Connectivity After the test completes, the results are displayed. Step 5 Do one of the following: • Click New to enter new parameters and create a new ping test. • Click Restart to rerun the connectivity test. Related Topic Setting Up Devices for Monitoring, page 17-2 CHAPTER 18-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 18 Administering the Cisco Application Networking Manager Date: 3/28/12 This chapter describes how to administer, maintain, and manage the ANM management system. Previous topics described how to manage your network devices on ANM, while this topic describes how to perform procedures on the system itself. Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • Overview of the Admin Function, page 18-2 • Controlling Access to Cisco ANM, page 18-3 • How ANM Handles Role-Based Access Control, page 18-8 • Configuring User Authentication and Authorization, page 18-9 • Managing User Accounts, page 18-17 • Displaying or Terminating Current User Sessions, page 18-24 • Managing User Roles, page 18-25 • Managing Domains, page 18-32 • Using an AAA Server for Remote User Authentication and Authorization, page 18-38 • Disabling the ANM Login Window Change Password Feature, page 18-50 • Managing ANM, page 18-51 • Administering the ANM Mobile Feature, page 18-67 • Lifeline Management, page 18-72 18-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Overview of the Admin Function Overview of the Admin Function Note Some of the Admin options might not be visible to some users; the roles assigned to your login determine which options are available. Table 18-1 describes the options that are displayed when you click Admin. Table 18-1 Admin Menu Options Menu Option Description Reference Role-Based Access Control Organizations Manage organizations, configure remote authentication mechanisms “Configuring User Authentication and Authorization” section on page 18-9 Users Manage users “Managing User Accounts” section on page 18-17 Active Users Display active users “Displaying or Terminating Current User Sessions” section on page 18-24 Roles Manage user roles “Managing User Roles” section on page 18-25 Domains Manage domains “Managing Domains” section on page 18-32 18-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Controlling Access to Cisco ANM Controlling Access to Cisco ANM Access to ANM is based on usernames and passwords, which can be authenticated to a local database on the ANM system or to a remote RADIUS, Active Directory/Lightweight Directory Access Protocol (AD/LDAPS), or TACACS+ server. For detailed procedures about remote authentication, see the “Configuring Authentication and Accounting Services” chapter of either the Cisco ACE Module Security Configuration Guide or Cisco ACE 4700 Series Appliance Security Configuration Guide on www.cisco.com. Note ANM supports LDAPS through Active Directory (AD) only. ANM Management ANM Checks the status of the ANM server. “Checking the Status of the ANM Server” section on page 18-52 License Management Views ANM license state, add more licenses, and tracks license information on your ACE “Using ANM License Manager to Manage ANM Server or Demo Licenses” section on page 18-54 Statistics Displays ACE statistics (for example, CPU, disk, and memory usage). “Displaying ANM Server Statistics” section on page 18-56 Statistics Collection Enables ACE server statistics polling. “Configuring ANM Statistics Collection” section on page 18-57 Audit Log Settings Allows you to specify number of audit logs saved and how many days logs are saved. “Configuring Audit Log Settings” section on page 18-58 ANM Change Audit Log Allows you to display audit logs recording any user input. “Displaying Change Audit Logs” section on page 18-61 ANM Auto-Sync Settings Allows you to specify ANM server auto sync settings “Configuring Auto Sync Settings” section on page 18-61 Advanced Settings Allows you to configure the following Advanced Settings functions: • Enable or disable overwrite of the ACE logging device-id while setting up syslog for autosync using Config > Devices > Setup Syslog for Autosync. • Enable or disable write memory on a Config > Operations configuration. “Configuring Advanced Settings” section on page 18-62 Lifeline Management Use this tool to report a problem to the Cisco support line and generate a diagnostic package “Lifeline Management” section on page 18-72 Table 18-1 Admin Menu Options (continued) Menu Option Description Reference 18-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Controlling Access to Cisco ANM When a user logs into the system, the specific tasks they can perform and areas of the system that they can use are controlled by organizations, roles, and domains. An organization is a virtual group of users, their roles, and domains managed by a specific server that provides authentication to its users. Each organization has its own set of users. See the “Understanding Organizations” section on page 18-7 for information about organizations. The role assigned to a user defines the tasks that a user can perform and the items in the hierarchy that they can see. Roles are either pre-defined or set up by the system administrator. See the “Understanding Roles” section on page 18-6 for more information. A domain is a collection of managed objects. When a user is given access to a domain, it acts as a filter for a sub-set of objects on the network which are displayed as a virtual context. The types of objects in the system that are domain controlled are as follows: • Chassis (with VLANs) • Virtual contexts • Resource classes • Real servers • Virtual servers Thus, role-based access control ensures that a user or organization can view only the devices or services or perform the actions that are included in the domains to which they have been given access (see Figure 18-1). Figure 18-1 Role-Based Access Control Containment Overview Default Organization System Objects AAA Setup Roles 1 to 1 Users Tasks Network Objects All associations are one to many, reading from topto bottom (unless noted otherwise) Objects contained within an organization Domains 240741 Organization used by service providers to resell management 18-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Controlling Access to Cisco ANM The following is an example of RBAC containment. All other user interfaces, such as configuration and monitoring, respect this role-based access control policy: • Roles limit the screens (or functions on those screens) that a user can see. • Domains limit the objects that are listed on any window that the roles allow. • Users (other than the system administrator) can only create subdomains of the domains to which they are assigned. • The system administrator user can see and modify all objects. All other users are subject to the role-based access controls illustrated in Figure 18-1. Related Topics • Types of Users, page 18-5 • Understanding Roles, page 18-6 • Understanding Operations Privileges, page 18-6 • Understanding Domains, page 18-7 • Understanding Organizations, page 18-7 • Managing User Accounts, page 18-17 Types of Users Two types of users configure and monitor the ANM system: • Default users—Individuals associated with the data center or IT department where ANM is installed. The default administrative account (user ID is admin) is a system user account that is preconfigured on ANM. The default administrative password (admin) is also preconfigured on ANM. You can change the password for the admin user account in the same manner as any other user password (see the “Managing User Accounts” section on page 18-17). System roles are defined by the system administrator when ANM is first set up. System roles are specified in terms of resource types and operations privileges. For each system role, the system administrator specifies which resource types a role can work with and what operations a role can perform on each resource type. Organization Webmasters Domains East Coast servers Central servers West Coast servers Role Web server administrator Users User A User B User C Note Each association is one-to-many. Because the organization itself is a collection, it is possible for a role to be used in many organizations. 18-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Controlling Access to Cisco ANM • Organization users—Users who work for the customer of a service provider or AAA server that segments your users and to whom you want to grant access to ANM. Organization users automatically have their access limited to the organization to which they belong. Related Topics • Configuring User Authentication and Authorization, page 18-9 • Managing User Accounts, page 18-17 • Using an AAA Server for Remote User Authentication and Authorization, page 18-38 Understanding Roles Roles in ANM are defined by the system administrator. Roles are specified in terms of resource types and operations privileges. For each role, the system administrator specifies which resource types a role can work with and what operations a role can perform on each resource type. When users are created, they are assigned at least one system role and inherit the operations privileges specified for each of the resource types assigned to that role. The options a user sees in the menu are filtered according to that user’s role (see the “Displaying User Roles and Associated Tasks and ANM Menu Privileges” section on page 18-28). Roles can be applied to both default and organization users. All users are strictly limited by the combination of their operations privileges and user access. For example, a user cannot create another user who has greater privileges or access. Related Topics • Configuring User Authentication and Authorization, page 18-9 • Managing User Accounts, page 18-17 • Managing User Roles, page 18-25 Understanding Operations Privileges Operations privileges define what users can do in the designated resource types. For example, each command and function on ANM has an assigned privilege. If a user’s privileges are not sufficient, the command or function will not be available to them. The following operations privileges can be granted: • No Access—The user has no access to this command or function. Note If a user is configured with no access to virtual contexts, it means absolutely no access to them. The most a user with this access can do is activate or suspend real servers. • View—Allows the user to view statistics and specify parameter collection and threshold settings. Gives the user read-only or view access to system objects and information. • Modify—Allows the user to change the persistent information associated with system objects, such as an organization record, or configuration. • Debug—Gives the user read-only or view access to system objects and information. 18-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Controlling Access to Cisco ANM • Create—Allows the user to control system objects, for example, creating them, enabling them, or powering up. Also allows the user to control system objects, for example, deleting them, disabling them, or powering down. Note The Create privilege includes the functions associated with the Modify privilege; however, the reverse is not true (a user with Modify privileges cannot create items). Privileges are hierarchical. If a user has Modify privileges, they have View privileges as well. If a user has Create or Debug privileges, they have View privileges as well. Related Topics • How ANM Handles Role-Based Access Control, page 18-8 • Managing User Roles, page 18-25 • Guidelines for Managing User Roles, page 18-25 • Understanding Predefined Roles, page 18-26 • Using an AAA Server for Remote User Authentication and Authorization, page 18-38 Understanding Domains Domains in ANM are defined by the system administrator. A domain is a collection of managed objects to which a user is given access. By setting up a domain, you are filtering for a subset of objects on the network. The user is then given access to this virtual context. The table rows that a user sees in any table are filtered according to the domain to which that user has access. Understanding Organizations An organization allows you to configure AAA server lookup for your users or set up users who work for a service provider customer. Organizations in ANM are defined by the system administrator. When you use an ACE device as a AAA server, you may want to segment them for customer, business, or security reasons. If you use more than one authentication server, then you can use organizations to configure them to authenticate your users. For example, if your company has four servers, one each for local, RADIUS, TACACS+, and LDAPS authentication, then organizations could reflect that. The Default organization in ANM is set up to act as the local server. ANM supports different device types that have unique ways of configuring authentication access, which helps with future device support. ANM can configure which users are authenticated by which authentication servers, but does not act as an AAA server itself because this would be in conflict of its role as a RBAC administrator and allows for the separation of authority that is needed to perform RBAC successfully. Related Topics • Using an AAA Server for Remote User Authentication and Authorization, page 18-38 18-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager How ANM Handles Role-Based Access Control How ANM Handles Role-Based Access Control This section describes how and why a system administrator might want to use the ANM RBAC features. ANM supports two distinct, but related RBAC capabilities as follows: • ANM RBAC—ANM acts as a system and network device overseer allowing it to globally implement its use of RBAC. • Device RBAC—ANM devices enforce RBAC. Understanding ANM RBAC ANM is a central place where you can globally set the RBAC for users, roles, and domains (as well as for virtual contexts or device types using device RBAC). As a system administrator, you may need to delegate authority to allow another administrator to perform specific tasks on specific devices, such as activating, suspending, and monitoring traffic flow to specific real servers, yet restrict them from accessing all other capabilities. ANM enables you to accomplish this delegation with more control. For a description of how the roles map to the functions, see “Displaying User Roles and Associated Tasks and ANM Menu Privileges” section on page 18-28. Understanding Device RBAC ANM’s device RBAC allows you to set up device permission levels of a more granular nature. You no longer have to provide “all-or-nothing” roles-based access of devices and device modules. Without ANM, some devices may be open to users who can perform every task on that device or module, regardless of their authorization due to permission level requirements on modules and or switches. ANM provides a central place to grant special access to users you specify. Device users, roles, and domain data are not part of, nor can they be used by ANM. Device RBAC is only for CLI access directly to the context. For example, some users may need level 3 access when direct troubleshooting of ACE hardware is required. You can set up these users with or without ANM, but ANM centralizes the capability to do so. If you want to configure a network engineer with a special role, for example either ACE-Admin or Network-Admin, to provide the level 3 access. ANM accesses the ACE as a level 15 user and an admin supervisor and uses the RBAC to determine the level of access (to device types, segments, elements, subelements, and so on). Some Cisco devices have the ability to configure RBAC directly on the device, for example the ACE. The CSS and CSM are examples of Cisco devices that do not have the capability to have its their own RBAC. When you configure remote authentication (AAA, RADIUS, LDAPS, or TACACs+) for the ACE through ANM, users no longer have to log out to access their device using Telnet. When you manually log into a CSS, the CSS performs user authentication in a Telnet session. Telnet does not provide any domain enforcement, so it is less secure. For an overview of the steps that you perform to configure remote authentication using an AAA server, see the “Using an AAA Server for Remote User Authentication and Authorization” section on page 18-38. If you are an admin using a CSS module outside of the ANM application, then you might have permission to do anything on this switch. If you are using ANM, you can set up better authorization for your administrators for specific devices. Better authorization controls are one of the advantages of using the ANM rather than using only the CLI on the ACE hardware. You can now configure separate access for one function for this user in this domain only. ANM allows this high level of granularity and with it, more control over who does what to your devices. 18-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Configuring User Authentication and Authorization Note When configuring device RBAC though Config > Devices, a message displays reminding you that you are configuring RBAC outside of ANM for direct access. Be aware that this may contradict your ANM settings. For more information on centralizing direct access to devices through RBAC on individual devices, see the “Configuring ACE Module and Appliance Role-Based Access Controls” section on page 5-53. Case Example In this example, a CSM device must have a level 15 access which by default makes the admin a supervisor on everything in the switch (and everything in the module). Another way of looking at this is providing read-only access to everything or configuration access to everything. ACE hardware can be configured on a virtual context to perform that task on a subset domain for every individual module, on every context, but this type of configuration must be configured individually. A system administrator might need to configure a network admin to manage two CSM modules, one out of six virtual contexts, and all East Coast web servers. With ANM, the admin could create one configuration set that includes a user account with a Network-Admin role and a domain that includes these objects. ANM then becomes the security window through which this user passes to get to their destination for that domain and for that virtual context. If there were six users, nine domains, and three virtual contexts, there would be 54 entries required into a AAA Server and ACE module. In ANM there is one entry completed for each of the six users. Configuring User Authentication and Authorization In ANM, you can configure authentication for your users by specifying the authentication method to use for specific user; the local method using ANM or a remote method using an AAA servers. You do this through organizations. An organization allows you to configure your local or AAA server lookup for your users, then associate specific users, roles, and domains with those organizations. The following sections describe the organization authentication tasks that you can complete in ANM: • Adding a New Organization, page 18-10 • Configuring AAA Server lookup for your users—See Adding a New Organization, page 18-10 • Changing server passwords—See Changing Authentication Server Passwords, page 18-14 • Modifying Organizations, page 18-14 • Duplicating an Organization, page 18-15 • Displaying Authentication Server Organizations, page 18-16 • Deleting Organizations, page 18-16 The Default organization (in which all users belong) authenticates users through the ANM internal mechanism, which is based on the RBAC security model. This mechanism authenticates users through the local authentication module and a local database of user IDs and passwords. If you choose to use a remote authentication method, you must specify the authentication server and port. Many organizations, however, already have an authentication service. To use your own authentication service instead of the local module, you can choose one of the alternate modules: • TACACS+ • RADIUS 18-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Configuring User Authentication and Authorization • AD/LDAPS Note For detailed procedures about remote authentication, see the “Configuring Authentication and Accounting Services” chapter of either the Cisco ACE Module Security Configuration Guide or Cisco ACE 4700 Series Appliance Security Configuration Guide on www.cisco.com. After you configure an organization, all authentication transactions are performed by the authentication service associated with that organization. Users log in with the user ID and password associated with the current authentication module. Related Topics • Managing User Accounts, page 18-17 • Managing User Roles, page 18-25 • Managing Domains, page 18-32 • Using an AAA Server for Remote User Authentication and Authorization, page 18-38 Adding a New Organization You can add organizations, which define the mechanism for authenticating ANM users: local using ANM or remote using RADIUS, TACACS+, or AD/LDAPS. When you configure an organization for remote authentication, users within that organization have their passwords validated using the specified remote AAA server. You can also configure an organization to use a TACACS+ server for remote authorization of ANM users. To use remote authorization, you must also configure the TACACS+ server with the role and domains associated with a user or user group (see the “Configuring Remote User Authorization Using a TACACS+ Server” section on page 18-45). When you use the services of a a remote AAA server, you can configure the organization to fall back to using local authentication and authorization when the remote AAA server becomes unavailable. Procedure Step 1 Choose Admin > Role-Based Access Control > All Organizations. Step 2 Click Add. Step 3 Enter the name of the new organization and notes if required, and click Save. Step 4 Enter the attributes described in Table 18-2. Certain attributes will display when specific options are selected. 18-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Configuring User Authentication and Authorization Table 18-2 Organization Attributes Attribute Description Notes Description of the organization or notes to administrator. Organization Name Company, department, or division of the organization that administers the ANM server. This can be different from the organization name above. Default name entered appears. Account Number Account number for the organization. Contact Name Name of the individual who is the contact in the organization. Email Address for the organization’s contact person. Telephone # Telephone number for the organization’s contact person. The format is free text with no embedded spaces. Alternative Telephone # Alternative telephone number for the organization’s contact person. Street Address Street for the organization. City City where the organization is located. Zip Code Zip code for the organization’s address. Country Country where the organization is located. Authentication Mechanism that the system uses to authenticate users. The default authentication mechanism is ANM's internal mechanism (local), which is based on ANM's security model. For remote authentication, you must specify the authentication server and port number. Options are as follows: • Local—Specifies the use of the local database. • RADIUS • TACACS+ • AD/LDAPS (ANM requires that a Domain Controller Server certificate be installed on the Active Directory Server. For a document containing the detailed instructions, see the “Configuring an LDAP Server” section in the “Configuring Authentication and Accounting Services” chapter of either the Cisco ACE Module Security Configuration Guide or Cisco ACE 4700 Series Appliance Security Configuration Guide on www.cisco.com.) Note: The attributes listed below appear only when the Authentication attribute is set to AD/LDAPS, RADIUS, or TACACS+. For detailed instructions about configuring these attributes, see the “Configuring Authentication and Accounting Services” chapter of either the Cisco ACE Module Security Configuration Guide or Cisco ACE 4700 Series Appliance Security Configuration Guide on www.cisco.com. 18-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Configuring User Authentication and Authorization Authentication Server Hostname or IP address of a RADIUS, TACACS+, or LDAPS server for remote user authentication. Note Setting the server with this command is mandatory if you set the Authentication attribute to anything other than the default (local). If you select a remote authentication method, you might need to specify a separate user ID for the authentication server. For AD/LDAPS, you must provide the FQDN of the server (which must be in the users authenticating domain). Note ANM supports LDAPS only through Active Directory (AD). Authentication Port (Optional) Destination port for communicating authentication requests to the authentication server as follows: • RADIUS—By default, the RADIUS authentication port is 1812 (as defined in RFC 2138 and RFC 2139). If your RADIUS server uses a port other than 1812, configure ANM for the appropriate port. Valid values are from 1 to 65535. • TACACS+—By default, the TACACS+ authentication port is 49 (as defined in RFC 1492). If your TACACS+ server uses a port other than 49, configure ANM for the appropriate port. Valid values are from 1 to 65535. • LDAPS—By default, the LDAP server port is 636. If your LDAP server uses a port other than 636, configure ANM for the appropriate port. Valid values are from 1 to 65535. Secondary Authentication Server (Optional) Hostname or IP address for the secondary RADIUS, TACACS+, or LDAPS server used for authentication in case the primary server is unavailable. Secondary Authentication Port (Optional) Destination port on the secondary RADIUS, TACACS+, or LDAPS server for communicating authentication requests if the primary server is unavailable. Authentication Secret String used to encrypt the traffic between Cisco ANM and the AAA server. This string must be identical on both servers. Remote Authorization (Optional) Field that appears only when the Authentication attribute is set to TACACS+. Determines whether ANM or the TACACS+ server performs user authorization. Uncheck the check box to have ANM perform user authorization locally (this is the default setting). Check the check box to enable remote authorization by the TACACS+ server. If you enable remote authorization, you must configure the TACACS+ server with the role and domain information associated with each user (see the “Configuring Remote User Authorization Using a TACACS+ Server” section on page 18-45). Note All role and domain definitions are stored locally on ANM (see the “Managing User Roles” section on page 18-25 and the “Managing Domains” section on page 18-32). Table 18-2 Organization Attributes (continued) Attribute Description 18-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Configuring User Authentication and Authorization Step 5 Click Save. Related Topics • Managing User Accounts, page 18-17 ANM Unique IDs Field that appears only when the Remote Authorization check box is checked for a TACACS+ server. Enter the value that matches the ANM identifier that you configure on the TACACS+ server (see the “Configuring Remote User Authorization Using a TACACS+ Server” section on page 18-45). The default value is ANM. Depending on how you configure the TACACS+ server for user authorization, you may need to specify multiple, comma-separated ANM IDs in the ANM Unique IDs field as follows: anm_1,anm2,anm3 For example, when configuring ANM user authorization on the TACACS+ server, you can use a maximum of 160 characters to specify an ANM unique ID and associated user role and user domain information. To work around this limitation, on the TACACS+ server you can specify additional domain information for the role by entering multiple ANM identifiers. When multiple ANM organizations share the same TACACS+ server, specify a different ANM identifier for each organization. When multiple ANMs share the same TACACS+ server, specify a different ANM identifier for each ANM. Fallback to Local Enables ANM to use local authentication (and local user authorization for TACACS+ applications) if the remote primary and secondary AAA servers are not available, such as when there is a timeout issue, connectivity issue, wrong IP address, and so forth. Note To use the fallback option, you must configure a local user on ANM that ANM can use when fallback is invoked. When you enable Fallback to Local for RADIUS and AD/LDAP, ANM falls back to local user authentication only when the AAA server is unreachable. If the AAA server is reachable but remote authentication fails, ANM does not fall back to local and the login is rejected. When you enable Fallback to Local for TACACS+, ANM falls back to local user authentication and authorization only when the AAA server is unreachable. If the remote server is reachable but remote authentication fails, ANM does not fall back to local and the login is rejected. If Remote Authorization is not enabled, after remote authentication is complete, ANM performs user authorization by checking the local user for role and domain information. If Remote Authorization is enabled and no valid role or domain information is found on the TACACS+ server, including the ANM IP attributes not being set on the TACACS+ server, ANM does not fall back to the local user and rejects the login (see the “Configuring Remote User Authorization Using a TACACS+ Server” section on page 18-45). Table 18-2 Organization Attributes (continued) Attribute Description 18-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Configuring User Authentication and Authorization • Changing the Admin Password, page 18-14 Changing Authentication Server Passwords Note Your user role determines whether you can use this option. You can change the authentication server password. Procedure Step 1 Choose Admin > Role-Based Access Control > Organization. Step 2 Choose the organization that you want to modify and click Edit. Step 3 Change the password attribute in the attributes table (see Table 18-5). Step 4 Click Save. The Edit User Details window appears. Step 5 Make any changes and click Save. Step 6 When all the details are correct, click Cancel. The User Management table is displayed. Related Topics • Managing User Accounts, page 18-17 • Changing the Admin Password, page 18-14 Changing the Admin Password Each ANM has an admin user account built into the device. The root user ID is admin, and the password is set when the system is installed. For information about changing the Admin password, see the “Changing Your Account Password” section on page 1-6. Note For details about resetting the Admin password, see the Installation Guide for Cisco Application Networking Manager 3.0. Modifying Organizations Note Your user role determines whether you can use this option. You can modify an existing organization. 18-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Configuring User Authentication and Authorization Assumptions This topic assumes the following: • ANM is installed and running. • The organization exists in the ANM database. • You have reviewed the guidelines for managing customer organizations (see the “Adding a New Organization” section on page 18-10). Procedure Step 1 Choose Admin > Role-Based Access Control > Organizations. Step 2 Choose the organization that you want to modify and click Edit. The Edit Organization window appears. Step 3 In the attributes table of the Edit Organization window, modify any of the attributes in the attributes table (see Table 18-2). Step 4 Click Save. Related Topics • Configuring User Authentication and Authorization, page 18-9 Duplicating an Organization Note Your user role determines whether you can use this option. You can create a new organization from an existing one. Assumptions This topics assumes the following: • ANM is installed and running. • The organization exists in the ANM database. • You have reviewed the guidelines for managing customer organizations (see the “Adding a New Organization” section on page 18-10). Procedure Step 1 Choose Admin > Role-Based Access Control > Organizations. The Organizations window appears. Step 2 In the Organizations window, choose the organization that you want to copy. Step 3 Click Duplicate. A script popup window appears. Step 4 At the prompt in the popup window, enter a name for the new organization. 18-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Configuring User Authentication and Authorization Step 5 Click OK. The popup window closes and the new organization copy is added to the Organization window. Step 6 (Optional) Choose the new organization and click Edit to make changes to the organization settings. The Edit Organization window appears. Step 7 In the attributes table of the Edit Organization window, modify any of the attributes in the attributes table (see Table 18-2). Step 8 Click Save. Related Topics • Configuring User Authentication and Authorization, page 18-9 Displaying Authentication Server Organizations Note Your user role determines whether you can use this option. To display the authentication server organizations, choose Admin > Role-Based Access Control > All Organizations. The Organizations window appears with a list of customer organizations. From this window you can create a users, roles, and domains that are associated with this specific organization. You can also access organizations by selecting the organization from the object selector that displays in the top right portion of the content area. Related Topics • Understanding Organizations, page 18-7 • Configuring User Authentication and Authorization, page 18-9 Deleting Organizations Note Your user role determines whether you can use this option. You can delete an organization. Assumptions This topic assumes the following: • ANM is installed and running. • The organization exists in the ANM database. • You have reviewed the guidelines for managing customer organizations (see Adding a New Organization, page 18-10). 18-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing User Accounts Procedure Step 1 Choose Admin > Role-Based Access Control > Organizations. The Organizations window appears. Step 2 In the Organizations window, choose the organization to delete. Step 3 Click Delete. All users, domains, and roles within that organization are removed. Related Topics Configuring User Authentication and Authorization, page 18-9 Managing User Accounts You use the User Management feature to specify the people that are allowed to log onto the system. Note You can create users in the organization in which you are a member. You will see users only in the organizations in which you are a member. This section includes the following topics: • Guidelines for Managing User Accounts, page 18-17 • Displaying a List of Users, page 18-18 • Creating User Accounts, page 18-19 • Duplicating a User Account, page 18-20 • Modifying User Accounts, page 18-21 • Resetting Another User’s Password, page 18-22 • Deleting User Accounts, page 18-23 Guidelines for Managing User Accounts This topic includes the following guidelines: • A user cannot log in until they have one domain and one user role associated through an organization. This can be the Default domain but a role must be specified. • Users cannot be moved from one organization to another. Organizations are designed to be separate and distinct. • Only users with create permissions can reset other user's password. See the “Resetting Another User’s Password” section on page 18-22. 18-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing User Accounts Displaying a List of Users You can display a list of ANM users, which includes ANM Mobile users if you have ANM configured to use this feature (for more information, see Chapter 19, “Using ANM Mobile”). Guidelines and Restrictions The list of ANM users does not include users that are remotely authenticated and authorized using a AAA server unless ANM is configured as a backup for user authentication and authorization. Procedure Step 1 Choose Admin > Role-Based Access Control > Organization > Active Users. The Users table appears. Table 18-3 describes the default user information that displays. Step 2 (Optional: Mobile ANM users only) To display the list of mobile devices used by a user, choose a user from the list and click Mobile Notifications. The Mobile Devices popup window appears, displaying device-specific information (see Table 18-18). Step 3 (Optional: Mobile ANM users only) To display the list of favorite objects associated with a user, choose the user from the list and click Favorites. The User Favorites popup window appears. Table 18-4 describes the information displayed. Step 4 (Optional) To specify the user information that displays in the Users table, hover over the Customize button ( ) to display and choose one of the following options: • Default—Displays only the fields described in Table 18-3. • Configure—Opens the Users List Configuration popup window that allows you to specify the user information that displays (see the “Customizing Tables” section on page 1-15). Note The list of user fields that you can choose from includes the Available Objects option, which lists the domain objects available to the user. Because the list of available domain objects for a user can be too extensive to display in the User table, the Excel spreadsheet is the only output format that displays this information (see Step 5). Table 18-3 Users Table Default Fields Field Description Login Name Full name of the user. Role Role assigned to the user. Domains Domains to which the user belongs. Table 18-4 Mobile Device User’s Favorites Field Description Object Type ACE object type accessed by the user, such a real server or virtual server. Device Name ACE device (virtual context) name accessed by the user. Object Name Name assigned to the object. 18-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing User Accounts Step 5 (Optional) To output the user information as raw data or in an Excel spreadsheet, hover over the Save button ( ) to display and choose one of the following output options: • Raw data—Displays the user information as raw data in a new window. • Excel spreadsheet—Displays user information in an Excel spreadsheet in a new window. Related Topics • Creating User Accounts, page 18-19 • Duplicating a User Account, page 18-20 • Modifying User Accounts, page 18-21 • Resetting Another User’s Password, page 18-22 • Deleting User Accounts, page 18-23 • Displaying Mobile Device Notifications and Testing the Notification Channel, page 18-70 • Chapter 19, “Using ANM Mobile” Creating User Accounts Note Your user role determines whether or not you can use this option. You can create new user accounts for an organization. Procedure Step 1 Choose Admin > Role-Based Access Control > Organization > Users. The Users table appears. Step 2 Click Add. The New Organization User window appears. Step 3 In the New Organization User window, configure the user attributes as described in Table 18-5: Note If your web browser supports the Remember Passwords option and you enable this option, the web browser may fill in the Name and Password fields when the New Organization User window loads. By default, these fields should be empty. You can change the name and password fields from whatever the web browser inserts into the two fields. Table 18-5 User Attributes Field Description Login Name Name by which the user is to be identified in the system (up to 24 characters). Only letters, numbers, underscore (_), and backslash (\) can be used. The field is case sensitive. Name Full name of the user. The format is free text. Password Password for the user account. 18-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing User Accounts Step 4 Click Save to save the user account information. Related Topics • Displaying a List of Users, page 18-18 • Duplicating a User Account, page 18-20 • Modifying User Accounts, page 18-21 • Resetting Another User’s Password, page 18-22 • Deleting User Accounts, page 18-23 Duplicating a User Account Note Your user role determines whether you can use this option. You can create a new user account using settings from an existing user. Procedure Step 1 Choose Admin > Role-Based Access Control > Organization > Users. The Users table appears. Step 2 Choose the user account you want to copy and click Duplicate. Confirm Password confirmation for the account. Email Email address for the user. Telephone# Telephone number for the user. The format is free text with no embedded spaces. Role Predefined role from the drop-down list. Domains Domains to which this user belongs. Use the Add and Remove buttons to choose the domains to which this user belongs. Allowed Login IP IP address or a subnetwork from which the user is allowed to log in. You can define up to ten different addresses for a single user. Unless you specifically define IP addresses or subnetworks using this option, the user can log in from any IP address. When you enter an allowed single IP address or an allowed subnet, then the user is only allowed to log in from the specified addresses. To restrict access to a specific subnetwork, enter the IP address and the mask, for example, 10.1.200.60/255.255.255.0. Note IP addresses 1.1.1.1 and 0.0.0.0 cannot be entered in this field. Description Notes about the user. First menu Menu that displays when this user first logs in. Choose one from the drop-down list. Last Login Last time (local time) this user logged in. Table 18-5 User Attributes (continued) Field Description 18-21 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing User Accounts A script popup window appears. Step 3 At the prompt in the popup window, enter a name for the new user account and click OK. The popup window closes and the Users table displays the new user account. Step 4 (Optional) To make changes to the user account, from the Users table, choose the user account and click Edit. The Edit Organization User window appears. Step 5 In the Edit Organization User window, modify the user account settings as described in Table 18-6. Step 6 Click Save to save the user account information. The Users window appears. Related Topics • Displaying a List of Users, page 18-18 • Creating User Accounts, page 18-19 • Modifying User Accounts, page 18-21 • Resetting Another User’s Password, page 18-22 • Deleting User Accounts, page 18-23 Modifying User Accounts Note Your user role determines whether you can use this option. You can modify existing user accounts. Procedure Step 1 Choose Admin > Role-Based Access Control > Organization > Users. The Users table appears. Step 2 Choose the user account you want to modify and click Edit. The Edit Organization User window appears. Step 3 In the Edit Organization User window, modify any of the attributes in the attributes table (see Table 18-6). . Table 18-6 Modify User Attributes Field Description Login Name Name you specified when you created the user you want to duplicate. This is the name by which the user is to be identified in the system (up to 24 characters). Only letters, numbers, and underscore can be used. The field is case sensitive. Name Full name of the user. The format is free text. Email Email address for this user. 18-22 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing User Accounts Step 4 Click Save to save the user account information. Related Topics • Displaying a List of Users, page 18-18 • Creating User Accounts, page 18-19 • Duplicating a User Account, page 18-20 • Resetting Another User’s Password, page 18-22 • Deleting User Accounts, page 18-23 Resetting Another User’s Password Note You must have create permissions in order to reset another user’s password. Use this procedure to reset another users’s password. Step 1 Log in to Cisco License Manager making sure the login username has create permissions. Step 2 Choose Admin > Users. The Users window appears. Step 3 In the Users window, choose the username for which the password needs to be reset and click the Reset Password button. The Reset Password popup window appears with the selected username in the username field. Step 4 Enter and confirm the new password. Telephone# Telephone number for this user. The format is free text with no embedded spaces. Role Predefined role from the list. Domains Domains to which this user belongs. Use the Add and Remove buttons to choose domains to which this user belongs. Allowed Login IP IP address or a subnetwork from which the user is allowed to log in. You can define up to ten different addresses for a single user. Unless you specifically define IP addresses or subnetworks using this option, the user can log in from any IP address. When you enter an allowed single IP address or an allowed subnet, then the user is only allowed to log in from the specified addresses. To restrict access to a specific subnetwork, enter the IP address and the mask, for example, 10.1.200.60/255.255.255.0. Note IP addresses 1.1.1.1 and 0.0.0.0 cannot be entered in this field. Description Notes about the user. First Menu Menu that is displayed when this user first logs in. Choose one from the drop-down list. Last Login Last time (local time) that this user logged in and the IP address that was used. Table 18-6 Modify User Attributes (continued) Field Description 18-23 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing User Accounts Step 5 Click OK to save the password information. The Password has been reset message displays if there are no errors. Related Topics • Displaying a List of Users, page 18-18 • Creating User Accounts, page 18-19 • Duplicating a User Account, page 18-20 • Modifying User Accounts, page 18-21 • Deleting User Accounts, page 18-23 • Displaying or Terminating Current User Sessions, page 18-24 Deleting User Accounts Note Your user role determines whether you can use this option. You can delete a user account. Procedure Step 1 Choose Admin > Role-Based Access Control > Organization > Users. The Users table appears. Step 2 Choose the user account to delete and click Delete. Step 3 The confirmation popup window appears. Step 4 In the confirmation popup window, do one of the following: • Click OK to confirm the deletion request. The user account is removed from the ANM database. • Click Cancel to ignore the deletion request. Related Topics • Displaying a List of Users, page 18-18 • Creating User Accounts, page 18-19 • Duplicating a User Account, page 18-20 • Modifying User Accounts, page 18-21 • Resetting Another User’s Password, page 18-22 18-24 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Displaying or Terminating Current User Sessions Displaying or Terminating Current User Sessions Note Your user role determines whether you can use this option. You can display a list of the users currently logged into the system and end their sessions, if required. You can only display the users in your organization. Procedure Step 1 Choose Admin > Role-Based Access Control > Active Users. The Active User Sessions window displays the following information for each active user who is logged in: Step 2 (Optional) To terminate an active session, click Terminate. When a user session is terminated, the user is logged out of the interface from which the user session was initiated. If the user was making changes to a configuration, the configuration lock is released and any uncommitted configuration change is discarded. If a user session is terminated while an operation is in progress, the current operation is not stopped, but any subsequent operation is denied. For more details on terminating active users, see the “Displaying or Terminating Current User Sessions” section on page 18-24. Related Topics • Controlling Access to Cisco ANM, page 18-3 • Managing User Accounts, page 18-17 Table 18-7 Active User Session Information Column Description Name Name used to log into the Cisco ANM. Type Of Login Method used to log in, for example WEB. User Type Method used to authenticate and authorize the user: • Local—ANM is used to authenticate and/or authorize the user. • Remote— AAA server is used to both authenticate and authorize the user. Login From IP IP address of host. Time Of Login Time user logged in. 18-25 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing User Roles Managing User Roles You use the Roles Management feature to add, modify, and delete user-defined roles and to modify predefined roles.A user’s role determines the tasks the user can access. Each role is associated with permissions or rules that define what feature access this role contains. For example, if you design a role that provides access to virtual servers, the role automatically includes access to all real servers that could be included in the virtual server. ANM provides several predefined user roles that you can modify but not delete. For more information about predefined user roles, including the list of the predefined user roles, see the “Understanding Predefined Roles” section on page 18-26. This section includes the following topics: • Guidelines for Managing User Roles, page 18-25 • Understanding Predefined Roles, page 18-26 • Displaying User Role Relationships, page 18-27 • Displaying User Roles and Associated Tasks and ANM Menu Privileges, page 18-28 • Creating User Roles, page 18-29 • Duplicating a User Role, page 18-31 • Modifying User Roles, page 18-31 • Deleting User Roles, page 18-32 Guidelines for Managing User Roles This topic includes the following guidelines: • System Administrators can view and modify all roles. • Organization administrator users can only see and modify the users, roles, and domains in their organization. • Other users can only view the user, roles, and domains assigned to them. • User-defined roles can be created but follow strict rules about which tasks can be selected or deselected. See the user interface for specific dependencies or the “Displaying User Roles and Associated Tasks and ANM Menu Privileges” section on page 18-28 for role to task mapping information. • You must have the ability to create real servers in your role and at least one virtual context in your domain before you can create real servers. • You must have the ability to create virtual contexts in your role and an Admin context in your domain before you can create virtual contexts. • If you upgrade to ANM 2.2 any custom roles that are migrated retain their associations but have different role definitions. We encourage you to use the ANM 2.2 predefined default roles. 18-26 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing User Roles Understanding Predefined Roles You must have one of the predefined roles in the Admin context in order to use the changeto command, which allows users to visit other contexts. Non-admin/user contexts do not have access to the changeto command; they can only visit their home context. Context administrators, who have access to multiple contexts, must explicitly log in to other contexts to which they have access. The predefined roles and their default privileges are defined in Table 18-8. For information about viewing user role details, see the “Displaying User Roles and Associated Tasks and ANM Menu Privileges” section on page 18-28. For detailed information on RBAC, see either the Cisco Application Control Engine Module Virtualization Configuration Guide or the Cisco 4700 Series Application Control Engine Appliance Virtualization Configuration Guide. Table 18-8 ANM Predefined Role Tasks Predefined Role Description Role Tasks/Operation Privileges1 ACE-Admin Access to create virtual contexts and monitor threshold information. • View Threshold • Create Device Events • Create Virtual Context+ ANM-Admin Access to create virtual contexts and monitor threshold information. Provides access to all features and functions. • Create ANM System • Create ANM User Access • Create VM Mapping • Create ANM Inventory+ Network-Admin Admin for L3 (IP and Routes) and L4 VIPs • View Threshold • Create Device Events • Create Switch • Create Routing • Create Interface • Create NAT • Create Connection Network-Monitor Monitoring for all features • View ANM Inventory+ Org-Admin Access to create role-based access control and import and update device data. • Create ANM User • Create VM Mapping • Create ANM Inventory+ Security-Admin Security features • Create AAA • Modify Interface • Create NAT • Create Inspect • Create Connection 18-27 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing User Roles Displaying User Role Relationships Note Your user role determines whether you can use this option. You can display which users are associated to specific roles. Procedure Step 1 Choose Admin > Role-Based Access Control > Organizations > Roles. The Roles table appears. Step 2 In the Roles table, choose a role and click Users. Server-Appln-Maintenance Server maintenance and L7 policy application • View Threshold • View VIP • View Virtual Inservice • Create LoadBalancer+ Server-Maintenance Server maintenance, monitoring, and debugging • View Threshold • View VIP+ • Modify Real Server • Debug Probe • Create Real Inservice SLB-Admin Load-balancing features • View Threshold • Create Building Block • Modify Interface • Create Expert+ SSL-Admin SSL features • Create SSL+ SSL-Cert-Key-Admin SSL certificate and key management features • Import, generate, or delete keys • Import or delete certificates • Generate a certificate signing request (CSR) • Monitor certificate expiration though the dashboard GUI and threshold modifications VM-Mapper Virtual machine (VM) mapping feature • Create VM to real server map 1. Where the plus sign (+) is indicated, all permissions included in this folder are included at the same privilege level, unless otherwise noted. For example, Virtual Contexts tasks are comprised of tasks such as AAA, Building Blocks, and so on. These tasks are depicted as columns in the Roles table. Table 18-8 ANM Predefined Role Tasks (continued) Predefined Role Description Role Tasks/Operation Privileges1 18-28 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing User Roles The Users With Role window appears. From this window you can delete or duplicate a user. For information about how roles map to users, see the “Displaying User Roles and Associated Tasks and ANM Menu Privileges” section on page 18-28. Related Topics • Duplicating a User Account, page 18-20 • Managing User Roles, page 18-25 Displaying User Roles and Associated Tasks and ANM Menu Privileges Note Your user role determines whether you can use this option. You can view the list of predefined and user defined roles and see how each role is configured to manage what a user can do within ANM. Figure 18-2 shows a sample of the role information available for the predefined ANM-Admin role. Each Role Task is assigned a privilege level (No Access, View, Modify, Debug, or Create) that determines what displays in the Resulting Menu Items list on the right. This list indicates which ANM GUI items the role allows a user to access. Figure 18-2 Edit Role Window Procedure Step 1 Choosing Admin > Role-Based Access Control > Organizations > Roles. The Roles table appears, displaying the list of predefined and user defined roles. The table includes the available role tasks and associated privilege level: No Access, View, Modify, Debug, or Create. Step 2 To view the ANM menu items available to a specific user role, choose a user role and click the Edit icon. 18-29 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing User Roles The Edit Role window appears (see Figure 18-2), displaying the Role Task tree and list of Resulting Menu Items, which is based on the privilege levels selected for each role task. Note The information available from the Edit Role window can vary depending on the version of ANM being used. Step 3 (Optional) Click Cancel to return to the Roles table where you can perform the following tasks: • Create a new role (see the “Creating User Roles” section on page 18-29). • View the users assigned to a role (see the “Displaying User Role Relationships” section on page 18-27). • Modify an existing role to which you have access (see the “Modifying User Roles” section on page 18-31). • Duplicate any existing role to which you have access (see the “Duplicating a User Role” section on page 18-31). • Delete any existing role to which you have access (see the “Deleting User Roles” section on page 18-32). Related Topics • Understanding Operations Privileges, page 18-6 • Managing User Roles, page 18-25 Creating User Roles Note Your user role determines whether you can use this option. You can edit the predefined roles, or you can create new, user-defined roles. When you create a new role, you specify a name and description of the new role, then choose the privileges for each task. You can also assign this role to one or more users. Procedure Step 1 Choose Admin > Role-Based Access Control > Organization > Roles. The Roles table appears. Step 2 Click Add. The New Role window appears. 18-30 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing User Roles Step 3 Enter the following attributes as shown in Table 18-9. Step 4 Click Save. The new role is added to the list of user roles. Step 5 (Optional) To assign this new role to one or more users, go to Admin > Organizations > Users. For detailed steps, see the “Modifying User Accounts” section on page 18-21. Related Topics • Understanding Operations Privileges, page 18-6 • Managing User Roles, page 18-25 Table 18-9 Role Attributes Attribute Description Name Name of the role. Description Brief description of the role. Role Tasks Role task tree that defines the operation privileges associated with each task. The tasks are arranged in a hierarchy of parent and subordinate tasks. Click on the + sign of a parent task to display its subordinate tasks as shown in the following example for the ANM Inventory task. – ANM Inventory -->parent task Threshold -->subordinate tasks DNS Answer UDG Device Events Switch + Virtual Context -->subordinate task that has its own set of subordinate tasks as indicated by the + sign You assign one of the following operating privileges to each of the tasks: No Access, View, Modify, Debug, or Create. When you assign an operating privilege to a parent task, by default, the same privilege is assigned the subordinates. You can assign a different operating privilege to the subordinates if needed; however, you can only assign an operating privilege that is greater than or equal to the operating privilege assigned to the parent task. If you set the parent task to Modify or Debug, the Create privilege is the only privilege allowed for the subordinate tasks and by default, is assigned to the subordinate tasks. For more information about operating privileges, see the “Understanding Operations Privileges” section on page 18-6. Resulting Menu Items Synchronized list of features in the form of menus that this role is able to access after setting the role task operation privileges. 18-31 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing User Roles Duplicating a User Role Note Your user role determines whether you can use this option. You can create a new user-defined role from an existing one. Procedure Step 1 Choose Admin > Role-Based Access Control > Organization > Roles. The Roles table appears. Step 2 In the Roles table, choose the role you want to copy and click Duplicate. A script popup window appears. Step 3 At the prompt in the script popup window, enter a name for the new role. Step 4 Click OK. Step 5 The script popup window closes and Roles tables displays the new role. Step 6 (Optional) To make changes to the new role’s attributes, in the Roles table, choose the role and click Edit. The Edit Role window appears. Step 7 Make the required changes and click Save to save the changes. Related Topics • Understanding Operations Privileges, page 18-6 • Managing User Roles, page 18-25 Modifying User Roles Note Your user role determines whether you can use this option. You can modify any user-defined roles. Procedure Step 1 Choose Admin > Role-Based Access Control > Organization > Roles. The Roles table appears. Step 2 Choose the role you want to modify and click Edit. The Edit Role window appears. Step 3 Make the required modifications. 18-32 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing Domains Step 4 Click Save. Related Topics • Understanding Operations Privileges, page 18-6 • Managing User Roles, page 18-25 Deleting User Roles Note Your user role determines whether you can use this option. You can delete any user-defined roles. Procedure Step 1 Choose Admin > Role-Based Access Control > Organization > Roles. The Users table appears. Step 2 Choose the role to delete and click Delete. Step 3 The confirmation popup window appears. Step 4 In the confirmation popup window, click OK to confirm the deletion. Users that have the deleted role no longer have that access. Related Topics Managing User Roles, page 18-25 Managing Domains Network domains provide a means for organizing the devices and their components (physical and logical) in your network and permitting access according to the way your site is organized. You can allow access to a domain by assigning it to an organization. Examples are specific virtual contexts or specific servers within a context. The following sections describe how to manage domains: • Guidelines for Managing Domains, page 18-33 • Displaying Network Domains, page 18-33 • Creating a Domain, page 18-34 • Duplicating a Domain, page 18-35 • Modifying a Domain, page 18-36 • Deleting a Domain, page 18-37 18-33 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing Domains Guidelines for Managing Domains This topic includes the following guidelines: • Domains are logical concepts. You do not delete a member of a domain when you delete the domain. • Domains can include supported Cisco chassis, ACE modules, ACE appliances, and CSS or CSM devices, as well as their virtual contexts, building blocks, resource classes, and real and virtual servers. • Choose the Allow All setting to include current and future device objects in a domain. • Objects must already exist in ANM. To add objects, see the “Importing Network Devices into ANM” section on page 5-10. • You must have the ability to create real servers in your role and at least one virtual context in your domain before you can create real servers. • You must have the ability to create virtual contexts in your role and an Admin context in your domain before you can create virtual contexts. • Domains continue to display device information even after you remove that device from ANM. This allows the domain information to be easily reassociated if you reimport the device. The device name must remain the same for this to work properly. • (GSS domain objects only) ANM does not allow you to add a VIP answer to a domain if the answer contains a space in its name. Caution Domain objects are hierarchical. If you include a parent object in a domain, the child object is also included even though they do not display in the Object selector tree when you add or edit domains. For example: – Inclusion of a Catalyst 6500 series switch includes all cards, virtual contexts, real servers and virtual servers. – Inclusion of an ACE 4710 includes all virtual contexts, real servers, and virtual servers. – Inclusion of a virtual context, CSM module or CSS device includes all associated objects. Related Topics • Creating a Domain, page 18-34 • Modifying a Domain, page 18-36 • Displaying Network Domains, page 18-33 • Duplicating a Domain, page 18-35 • Deleting a Domain, page 18-37 Displaying Network Domains Note Your user role determines whether you can use this option. You can display the network domains and a domain’s attributes. 18-34 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing Domains Procedure Step 1 Choose Admin > Role-Based Access Control > Organization > Domains. The Domains table appears. Step 2 Expand the table until you can see all the network domains. Step 3 Choose a domain from the Domains table to view and click Edit. The Edit Domains window appears, displaying the domain’s attributes. Related Topics • Managing Domains, page 18-32 • Guidelines for Managing Domains, page 18-33 • Creating a Domain, page 18-34 • Duplicating a Domain, page 18-35 • Modifying a Domain, page 18-36 • Deleting a Domain, page 18-37 Creating a Domain Note Your user role determines whether you can use this option. You can create a new domain. Procedure Step 1 Choose Admin > Role-Based Access Control > Organization > Domains. The Domains table appears. Step 2 Click Add. Step 3 Define the domain attributes as described in Table 18-10. Table 18-10 Domain Attributes Field Description Name Name of the domain. Description Description of the domain. 18-35 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing Domains Step 4 Click Save. The Domains Edit window updates and displays the total object number next to the object name. Related Topics • Managing Domains, page 18-32 • Guidelines for Managing Domains, page 18-33 • Displaying Network Domains, page 18-33 • Creating a Domain, page 18-34 • Duplicating a Domain, page 18-35 • Modifying a Domain, page 18-36 • Deleting a Domain, page 18-37 Duplicating a Domain Note Your user role determines whether you can use this option. You can create a new domain from an existing one. Procedure Step 1 Choose Admin > Role-Based Access Control > Organization > Domains. The Domains table appears. Step 2 Choose the domain to copy and click Duplicate. Step 3 A script popup window appears. Allow All Check box that enables all objects within this domain (current and future objects). If this check box is left unchecked, the Objects tree displays. Objects Collection of objects that comprise this domain. Choose an object name and use the arrows to move it from the available to selected column. For example, selecting a virtual context selects all real servers within that virtual context, or selecting a chassis selects the virtual contexts on that chassis. The interface does not explicitly display this in the table, but the objects are, in fact, selected. Note When you add objects such as real servers to a domain on an ACE that has an HA peer, ANM automatically adds the redundant objects from the HA peer to the list of selected objects. See the “Guidelines for Managing Domains” section on page 18-33 for domain rules about creating virtual contexts and real servers. Table 18-10 Domain Attributes (continued) Field Description 18-36 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing Domains Step 4 At the prompt in the script popup window, enter a name for the new domain and click OK. The script popup window closes and the Domains table displays the new domain. Step 5 Click Save. Related Topics • Managing Domains, page 18-32 • Guidelines for Managing Domains, page 18-33 • Displaying Network Domains, page 18-33 • Creating a Domain, page 18-34 • Modifying a Domain, page 18-36 • Deleting a Domain, page 18-37 Modifying a Domain Note Your user role determines whether you can use this option. You can modify the settings in a domain. Procedure Step 1 Choose Admin > Role-Based Access Control > Organization > Domains. The Domains table appears. Step 2 In the Domains table, choose the domain you want to change and click Edit. The Edit Domains window appears. Step 3 In the Edit Domains window, modify the domain settings. For detailed domain attribute descriptions, see Table 18-10 on page 18-34. Step 4 Click Save. Related Topics • Managing Domains, page 18-32 • Guidelines for Managing Domains, page 18-33 • Displaying Network Domains, page 18-33 • Creating a Domain, page 18-34 • Duplicating a Domain, page 18-35 • Deleting a Domain, page 18-37 18-37 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing Domains Deleting a Domain Note Your user role determines whether you can use this option. You can delete a network domain from the systems. You do not delete objects associated with that domain when you delete the domain. Procedure Step 1 Choose Admin > Role-Based Access Control > Organization > Domains. The Domains table appears. Step 2 In the Domains table, choose the domain to delete and click Delete. The confirmation popup window appears. Step 3 In the confirmation popup window, click OK. The domain is removed from the ANM database. Related Topics • Managing Domains, page 18-32 • Guidelines for Managing Domains, page 18-33 • Displaying Network Domains, page 18-33 • Creating a Domain, page 18-34 • Duplicating a Domain, page 18-35 • Modifying a Domain, page 18-36 18-38 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Using an AAA Server for Remote User Authentication and Authorization Using an AAA Server for Remote User Authentication and Authorization ANM allows you to centrally control user authentication and authorization. User authentication, which manages access to ANM, can be performed locally using a database that resides in ANM or remotely using a database that resides on an AAA server, such as an Active Directory (AD) server using LDAPS, RADIUS, or TACACS+. In ANM, you can configure authentication for your users by specifying which AAA servers are used for specific users. You configure authentication through organizations. An organization allows you to configure your AAA server lookup for your users and then associate specific users, roles, and domains with those organizations. User authorization, which manages access to different ANM functionality, can also be performed locally using a database that resides in ANM or remotely using a database that resides on a TACACS+ server. ANM supports the use of a TACACS+ server only for remote authorization. The information provided in this section is intended as a guide to help you ensure proper communication with the AAA server and ANM operating as the AAA client. For details about configuring the Cisco Secure ACS, Active Directory, or another AAA server, see the documentation that is provided with the software. This section includes the following topics: • Information About Using AD/LDAPS for Remote User Authentication, page 18-38 • Configuring Remote User Authentication Using a TACACS+ Server, page 18-39 • Configuring Remote User Authorization Using a TACACS+ Server, page 18-45 Information About Using AD/LDAPS for Remote User Authentication This section describes how ANM uses AD/LDAPS for remote user authentication. ANM performs the following steps to authenticate and authorize a user when configured to use AD/LDAPS for user authentication: 1. ANM verifies that the user organization exists locally on the ANM database. ANM makes this determination based on the part of the user login name that follows the @ character. 2. ANM uses the configured AD server to authenticate the user. 3. ANM authorizes the user locally. ANM verifies that the user’s name is associated with one of the defined roles in the Roles table (Admin > Role-Based Access Control > Organization > Roles). After ANM completes these three steps, the user is permitted access according to their account settings in the Roles table and Domains table (Admin > Role-Based Access Control > Organization > Domains). If any of the authentication and authorization checks fail, ANM logs the error in the audit log (Admin > ANM Management > ANM Change Audit Log). One of the following error messages display depending on when the failure occurs: • If Step 1 fails, the message is as follows: User authentication failed: Organization does not exist. • If Step 2 fails, the message is as follows: User authentication failed: ... , reason=User password check failed - error code XXX - . 18-39 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Using an AAA Server for Remote User Authentication and Authorization This message means that the AD server rejected the user. The list of possible error codes and respective descriptions are as follows: – 525—User is not found – 52e—User credentials are invalid – 530—User is not permitted to log on at this time – 531—User is not permitted to log on from this workstation – 532—Password has expired – 533—Account is disabled – 701—Account has expired – 773—User must reset their password – 775—Account is locked out • If Step 3 fails, the message is as follows: User authorization failed: User is not defined in the organization. Configuring Remote User Authentication Using a TACACS+ Server This section describes how to configure ANM and a TACACS+ server for remote user authentication. Note For background information about configuring an AAA server, see the “Configuring Authentication and Accounting Services” chapter of either the Cisco ACE Module Security Configuration Guide or Cisco ACE 4700 Series Appliance Security Configuration Guide on www.cisco.com. Assumptions This topic assumes the following: • For purposes of this example, assume usage of a Cisco Secure ACS version 4.1 server. • Your user role determines whether you can perform the procedures outlined in this section. • Administrative login rights are required to access the Cisco Secure ACS HTML interface. Table 18-11 provides a high-level overview of the steps required to authenticate ANM users with a TACACS+ server. 18-40 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Using an AAA Server for Remote User Authentication and Authorization Table 18-11 Authenticating ANM Users with a TACACS+ Server Task Procedure Step 1 Create an organization and define the remote TACACS+ server used (ANM) Note Your user role determines whether you can use this option. Remote authentication servers are defined in ANM as organizations. A single server can be used in multiple organizations. To configure authentication for your users by creating an organization and defining TACACS+ as the method of authentication, do the following: a. Choose Admin > Role-Based Access Control > All Organizations. The Organizations window appears. b. Click Add. c. Enter the name of the new organization and notes if required. d. Click Save. e. Choose the new organization and click Edit. f. Enter the attributes as described in Table 18-2. Certain attributes appear when you choose specific options. Include the following organization attributes to authenticate ANM users with a TACACS+ server: – Organization name – TACACS+ as authentication method – IP address of TACACS+ server – Authentication port number – Authentication secret g. Click Save. See the “Adding a New Organization” section on page 18-10 for details about this procedure. Step 2 Creating a role for RBAC (ANM) Note Your user role determines whether you can use this option. You can edit the predefined roles or you can create user-defined roles. When you create a role, you specify a name and description of the new role, and then choose the privileges for each task. You can also assign this role to one or more users. Do the following: a. Choose Admin > Role-Based Access Control > Organization > Roles. The Roles table appears. b. Click Add. The New Role form appears. c. Enter the attributes as described in Table 18-9. d. Click Save. The new role is added to the list of user roles. See the “Creating User Roles” section on page 18-29 for details on this procedure. 18-41 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Using an AAA Server for Remote User Authentication and Authorization Step 3 Create a domain for an RBAC user (ANM) Note Your user role determines whether you can use this option. A domain defines which objects that the RBAC user will have access to. The assigned role defines which actions that user will be able to perform on those objects. To configure a domain for an RBAC user, do the following: a. Choose Admin > Role-Based Access Control > Organization > Domains. The Domains table appears. b. In the Domains table, click Add. c. For the new domain, enter the attributes as described in Table 18-10. Note If you check the Allow All checkbox, this selection enables all objects within this domain (current and future objects). If you leave this check box unchecked, the Objects tree displays. To allow a user to have access to the entire context, highlight the Virtual Contexts folder in the Objects tree, locate the specific user context, and then click the arrow to send it to the Selected box. The context name format is :: d. Click Save when all the objects that you want to allow access to are listed in the Selected box. See the “Creating a Domain” section on page 18-34 for details on this procedure. Step 4 Create an organization user (ANM) Note Your user role determines whether you can use this option. Organization users are users who work for the customer of a service provider or AAA server that segments your users and to whom you want to grant access to ANM. Do the following: a. Choose Admin > Role-Based Access Control > Organization > Users. The Users window appears. b. In the Users window, click Add. c. Enter the attributes as described in Table 18-5. Include the following organization user attributes: – Login name – Predefined role – Domains to which this user belongs d. Click Save. The Users table appears. See the “Creating User Accounts” section on page 18-19 for details on this procedure. Table 18-11 Authenticating ANM Users with a TACACS+ Server (continued) Task Procedure 18-42 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Using an AAA Server for Remote User Authentication and Authorization Step 5 Access the AAA server (Cisco Secure ACS server) Note Administrative login rights are required to access the Cisco Secure ACS HTML interface. To access the Cisco Secure ACS HTML interface, do the following: a. Open a web browser for the URL of the Cisco Secure ACS HTML interface. b. In the Username box, type a valid Cisco Secure ACS administrator name. c. In the Password box, type the password for the administrator name that you specified. d. Click Login. The Cisco Secure ACS HTML interface appears. For details on configuring the Cisco Secure ACS HTML server, see the documentation that is provided with the software. Step 6 Create a network device group (Cisco Secure ACS Server) To create a group of TACACS+ clients and servers on the Cisco Secure ACS HTML server, do the following: a. Go to the Network Configuration section of the Cisco Secure ACS HTML interface. b. In the navigation bar, click the Network Configuration button. The Network Configuration page appears in the Cisco Secure ACS HTML interface. c. Under the Network Device Groups table, click the Add Entry button to create a new group of TACACS+ clients and servers. Type the name of the new group (for example ANM). d. Click Submit. For details on configuring the Cisco Secure ACS HTML server, see the documentation that is provided with the software. Table 18-11 Authenticating ANM Users with a TACACS+ Server (continued) Task Procedure 18-43 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Using an AAA Server for Remote User Authentication and Authorization Step 7 Specify the AAA client setup for ANM (Cisco Secure ACS Server) To define the AAA client setup for ANM on the Cisco Secure ACS HTML server, do the following: a. Click Add Entry below the AAA Clients table. The Add AAA Client window appears. b. In the Add AAA Client window, specify the following attributes: – AAA Client IP Address—Client IP address of ANM that will be used for communicating with the TACACS+ server – Shared Secret—Shared secret specified on ANM – Network Device Group—ANM – Authenticate Using—TACACS+ (Cisco IOS) Note The TACACS+ (Cisco IOS) drop-down item specifies the Cisco TACACS+ authentication function. This selection activates the TACACS+ option when using Cisco Systems access servers, routers, and firewalls that support the TACACS+ authentication protocol, including support for ANM as well. c. Click Submit + Apply. For details on configuring the Cisco Secure ACS HTML server, see the documentation that is provided with the software. Step 8 Specify the AAA server setup (Cisco Secure ACS Server) To define the AAA server setup for ANM on the Cisco Secure ACS HTML server, do the following: a. Click Add Entry below the AAA Servers table. The Add AAA Servers window appears. b. In the Add AAA Servers window, specify the following attributes: – AAA Server IP Address—IP address of the TACACS+ server – Key—Shared secret specified on ANM – Log Update/Watchdog Packets from This Remote AAA Server—Enabled – Network Device Group—ANM – AAA Server Type—TACACS+ – Traffic Type—Inbound/Outbound c. Click Submit + Apply. For details on configuring the Cisco Secure ACS HTML server, see the documentation that is provided with the software. Table 18-11 Authenticating ANM Users with a TACACS+ Server (continued) Task Procedure 18-44 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Using an AAA Server for Remote User Authentication and Authorization Step 9 Create the ANM user on the TACACS+ server (Cisco Secure ACS Server) To create the ANM user on the Cisco Secure ACS HTML server, do the following: a. Click the User Setup button. The User Setup window appears. b. In the User text box of the User Setup window, enter the user name of the organization user that you created in ANM (see Step 3, the Create an domain for a RBAC user task). c. Click the Add/Edit button. d. Specify the following user attributes: – Real Name—Real name of the ANM user. – Description—Brief description of the user for the administrator. – Password Authentication—ACS Internal Database. – Password—Password for this user account. Enter this password a second time in the Confirm Password text box. For details on configuring the Cisco Secure ACS HTML server, see the documentation that is provided with the software. Table 18-11 Authenticating ANM Users with a TACACS+ Server (continued) Task Procedure 18-45 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Using an AAA Server for Remote User Authentication and Authorization Figure 18-3 Example of Authentication Communication Between ANM and a TACACS+ Server Related Topics • Controlling Access to Cisco ANM, page 18-3 • How ANM Handles Role-Based Access Control, page 18-8 • Configuring Remote User Authorization Using a TACACS+ Server, page 18-45 Configuring Remote User Authorization Using a TACACS+ Server You can configure a TACACS+ server to perform remote authorization of ANM users by configuring the authorization settings on the AAA server, which includes a unique ANM identifier, user role, and domain information. After you configure the TACACS+ server and ANM for remote authorization, when ANM authorizes a user, it sends an authorization request to the TACACS+ server, which returns with the names of the role and domains that are assigned to the user and defined on ANM. Guidelines and Restrictions This topic includes the following guidelines and restrictions: • You can configure ANM remote authorization on a TACACS+ server only. This feature is not available for AD/LDAPS or RADIUS. • Cisco has approved the use of Cisco Secure Access Control System (ACS) only for remote authorization (Cisco has not approved the use of other TACACS+ servers for this purpose). The Cisco Secure ACS can accept an authorization request and send the following attribute in the request: Step 10 Log in to ANM using the newly created account To test the new login credentials for user authentication, do the following: a. Log in to ANM by entering the new user account in the ANM login window. Enter the username using the following format: @. b. Click Login. Authentication occurs between ANM and the TACACS+ server (see Figure 18-3). All authentication transactions are performed by the TACACS+ authentication service associated with the associated organization. c. ANM appears with the virtual contexts that you included as part of the domain for the RBAC user in Step 3 (the Create an domain for a RBAC user task). Table 18-11 Authenticating ANM Users with a TACACS+ Server (continued) Task Procedure 18-46 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Using an AAA Server for Remote User Authentication and Authorization ANM_UniqueID=RoleNameDomain1Domain2 . . . ANM/IP should be used as the TACACS_Service/TACACS_Protocol pair for an authorization request and response. • You configure the user authorization attributes on the TACACS+ server using the following format: ANM_UniqueID=RoleNameDomain1Domain2 . . . The number of characters allowed for the ANM identifier, role, and domain information is limited to 160 characters, including spaces. You can use additional characters by adding a new ANM Unique ID entry for domain attributes as follows: ANM_UniqueID_1=RoleNameDomain1Domain2 ANM_UniqueID_2=Domain3Domain4 ANM_UniqueID_3=Domain5 You must assign a different ANM identifier to each entry. Make sure that you configure the ANM organization with each ANM unique ID (see the “Adding a New Organization” section on page 18-10). • You can define user authorization at the user level, user group level, or both. We recommend configuring authorization at the user group level, which allows you to assign a common set of authorization attributes to multiple users. When you configure the authorization attributes at both the user level and user group level, the user attributes take precedence over user group attributes. The procedure in this section includes all three configuration options. • You can configure ANM to revert to local user authorization if the TACACS+ server becomes unavailable (see the “Adding a New Organization” section on page 18-10). Prerequisites ANM has a user organization that is configured for remote authorization (see the “Adding a New Organization” section on page 18-10). This section includes the following topics: • Configuring Remote User Authorization Using Cisco Secure ACS Version 5.1, page 18-46 • Configuring Remote User Authorization Using Cisco Secure ACS Version 4.2, page 18-48 Configuring Remote User Authorization Using Cisco Secure ACS Version 5.1 You can use Cisco Secure ACS Version 5.1 for configuring a remote server to perform remote authorization of ANM users. Note This procedure describes only the ANM-specific attributes for creating user groups and users on Cisco Secure ACS. For information about configuring the other attributes, see the User Guide for Cisco Secure Access Control Server located on Cisco.com. Procedure Step 1 From the Cisco Secure ACS HTML GUI, create a new Device Type to identify requests coming from the ANM server. 18-47 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Using an AAA Server for Remote User Authentication and Authorization Do the following: a. From the sidebar menu, choose Network Device Groups > Device Type. The Device Group General window appears. b. In the Name field, enter ANM. c. (Optional) In the Description Field, enter a description. For example, ANM Server. d. In the Parent field, select All Device Types. e. Click Submit. Step 2 From the sidebar menu, choose Network Device Groups > Network Devices and AAA Clients to add a device. The Network Devices and AAA Clients window appears. Do the following: a. In the Name field, enter ANM. b. From the Network Device Groups pane, do the following: – In the Location field, select All Locations. – In the Device Type field, select All device Types:ANM, which is the device type that you created in Step 1. c. From the IP Address pane, do the following: – Choose the IP Range(s) radio button. – From the IP and Mask fields, enter the IP address and Mask to use and click Add to add the values to the IP/Mask table. d. From the Authentication Options pane, check the TACACS+ check box. e. Click Submit. Step 3 From the sidebar menu, choose Users and Identity Stores > Identity Groups to create an Identity Group, which will be used later to map users to a specific role. The Identity Groups General window appears. Do the following: a. In the Name field, enter a name for the group. For example, ACE-Admin. b. (Optional) In the Description field, enter a description for the group. For example, ACE devices admin. c. In the Parent field, select ALL Groups:ANM-Groups. d. Click Submit. The Identity Groups window appears. e. From the Identity Groups window, drill down and check the check box of an organization division/roll to associate with the group. For example, check the ACE-Groups check box (All Groups > ANM-Groups > ACE-Admin). f. Click Create. g. Repeat Step 3 for every Identity Group that you need to create. Step 4 From the sidebar menu, choose Users and Identity Stores > Internal Identity Stores > Users to create a user. The Users General window appears. Do the following: a. In the Name field, enter a user name. b. From the Status drop-down list, set the status for the user account. For example, Enabled. 18-48 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Using an AAA Server for Remote User Authentication and Authorization c. (Optional) In the Description field, enter a description for the user account. d. In the Identity Group field, select one of the groups created in Step 3 to associate with the user. e. Click Submit. Step 5 From the sidebar menu, choose Policy Elements > Authorization and Permissions > Device Administration > Shell Profiles to create a shell profile for each Identity Group that you created in Step 3. The shell is used to pass the user’s role and domain list to the ANM server. The Shell Profiles window appears. Do the following: a. Click the Custom Attributes tab. b. From the Attribute field, enter the attribute name, which is the ANM unique ID that you configured in the ANM organization on ANM. The ANM unique ID is followed by the role and domain names as a name/value pair (NV Pair) using the following format: ANM_UniqueID=RoleNameDomain1Domain2 . . . For example: ANM=Role1 Domain1 Domain2 Domain6 The ANM_UniqueID variable must match the ANM unique ID that you configured in the ANM organization on ANM (see the “Adding a New Organization” section on page 18-10). This line cannot exceed 254 characters. If you need to use more than 254 characters, add another ANM Unique ID entry to specify the domains associated with the role specified in the first entry (for details, see the Guidelines and Restrictions associated with this topic). c. Click Add. The attribute name is added to the Manually Entered pane. d. Click Submit. Related Topics • Managing User Roles, page 18-25 • Managing Domains, page 18-32 • Adding a New Organization, page 18-10 • Using an AAA Server for Remote User Authentication and Authorization, page 18-38 • Configuring Remote User Authorization Using Cisco Secure ACS Version 4.2, page 18-48 Configuring Remote User Authorization Using Cisco Secure ACS Version 4.2 You can use Cisco Secure ACS Version 4.2 for configuring a remote server to perform remote authorization of ANM users. Note This procedure describes only the ANM-specific attributes for creating user groups and users on Cisco Secure ACS. For information about configuring the other attributes, see the User Guide for Cisco Secure Access Control Server located on Cisco.com. 18-49 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Using an AAA Server for Remote User Authentication and Authorization Procedure Step 1 From the Cisco Secure ACS HTML GUI, configure the interface as follows: a. From the side menu bar, click Interface Configuration. The Interface Configuration window appears. b. From the Advanced Options pane of the Interface Configuration window, check the Per-user TACACS+/RADIUS Attributes check box and click Submit. c. From the New Services pane of the Interface Configuration window, check the Service and Protocol check boxes and add a new service as follows: – In the Service text box, enter ANM. – In the Protocol text box, enter IP. d. Click Submit. Step 2 Do one of the following: • Configure a user group for the users that you create—Go to Step 3. • Configure a user only—Skip to Step 4. Step 3 To configure a user group, do the following: a. From the side menu bar, click Group Setup. The Group Setup window appears. b. From the Group Setup window, create a user group and set the following ANM attributes: – Check the ANM IP service check box. – Check the Custom attributes check box and enter the ANM unique identifier followed by the role and domain names as a name/value pair (NV Pair) in the Custom Attributes pane using the following format: ANM_UniqueID=RoleNameDomain1Domain2 . . . For example: ANM=Role1 Domain1 Domain2 Domain6 The ANM_UniqueID variable must match the ANM unique ID that you configured in the ANM organization on ANM (see the “Adding a New Organization” section on page 18-10). This line cannot exceed 160 characters. If you need to use more than 160 characters, add another ANM Unique ID entry to specify the domains associated with the role specified in the first entry (for details, see the Guidelines and Restrictions associated with this topics). c. Click Submit. The user group is now ready for adding users (go to Step 4). Step 4 Create a user as follows: a. From the side menu bar, click User Setup. The User Setup window appears. b. To assign the user to the user group that you created in Step 3, from the User Setup window, choose the group from the following drop-down list: Group to which the user is assigned. Skip this step if the user is not to be included in a user group. 18-50 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Disabling the ANM Login Window Change Password Feature c. Configure the ANM-specific attributes. Perform this step for either of the following reasons; otherwise, skip this step: – The user is not to be included in a user group. – The user is included in a user group but requires different authorization attributes (user attributes have precedence over user group attributes). To configure the ANM-specific attributes, from the User Setup window, do the following: – Check the ANM IP service check box. – Check the Custom attributes check box, enter the ANM unique ID and role and domain names as NV Pair in the Custom Attributes pane using the following format: ANM_UniqueID=RoleNameDomain1Domain2 . . . For example: ANM=Role1 Domain1 Domain2 Domain6 The ANM_UniqueID variable must match the ANM Unique ID that you configured in the ANM organization (see the “Adding a New Organization” section on page 18-10). This line cannot exceed 160 characters. If you need to use more that 160 characters, add another ANM Unique ID entry to specify the domains associated with the role (for details, see this topic’s Guidelines and Restrictions): d. Click Submit. Related Topics • Managing User Roles, page 18-25 • Managing Domains, page 18-32 • Adding a New Organization, page 18-10 • Using an AAA Server for Remote User Authentication and Authorization, page 18-38 • Configuring Remote User Authorization Using Cisco Secure ACS Version 5.1, page 18-46 Disabling the ANM Login Window Change Password Feature When you log into ANM from the login window, you have the option to change your password at that time. This feature is enabled by default; however, you can disable it by modifying the ANM cs-config.properties file. When disabled, the login window no longer displays the Change Password hyperlink. Procedure Step 1 Disable the Change Password option on the ANM login window as follows: • ANM Server—Open the /opt/CSCOanm/etc/cs-config.properties file in a text editor and change the state of the following line from true to false: changeANMPassword.enable=false 18-51 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM • ANM Virtual Appliance—Enter the following command: anm-property set changeANMPassword.enable false Step 2 Restart ANM as follows: • ANM Server—Enter the following command: /opt/CSCOanm/bin/anm-tool restart • ANM Virtual Appliance—Enter the following command: anm-tool restart Related Topics • Logging In To the Cisco Application Networking Manager, page 1-5 • Changing Your Account Password, page 1-6 Managing ANM When you choose Admin > ANM Management, you can display the following information: • ANM—Allows you to check the status of your ANM server. See the “Checking the Status of the ANM Server” section on page 18-52. • License Management—Displays the ANM license information. See the “Using ANM License Manager to Manage ANM Server or Demo Licenses” section on page 18-54. • Statistics—Displays the ANM server statistics. See the “Displaying ANM Server Statistics” section on page 18-56. • Statistics Collection—Allows you to enable or disable ANM server statistic collection. See the “Configuring ANM Statistics Collection” section on page 18-57. • Audit Log Settings—Allows you to determine how long audit log records are kept. See the “Configuring Audit Log Settings” section on page 18-58. • Change Audit Log—Displays ANM server logs. See the “Displaying Change Audit Logs” section on page 18-61. • Auto Sync Settings—Allows you to allow ANM to automatically sync with CLI when it detects out of band changes between itself and the ACE. See the “Configuring Auto Sync Settings” section on page 18-61. • Advanced Settings—Allows you to set the following advanced settings for ANM: – Enable or disable overwrite of the ACE logging device-id while setting up syslog for autosync using Config > Devices > Setup Syslog for Autosync. – Enable or disable write memory on a Config > Operations configuration. – Enable features for displaying details about real or virtual servers. – Enable mobile notifications from ANM. – Hide syslog buffer details in the Dashboard pane Top 10 Current Resources. – Display all virtual servers that have class-map and policy-map definitions in the monitoring and operations windows. See the “Configuring Advanced Settings” section on page 18-62. 18-52 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM • Virtual Center Plugin Registration—Allows you register the ANM plugin to integrate ANM in a VMware virtual data center environment. See Appendix B, “Using the ANM Plug-In With Virtual Data Centers.” Checking the Status of the ANM Server Note Your user role determines whether you can use this option. You can check if ANM has a backup server and to view the server status. The ANM server can be configured as either of the following: • A non-HA ANM. The non-HA ANM consists of only one host and is referred to as a standalone ANM. • An HA (high availability or fault-tolerant) ANM, which consists of two hosts: an active ANM and a standby ANM. An HA ANM has a virtual IP address that is always assigned to the active ANM. Users log into this virtual IP address—they never log into the real IP addresses of the hosts. In addition, an HA ANM has a secondary NIC and IP address on each host over which “heartbeat” messages are used to arbitrate which host is active and which is standby. Procedure Step 1 Choose Admin > ANM Management > ANM. The ANM Server status window appears. This window contains the following information: Table 18-12 ANM Server Status Information Field Description HA Replication State HA replication state as follows: • OK—This is an HA ANM and is running properly. • Standalone—This is a non-HA ANM; therefore, the HA attributes and operations are not meaningful. • Stopped—This is HA ANM and this state indicates that the active ANM is copying its entire database contents to the standby ANM. This normally happens when the standby ANM initially starts up or it has been stopped and restarted later. This process normally takes a few seconds to a few minutes depending on the size of the ANM configuration data and monitoring data. During this time, the active ANM cannot be stopped, restarted, or failover. • Failed—This is an HA ANM and database replication cannot proceed. Most likely this is because the standby ANM is unresponsive or is unreachable. Version Version of the ANM software. Build Number and Build Timestamp Build identification information. Time Server Started Date and time the ANM server started. 18-53 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM Related Topics • Using ANM License Manager to Manage ANM Server or Demo Licenses, page 18-54 • Displaying ANM Server Statistics, page 18-56 Virtual IP Address Virtual IP address that associates with the active host. This IP address must be on the same subnet as the primary IP addresses of both Node 1 and Node 2. Active Name Name of Node 1, which can be displayed by issuing the uname -n command on the host. Active IP IP address used by Node 1 for normal (non-heartbeat related) communication. This IP address must be on the same subnet as the primary address for Node 2. Active Heartbeat IP IP address associated with the crossover network interface for Node 1. This IP address must be on the same subnet as the Heartbeat IP address for Node 2. Standby Name Name of Node 2, which can be returned by issuing the uname -n command on the host. Standby IP IP address used by Node 2 for normal (non-heartbeat related) communication. This IP address must be on the same subnet as the primary IP address for Node 1. Standby Heartbeat IP IP address associated with the crossover network interface for Node 2. This IP address must be on the same subnet as the Heartbeat IP address for Node 1. License Server State License server state as follows: • OK—There is a valid license on the host. • Invalid—The host either contains an invalid license or there is no license present. • Unknown—It is not possible to communicate with the host's license manager, therefore, the license state is unknown. Note The Unknown and Invalid states will not display for the active (local) ANM. If the standby ANM has an Invalid license state, you should install a valid license. If the standby ANM has an Unknown license state, check that the standby ANM has been installed correctly. • DEMO—Used for the demonstration purposes. It lasts for 30, 60, or 90 days from the issue day of the license. It allows you to use all features. Standby License Server State Standby license server state as follows: • OK—There is a valid license on Node 2. • Invalid—Node 2 either contains an invalid license or there is no license present. • Unknown—It is not possible to communicate with the license manager on Node 2, therefore, the license state is unknown. Note The Unknown and Invalid states will not display for the active (local) ANM. If the standby ANM has an Invalid license state, you should install a valid license. If the standby ANM has an Unknown license state, check that the standby ANM has been installed correctly. • DEMO—Used for the demonstration purposes. It lasts for 30, 60, or 90 days from the issue day of the license. It allows you to use all features. Table 18-12 ANM Server Status Information (continued) Field Description 18-54 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM • Configuring ANM Statistics Collection, page 18-57 Using ANM License Manager to Manage ANM Server or Demo Licenses You can use the ANM License Manager feature to manage to the ANM license required to use ANM beyond the 90-day evaluation period. Note Your user role determines whether you can use this option. Table 18-13 describes the available ANM licenses and their purpose. ANM licenses are available at no charge. When you install the ANM software, you are provided with a 90-day evaluation period that does not require a license; however, to continue using ANM beyond the evaluation period, you must install the ANM server license as follows: • To install the server license before the evaluation period expires, you can use ANM License Manager (see the “Displaying and Adding ANM Licenses to License Management” section on page 18-54). Optionally, you can use the CLI to install the license as described in the next bullet. • To install the server license after the evaluation period expires, you must use the CLI (see the Installation Guide for Cisco Application Networking Manager 5.2 or the Installation Guide for the Cisco Application Networking Manager 5.2 Virtual Appliance for instructions). Note ANM uses TCP port 10444 for the ANM License Manager. For other port numbers, see Appendix A, “ANM Ports Reference.” This section includes the following topics: • Displaying and Adding ANM Licenses to License Management, page 18-54 • Removing an ANM License File, page 18-55 Displaying and Adding ANM Licenses to License Management Note Your user role determines whether you can use this option. You can add a license to the license manager. You need to add a license before the 90-day evaluation period expires or when you convert from a demo license to an ANM server license. Table 18-13 ANM License Descriptions License Name Description ANM-DEMO or DEMO Used for demonstration purposes. It lasts for 90 days from the issue day of the license and allows you to use all features. ANM-SERVER-50-K9 Used to allow access to the ANM server. Beginning with ANM 4.1, ANM does not perform a license version number check; it will accept any version ANM license. 18-55 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM Guidelines and Restrictions The license manager does not display information related to the 90-day evaluation period that allows you to use ANM immediately after you install the software. When there are 10 days or less remaining to the evaluation period, ANM issues daily warnings that the evaluation period is about to expire. You must install the ANM server license to continue using ANM. Procedure Step 1 Choose Admin > ANM Management > License Management. The Licenses table appears. Table 18-14 describes the contents of this table. Step 2 To add new license, from the Licenses table, click Add. The New License window appears. Step 3 In the New License window, click Browse to locate the new license name. Use the browser to choose the license file. Step 4 Click Upload to install the license you added onto the ANM Server or Cancel to exit. The license file appears in the License Files table. From the License Files table you can see the Install Status of the license file and if there are any errors. Related Topics • ANM Licenses, page 1-7 • Managing ACE Licenses, page 6-36 • Using ANM License Manager to Manage ANM Server or Demo Licenses, page 18-54 • Removing an ANM License File, page 18-55 Removing an ANM License File For ANM server, if your license file does not work in ANM due to file errors, you need to remove it from the ANM host and request another license file from Cisco. There is no ANM GUI remove license command. You must remove the license from the operating system by deleting the file. Table 18-14 License Files Field Description File Name Name of the ANM server or demo license file that you have installed on the ANM host. Install Status Status of the license file. Any licensing errors display here. For ANM server, if errors display, see the “Removing an ANM License File” section on page 18-55 for details about how to remove this file and import a working file. You cannot remove a license from ANM Virtual Appliance; however, a license that displays in error is not a probelm as long as a valid license is also installed. 18-56 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM Guidelines and Restrictions You can remove a license file from ANM server; however, you cannot remove a license file from ANM Virtual Appliance. If you are using ANM Virtual Appliance and have a license that displays in error, it is not an issue as long as a valid license is also installed. Procedure Step 1 Log in as the root user. Step 2 To remove the license file, enter the following: rm /opt/CSCOanm/etc/license/ The license file is removed from the ANM host. Step 3 Restart ANM to allow it to update the licenses table data. To restart ANM, see instructions in the Installation Guide forCisco Application Networking Manager 5.2. To request another license from Cisco to replace the one that had errors, open a service request using the TAC Service Request Tool or call the Technical Assistance Center. Add the license into ANM. Related Topics • ANM Licenses, page 1-7 • Using ANM License Manager to Manage ANM Server or Demo Licenses, page 18-54 • Displaying and Adding ANM Licenses to License Management, page 18-54 Displaying ANM Server Statistics You can display ANM statistics (for example, CPU, disk, and memory usage on the ACE). Procedure Step 1 Choose Admin > ANM Management > Statistics. The statistics viewer displays the fields in Table 18-15. 18-57 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM Related Topics • Checking the Status of the ANM Server, page 18-52 • Configuring ANM Statistics Collection, page 18-57 Configuring ANM Statistics Collection You can enable ACE server statistics polling. Procedure Step 1 Choose Admin > ANM Management > Statistics Collection. The Primary Attributes configuration window appears. Step 2 In the Polling Stats field, click Enable to start background polling or Disable to stop background polling. Step 3 In the Background Polling Interval field, choose the polling interval appropriate for your networking environment. Step 4 Click Deploy Now to save your entries. Related Topics • Checking the Status of the ANM Server, page 18-52 • Displaying ANM Server Statistics, page 18-56 Table 18-15 ACE Server Statistics Name Description Owner Process where statistics are collected. Statistic Statistical information, includes the following: • CPU Usage—Overall ACE CPU busy percentage in the last 5-minute period. • Disk Usage—Amount of disk space being used by the ANM server or ACE device. • Memory Usage—Amount of memory being used by the ANM server or ACE hardware. • Process Uptime—Amount of time since this system was last initialized, or the amount of time since the network management portion of the system was last reinitialized. Value Value of the statistic. Description Information that the statistic gathered. 18-58 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM Configuring Audit Log Settings You can determine how long audit logs are kept in the database. Audit Log Purge Settings allow you to specify the following: • How many days the log records in the database will be kept (default is 31). • The maximum of log records that will be stored in the ANM database (default 100,000). Audit Log File Purge Settings allows you to specify the following: • The number of days worth of log record files that will be stored in the ANM database (default 31 days). • The number of daily rolling files that will be stored in the ANM database (default 10 files each day, allowable file size is 2 Megabytes and is not configurable). Procedure Step 1 Choose Admin > ANM Management > Audit Log Settings. The Audit Log Settings configuration window appears. Audit Log Purge Settings fields let you determine whether audit log table entries will be deleted after a certain number of days (default is 31 days) or after the table entries reach a certain size (default is 100 entries). Step 2 Enter the greatest number of days that you would like entries to be retained in the Number of Days field. Step 3 Enter the maximum amount of log records to be stored in the ANM database in the audit log tables in the Number of Entries (Thousand) field (default 100,000). Audit Log File Purge Settings fields let you determine whether to retain log files according by age (default is 31 days) or by amount saved in a given day (default is 10 entries). Step 4 Enter the greatest number of days that you would like entries to be retained in Number of Days field. Step 5 Enter the greatest number of log files that you would like retained in the Number of Daily Rolling Log Files field. Step 6 Do one of the following: • Click Reset to Default to erase changes and restore the default values. • Click Save Now to save your entries. Related Topics • Performing Device Audit Trail Logging, page 18-59 • Displaying Change Audit Logs, page 18-61 18-59 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM Performing Device Audit Trail Logging Certain configuration and deployment changes are logged in the ANM database and available for displaying according to your role, which is restricted by the ACE virtual context as established by RBAC. Log files are located /var/lib/anm/events/date/audit, where date is in YYYYMMDD format (for example, 20091109 for November 9, 2009). The following changes are logged in ANM: • Configuration deployments to devices • Device or virtual context synchronization operations • Device or virtual context import and deletions • Creation/updates/deletion of the to-be-deployed later by the virtual server Procedure Step 1 Choose Config > device(s) to view > Device Audit. ANM displays all operations described above on the specified devices. See Table 18-16 for a description of the displayed information, some of which is extracted from the syslog. You can sort information in the table by clicking on a column heading, adjust the viewable time range using the drop-down list, and export the table for reporting and troubleshooting purposes. 18-60 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM Table 18-16 Config > Device Audit Fields Field Description Time ANM server timestamp when the action is complete. Client IP Source IP address initiating action. User Email address in the following format: username@organization name for example, admin@cisco.com. Device Device or ACE virtual context target of user action. Action The action name of the operation, including the following: • add staging object • allocate vlan • change credential • create • create vc • create vc-template • create-vip • delete • delete-vip • deploy staging object • disable polling • enable polling • export-certificate-key • generate-csr • import device • import-certificate-key • import module • remove device • remove vc • restart monitoring • syncup config • syslog-setup • unmanage module • update • update staging object • update-vip Target Name of the target configuration object (for example, Serverfarm sf1). Status Indicates whether operation succeeded or not. 18-61 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM Related Topics • Configuring Audit Log Settings, page 18-58 • Displaying Change Audit Logs, page 18-61 Displaying Change Audit Logs You can display ANM change audit logs for example, user login attempts, create/update/delete objects such as RBAC, Global Resource Class, Credential, device group, and threshold setting. Any key or change related activities to the ANM server will be logged and viewed according to your role. To display the change audit logs, choose Admin > ANM Management > ANM Change Audit Log. The audit log displays the fields in Table 18-17. Related Topics • Checking the Status of the ANM Server, page 18-52 • Configuring Audit Log Settings, page 18-58 • Performing Device Audit Trail Logging, page 18-59 Configuring Auto Sync Settings You can configure ANM server auto sync settings. Procedure Step 1 Choose Admin > ANM Management > ANM Auto Sync Settings. The Setup ANM Auto-Sync Settings window appears. Step 2 In the ANM Auto-Sync field of the Setup ANM Auto-Sync Settings window, do one of the following: Detail CLI commands sent to the device and/or error messages. ANM truncates the display if the number of characters for the CLI commands exceeds 100,000 characters. You can view the complete audit output in the audit log file. Table 18-16 Config > Device Audit Fields (continued) Field Description Table 18-17 Server Audit Log Name Description Time Server time stamp when user action is complete. Client IP IP address where action originated. User Email address in the following format: username@organization name for example, admin@cisco.com. Message Boilerplate text descriptive of action taken, usually self-explanatory (for example “User authentication succeeded.” 18-62 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM • Click Enable to have the ANM server automatically sync with ACE CLI when it detects out of band changes. • Click Disable to have the ANM server warn but not take independent action when it detects out of band changes between the server and ACE CLI. Step 3 In the Polling Interval field, choose the polling interval you want the ANM server to employ. Step 4 Click OK to save your entries. Related Topic Synchronizing Virtual Context Configurations, page 6-105 Configuring Advanced Settings This section discusses the Advanced Settings window. This section includes the following topics: • Configuring the Overwrite ACE Logging device-id for the Syslog Option, page 18-62 • Configuring the Enable Write Mem on the Config > Operations Option, page 18-63 • Enabling the ACE Real Server Details Popup Window Option, page 18-64 • Enabling the ACE Server Farm Details Popup Window Option for Virtual Servers, page 18-65 • Enable Mobile Notifications from ANM, page 18-66 • Managing the Syslog Buffer Display in the All Devices Dashboard, page 18-66 • Managing the Display of Virtual Servers in the Operations and Monitoring Windows, page 18-66 Configuring the Overwrite ACE Logging device-id for the Syslog Option Yo can overwrite the ACE logging device-id. By default, ANM Autosync relies on the ACE logging device-id to be of type “String.” A device-id setting adds explicit information that is appended to the syslog message and is used by ANM to identify the source of a syslog message. If you configure ANM to manage syslog settings for Autosync on a virtual context (Config > Devices > Setup Syslog for Autosync) and the logging device-id is defined as something other than type “String” for the context, the operation fails and ANM displays “Syslog device is already configured for other purpose.” You can instruct ANM to overwrite the ACE logging device-id when you enable the synchronization of syslog messages setup of syslog for Autosync from the ACE. If any of the contexts that you are trying to set up a syslog the syslog for Autosync has a device-id setup for a type other than string, ANM will override the device-id with the ANM preferred string. Procedure Step 1 Choose Admin > ANM Management > Advanced Settings. The Advanced Settings configuration window appears. Step 2 In the Overwrite ACE Logging Device ID field of the Advanced Settings configuration window, do one of the following: 18-63 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM • Click Enable to overwrite the logging device-id during Setup Syslog for Autosync. • Click Disable to prevent overwriting the existing logging device-id if it has been previously set up with a type other than string. If the selected context from Setup Syslog for Autosync already has a device-id that is set up with a type other than string, then the operation reports an error and ANM does not overwrite this setting. This is the default setting. Step 3 Click OK to accept your entries on the Advanced Settings configuration window. Related Topics • Enabling a Setup Syslog for Autosync for Use With an ACE, page 5-27 Configuring the Enable Write Mem on the Config > Operations Option You can configure the Enable Write Mem on the Config > Operations feature. By default, ANM initiates a write memory command action after you activate or suspend changes on the ACE, CSM, or CSS through the different ANM Operations Pages (Config > Operations). In certain situations, such as those that involve large configurations, a write memory action can take an extended period of time to complete. In this case, the ANM GUI may time out. If a write memory action is not performed before a device reload occurs, the changes will be lost. You can instruct ANM to enable or disable write memory on a Config > Operations configuration. Note The write memory command is the same as the copy running-config startup-config command; both commands save changes to the configuration. Note The CSS Expert mode must be disabled if you wish to disable the Write Mem on Config > Operations feature. The Expert mode allows you to turn the CSS confirmation capability on or off; turning Expert mode on disables the CSS from prompting for confirmation when configuration changes are made. If Expert mode is enabled on the CSS, this function will cause the CSS to perform an implicit write memory action after each operational change. Procedure Step 1 Choose Admin > ANM Management > Advanced Settings. The Advanced Settings configuration window appears. Step 2 In the Enable Write Mem on Config > Operations field of the Advanced Settings configuration window, do one of the following: • Click Enable to instruct ANM to activate the write memory action on the Config > Operations window. This is the default. • Click Disable to deactivate the write memory action on the Config > Operations window. This option will require you to periodically access the CLI for the ACE context, the CSM, or the CSS and enter the write memory command to commit the change to the startup-configuration file. Step 3 Click OK to accept your entries on the Advanced Settings configuration window. 18-64 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM Enabling the ACE Real Server Details Popup Window Option You can enable the ACE real server Details popup window option that displays real server details by issuing the show rserver detail command to the selected ACE in the real servers operation window (Config > Operations > Real Servers). This top level real server show command displays information that includes total statistics about every serverfarm real server associated with the selected rserver. The ACE real server Details popup window feature is disabled by default. Caution When you enable the ACE real server Details popup window option, the information that displays in the Details popup window may exceed the RBAC restrictions assigned to the user. The following example shows how enabling the ACE real server Details popup window option in ANM can display information that may exceed the RBAC restrictions assigned to a user. In the following CLI example, the ACE displays information for rbac-test:80 and rbac-test:443 in response to the show rserver rbac-test detail command: switch/Admin# sh rserver rbac-test detail rserver : rbac-test, type: HOST state : OUTOFSERVICE --------------------------------- ----------connections----------- real weight state current total ---+---------------------+------+------------+----------+-------------------- serverfarm: sf-rbac-test 0.0.0.0:80 8 OUTOFSERVICE 0 0 serverfarm: sf1-rbac-test 0.0.0.0:443 8 OUTOFSERVICE 0 0 switch/Admin(config-sfarm-host-rs)# When you enable the Details option in ANM, the popup window displays the same information even if the user requesting the information is configured in ANM to have access to rbac-test:80 only. Procedure Step 1 Choose Admin > ANM Management > Advanced Settings. The Advanced Settings configuration window appears. Step 2 In the Enable Details popup window for Config > Operations > Real Servers field of the Advanced Settings configuration window, do one of the following: • Click Enable to enable the ACE real server Details popup window option. • Click Disable to disable the ACE real server Details popup window option. This is the default. Step 3 Click OK to accept your entries on the Advanced Settings configuration window. Related Topics • Displaying Real Servers, page 8-18 18-65 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM Enabling the ACE Server Farm Details Popup Window Option for Virtual Servers You can enable the ACE Server Farm Details popup window option that displays details about the server farms associated with a virtual server. When you enable this feature, the server farms listed in the virtual servers operation window (Config > Operations > Virtual Servers) become hyperlinks that open a popup details window. When you click a server farm associated with a virtual server, ANM issues the show serverfarm detail command to the ACE and displays the command output in the popup window. This top level virtual server show command displays information that includes statistical information related to the real servers associated with the server farm. The ACE Server Farm Details popup window feature is disabled by default. Caution When you enable the ACE Server Farm Details popup window option, the information that displays in the popup window may exceed the RBAC restrictions assigned to the user. For example, information related to real severs that a user is not permitted to access may display. The following is an example of the show serverfarm test-sf detail command output: serverfarm : test-sf, type: REDIRECT total rservers : 1 active rservers: 0 description : - state : INACTIVE predictor : ROUNDROBIN failaction : - back-inservice : 0 partial-threshold : 0 num times failover : 0 num times back inservice : 0 total conn-dropcount : 0 --------------------------------- ----------connections----------- real weight state current total failures ---+---------------------+------+------------+----------+----------+--------- rserver: anm-vm-119 0.0.0.0:0 8 OUTOFSERVICE 0 0 0 description : - max-conns : - , out-of-rotation count : - min-conns : - conn-rate-limit : - , out-of-rotation count : - bandwidth-rate-limit : - , out-of-rotation count : - retcode out-of-rotation count : - Procedure Step 1 Choose Admin > ANM Management > Advanced Settings. The Advanced Settings configuration window appears. Step 2 In the “Enable Details popup window for Config > Operations > Virtual Servers” field of the Advanced Settings configuration window, do one of the following: • Click Enable to enable the ACE Server Farm Details popup window option. • Click Disable to disable the ACE Server Farm Details popup window option. This is the default. Step 3 Click OK to accept your entries on the Advanced Settings configuration window. 18-66 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Managing ANM Related Topic “Displaying Virtual Servers” section on page 7-81 Enable Mobile Notifications from ANM You can enable ANM to send alarm notifications to supported mobile devices that are using the ANM Mobile app. By default, this feature is disabled. For details about the enabling this advanced setting, see the “Globally Enabling or Disabling Mobile Device Notifications” section on page 18-69. Related Topics • Globally Enabling or Disabling Mobile Device Notifications, page 18-69 • Configuring Alarm Notifications on ANM, page 17-57 • Administering the ANM Mobile Feature, page 18-67 • Chapter 19, “Using ANM Mobile” Managing the Syslog Buffer Display in the All Devices Dashboard You can choose to show or hide the syslog buffer information that displays in the Top 10 Current Resources pane of the All Devices Dashboard window (Monitor > Devices > Dashboard >All Devices). You may want to hide this information because it will always show 100 percent after the buffer becomes full and starts to wrap. Procedure Step 1 Choose Admin > ANM Management > Advanced Settings. The Advanced Settings configuration window appears. Step 2 Check the Hide 'Syslog Buffer' details in 'Top 10 Current Resources' in Dashboard Pane (All devices dashboard) check box to hide the syslog information. Uncheck the check box to display the syslog information. Step 3 Click OK to accept your entries on the Advanced Settings configuration window. Step 4 (Optional) Choose Monitor > Devices > Dashboard >All Device to view the change to the Top 10 Current Resources pane. For more information, see the “Top 10 Current Resources Table” section on page 17-20. Managing the Display of Virtual Servers in the Operations and Monitoring Windows You can choose to show only ANM recognized virtual servers or all virtual servers in the virtual server windows for Config Operations (Config > Operations > Virtual Servers) and Monitor Devices (Monitor > Devices > Load Balancing > Virtual Servers). ANM recognized virtual servers are virtual servers that match ANM’s virtual server definition (see “Virtual Server Configuration and ANM” section on page 7-2). When you have the display set to display all virtual servers, it includes virtual servers that match ANM’s virtual server definition and those that do not match this definition but that ANM can recognize as virtual servers using SNMP polling 18-67 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Administering the ANM Mobile Feature Procedure Step 1 Choose Admin > ANM Management > Advanced Settings. The Advanced Settings configuration window appears. Step 2 Do one of the following to specify the virtual server types that display in the Operations and Monitor windows for virtual servers: • Check the Display All Virtual Servers in Monitoring & Operations page (Virtual Servers that have class-map/policy-map definitions) check box to display virtual servers that match ANM’s virtual server definition and those that do not match this definition but that ANM can recognize as virtual servers using SNMP polling. When this option is checked, the virtual server windows for Config Operations and Monitor Devices includes a display toggle button ( ) located above the table that allows you to change from viewing all virtual servers to viewing only ANM recognized virtual servers. • Uncheck the check box to display only virtual servers that match ANM’s virtual server definition (see the “Information About Using ANM to Configure Virtual Servers” section on page 7-4. This is the default. Step 3 Click OK to accept your entries on the Advanced Settings configuration window. Step 4 (Optional) Choose Config > Operations > Virtual Servers to view the change. Administering the ANM Mobile Feature ANM Mobile is a mobile device app that allows supported mobile devices to access your ANM server or ANM Virtual Appliance and manage the network objects in much the same way you do from an ANM client as described in Chapter 19, “Using ANM Mobile.” This section describes how to configure ANM to send alarm notifications to ANM Mobile, which requires configuring ANM with a push notification proxy server and globally enabling the mobile notification feature. For remotely authorized users, you must also modify the ANM configuration to allow ANM to send this user type mobile notifications. After you have ANM configured to issue mobile notifications, you can send a test message to test the notification channel between ANM and the mobile device. You can also view a list that shows the last notification that ANM issued to each mobile device. This section includes the following topics: • Configuring ANM with a Proxy Server for ANM Mobile Push Notifications, page 18-67 • Enabling Mobile Device Notifications for Remotely Authorized Users, page 18-69 • Globally Enabling or Disabling Mobile Device Notifications, page 18-69 • Displaying Mobile Device Notifications and Testing the Notification Channel, page 18-70 Configuring ANM with a Proxy Server for ANM Mobile Push Notifications You can modify the ANM properties file for ANM Mobile push (or alarm) notifications. ANM is preconfigured to send ANM Mobile notifications directly to the Cisco proxy service. If your network does not allow direct access to the proxy service, you can configure ANM to send notifications to your proxy server, which in turn forwards the notifications to the Cisco proxy service. 18-68 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Administering the ANM Mobile Feature Prerequisites ANM has alarm threshold groups configured for mobile device alarm notifications (see the “Configuring Alarm Notifications on ANM” section on page 17-57). Procedure Step 1 Specify a proxy server to use as follows: • ANM Server—Open the /opt/CSCOanm/etc/cs-config.properties file in a text editor and modify the following lines: – proxy-type=type Specify a type of either ssl or socks depending on your network requirements. – proxy-server=proxy_IPaddress Specify the IP address of your proxy server. – proxy-server-port=port_number Specify the port to use to communicate with your proxy server. • ANM Virtual Appliance—Enter the following commands: – anm-property set proxy-type type Specify a type of either ssl or socks depending on your network requirements. – anm-property set proxy-server proxy_IPaddress Specify the IP address of your proxy server. – anm-property set proxy-server-port port_number Specify the port to use to communicate with your proxy server. Step 2 Restart ANM as follows: • ANM Server—Enter the following command: /opt/CSCOanm/bin/anm-tool restart • ANM Virtual Appliance—Enter the following command: anm-tool restart Step 3 Allow ANM to send alarm notifications to supported mobile devices. For more information, see the “Globally Enabling or Disabling Mobile Device Notifications” section on page 18-69. Step 4 (Optional) Send a test notification to a mobile device. For more information, see the “Displaying Mobile Device Notifications and Testing the Notification Channel” section on page 18-70. Related Topics • Enabling Mobile Device Notifications for Remotely Authorized Users, page 18-69 • Globally Enabling or Disabling Mobile Device Notifications, page 18-69 • Displaying Mobile Device Notifications and Testing the Notification Channel, page 18-70 • Chapter 19, “Using ANM Mobile” 18-69 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Administering the ANM Mobile Feature Enabling Mobile Device Notifications for Remotely Authorized Users You can modify the ANM configuration when you need to send mobile device alarm notifications to users that are authorized remotely using an AAA server. Guidelines and Restrictions When you enable alarm notifications to remotely authorized users, ANM does not perform any RBAC filtering of alarms to users, which means that remotely authorized users receive all alarm notifications regardless of the roles and domains assigned to them. Procedure Step 1 Enable mobile device notifications for remotely authorized users as follows: • ANM Server—Open the /opt/CSCOanm/etc/cs-config.properties file in a text editor and change the state of the following line from false to true: send.mobile.notifications.to.remote.users=true • ANM Virtual Appliance—Enter the following command: anm-property set send.mobile.notifications.to.remote.users true Step 2 Restart ANM as follows: • ANM Server—Enter the following command: /opt/CSCOanm/bin/anm-tool restart • ANM Virtual Appliance—Enter the following command: anm-tool restart Step 3 Globally enable ANM to send mobile device alarm notifications (see the “Globally Enabling or Disabling Mobile Device Notifications” section on page 18-69). Related Topics • Configuring ANM with a Proxy Server for ANM Mobile Push Notifications, page 18-67 • Globally Enabling or Disabling Mobile Device Notifications, page 18-69 • Displaying Mobile Device Notifications and Testing the Notification Channel, page 18-70 • Chapter 19, “Using ANM Mobile” Globally Enabling or Disabling Mobile Device Notifications You can globally enable or disable mobile device notifications from ANM. Prerequisites This topic includes the following prerequisites: • ANM has alarm threshold groups configured for mobile device alarm notifications (see the “Configuring Alarm Notifications on ANM” section on page 17-57). 18-70 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Administering the ANM Mobile Feature • ANM is allowed to send alarm notifications outside your network to the Cisco proxy service either directly (default) or through a specified proxy server (see the “Configuring ANM with a Proxy Server for ANM Mobile Push Notifications” section on page 18-67). • For remotely authorized users only, you must modify the ANM config.properties file to allow ANM to send notifications to this user type (see the “Enabling Mobile Device Notifications for Remotely Authorized Users” section on page 18-69). Procedure Step 1 Choose Admin > ANM Management > Advanced Settings. The Advanced Settings configuration window appears. Step 2 In the “Enable mobile notifications from ANM” field of the Advanced Settings configuration window, do one of the following: • Click Enable to allow ANM to send alarm notifications to mobile devices using ANM Mobile. • Click Disable to not allow ANM to send alarm notification to mobile devices. This is the default. Step 3 Click OK to accept your entries on the Advanced Settings configuration window. Step 4 (Optional) Send a test notification to a mobile device. For more information, see the “Displaying Mobile Device Notifications and Testing the Notification Channel” section on page 18-70. Related Topics • Configuring Advanced Settings, page 18-62 • Configuring ANM with a Proxy Server for ANM Mobile Push Notifications, page 18-67 • Enabling Mobile Device Notifications for Remotely Authorized Users, page 18-69 • Displaying Mobile Device Notifications and Testing the Notification Channel, page 18-70 • Chapter 19, “Using ANM Mobile” Displaying Mobile Device Notifications and Testing the Notification Channel You can display the list of ANM Mobile alarm notifications and send a customized test message to a mobile device. Guidelines and Restrictions This topic includes the following guidelines and restrictions: • ANM displays only the last notification sent to a mobile device. • You can send a test message to a mobile device even when you have globally disabled mobile device alarm notifications in ANM. For information about managing mobile device alarm notifications, see the “Globally Enabling or Disabling Mobile Device Notifications” section on page 18-69. Procedure Step 1 Choose Admin > Role-Based Access Control > Mobile Notifications. 18-71 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Administering the ANM Mobile Feature The Mobile Notifications window appears. Table 18-18 describes the information displayed. Step 2 (Optional) To manage which fields display in the Mobile Notifications window, do the following: a. Click the Customize button ( ) and choose Configure from the menu that appears. The Mobile Notifications List Configuration popup window appears. b. From the popup window, choose the fields that you want to display and make any other display modifications that you want to see. Be sure to enter a name in the List Customization Name field if you want to assign a name to the customized display. This option allows you to recall the customized display if you return to the default display. c. Do one of the following: – Click Save to save the settings to the name that you provided in the List Customization Name field. – Click Cancel to exit the popup window without making any changes. – Click Apply to apply the changes to the Mobile Notifications window without saving the display settings to a new name. Step 3 (Optional) To test the notification channel between ANM and a mobile device, send the device a test message by doing the following: a. Choose the device from the Mobile Devices window and click Send Test Message. The Send Test Message to Device dialog box appears. b. In the dialog box, enter a message (150 characters maximum) to send the device and click Send. ANM sends the test message, which can be verified on the targeted device. Related Topics • Displaying a List of Users, page 18-18 • Configuring ANM with a Proxy Server for ANM Mobile Push Notifications, page 18-67 • Enabling Mobile Device Notifications for Remotely Authorized Users, page 18-69 • Globally Enabling or Disabling Mobile Device Notifications, page 18-69 • Chapter 19, “Using ANM Mobile” Table 18-18 Mobile Notifications Window Field Description Owner Mobile device owner. UUID Unique ID of the user who last logged in to ANM from the mobile device. Device Type Mobile device type. Device OS Mobile device operating system information. Last Registration Time Last time the mobile device passed a device token to ANM. Time Zone1 1. This field is not shown in the default view of the Mobile Notifications window. See Step 2 to manage which fields display. Time zone associated with the mobile device. Last Notification Time1 Last time that ANM sent an alarm notification to the mobile device. 18-72 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 18 Administering the Cisco Application Networking Manager Lifeline Management Lifeline Management You can use the troubleshooting and diagnostics tools provided by the Lifeline feature to report a critical problem to the Cisco support line and generate a diagnostic package. For more information about this feature, see the “Using Lifeline” section on page 20-7. CHAPTER 19-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 19 Using ANM Mobile Date: 3/28/12 This chapter describes Cisco ANM Mobile, which allows you to access your ANM server or ANM Virtual Appliance and manage your devices using a mobile device such as an iPhone or Android smartphone. This chapter contains the following sections: • Information About ANM Mobile, page 19-2 • ANM Mobile Prerequisites and Supported Devices, page 19-4 • Guidelines and Restrictions, page 19-5 • Using ANM Mobile, page 19-5 19-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile Information About ANM Mobile Information About ANM Mobile ANM Mobile allows supported mobile devices to access to your ANM server or ANM Virtual Appliance and manage the network objects in much the same way you do from an ANM client. Using a mobile device, you can run ANM Mobile as a native application (app) or inside the mobile device browser. Using either the native app or the mobile device browser, you can perform the following tasks: • Activate or suspend a real server, virtual server, VIP answer, or DNS rule. • Access the status and details of a real server, virtual server, VIP answer, or DNS rule. • Change the weight of a real server. • Display a real-time chart of a real or virtual server statistical metric, such as the number of connections. • Display the Operation Summary (similar to the Device Configuration Summary Panel inside the ANM dashboard) by object type (Real Server, Virtual Server, VIP Answer or DNS Rule) in category of healthy, unhealthy, and others. You can drill down to see the list of objects in the selected category and object type. • (Native app only) Receive alarm notifications from ANM when conditions exist that require your attention. • Add frequently accessed objects to the Favorite screen. • Use the search feature to find managed objects, such as a device, real server, virtual server, VIP answer, or DNS rule. • View the alarm summary and details. • Change the real time chart polling interval and connection time out values. • Save your access credentials. • From ANM’s Mobile Devices window (Admin > Role-Based Access Control > Mobile Devices), system administrators can view the list of registered mobile users and send a test push notification message to a user’s mobile device. Table 19-1 shows the main differences between using ANM Mobile as a native app or using it in the mobile device’s browser. Figure 19-1 provides an overview of ANM Mobile, including the components that are available with the native app only. Table 19-1 Major ANM Mobile Differences Between Native App and Mobile Browser Category Native Application Mobile Browser ANM Notification Service (native app only) Supported Not supported Client application (ANM Mobile) download and installation Required Not required1 1. When using a mobile device browser, you enter the ANM server IP address in the browser address bar, at which point you are redirected to ANM Mobile. Upgrade Required download and installation of latest version Part of the ANM server upgrade process 19-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile Information About ANM Mobile Figure 19-1 ANM Mobile Overview The components in Figure 19-1 are as follows: 1. ANM Mobile app—Obtain the no-cost Cisco ANM Mobile app from the app store or market associated with the mobile device. 2. Mobile device login—Enter ANM IP address, username, and password to log in to ANM server or ANM Virtual Appliance from the mobile device. After a successful login, ANM associates the mobile device with the user (see the “Displaying a List of Users” section on page 18-18). 3. Access ANM—Access ANM functionality to monitor your network and perform operational tasks. For more information, see the “Using ANM Mobile” section on page 19-5. 4. Alarm Notifications—ANM sends alarm notifications to a mobile device (native app required) through a proxy service. For more information, see the “Setting Up and Viewing Mobile Device Alarm Notifications” section on page 19-13. 5. Cisco Proxy Service—Standalone server (managed by Cisco IT) that forwards notification messages from ANM to the Apple or Google Push Notification Service. The proxy service, which is hosted by Cisco and used for alarm notifications, manages the push notification messages that ANM issues by forwarding them to the Apple or Android Push Notification Services. For more information, see the “Configuring ANM with a Proxy Server for ANM Mobile Push Notifications” section on page 18-67. 6. Push notification service—Allows a third-party server, such as the ANM server, to send notification messages securely to a mobile device. The push notification services provided by APPLE and Google are used for alarm notifications and are best effort; therefore, the push notification service provided by Cisco is also best-effort. 19-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile ANM Mobile Prerequisites and Supported Devices Related Topics • ANM Mobile Prerequisites and Supported Devices, page 19-4 • Guidelines and Restrictions, page 19-5 • Using ANM Mobile, page 19-5 ANM Mobile Prerequisites and Supported Devices This section describes the ANM and mobile device requirements needed to use ANM Mobile. ANM Server and ANM Virtual Appliance Requirements Your ANM server or ANM Virtual Appliance must be using ANM software Version 5.1 or later to access ANM Mobile. To utilize the alarm notification feature, ANM must be configured to send notifications (see the “Administering the ANM Mobile Feature” section on page 18-67). Mobile Device Requirements Table 19-2 shows the mobiles devices that ANM Mobile version 1.0 supports. Use following links to download the ANM Mobile app to your smartphone: • ANM Mobile on iPhone • ANM Mobile on Android • ANM Mobile on Cisco Cius Related Topics • Information About ANM Mobile, page 19-2 • Guidelines and Restrictions, page 19-5 • Using ANM Mobile, page 19-5 Table 19-2 Supported Devices OS Platform Tested Version Native Application Mobile Browser Tested Device Types Apple iOS 4.2 and 4.3 Yes Safari iPhone, iPod, iPad Android 2.2, 2.3.3, 2.3.6 Yes Default Android Browser Tested on the following Android handsets: HTC Inspire 4G, HTC Desire, Google Nexus One, Cisco Cius Note ANM Mobile may also work on other Android devices, but testing was performed on the above-mentioned set of Android handsets. 19-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile Guidelines and Restrictions Guidelines and Restrictions ANM Mobile includes the following guidelines and restrictions: • Communication guidelines are as follows: – Communication between ANM Mobile and ANM is secure over HTTPS. Note Ensure that your mobile device network setting permits access to ANM. – User authentication is required to access the web services. – The existing ANM user account is used to log in to ANM from the mobile device. – All the existing RBAC (role-based access control) for the login user are enforced. • The alarm notification feature requires access to the Internet. Depending on your network requirements, ANM can communicate directly with the Cisco proxy service or you can configure ANM to use your proxy server when issuing alarm notifications to the proxy service. For more information, see the “Configuring ANM with a Proxy Server for ANM Mobile Push Notifications” section on page 18-67. • The number of ANM Mobile users that can simultaneously connect to a single ANM server or ANM Virtual Appliance is limited to 35. • (Android devices only) When navigating within the ANM Mobile native app, you must use the navigation tools provided by the native app because the native Android navigation tools are not supported. Related Topics • Information About ANM Mobile, page 19-2 • ANM Mobile Prerequisites and Supported Devices, page 19-4 • Using ANM Mobile, page 19-5 Using ANM Mobile This section shows how to log in to ANM Mobile from your mobile device and then use its features to manage your network. If you are using the ANM Mobile app and want to use the alarm notification feature, this section also describes how to configure ANM and the ANM Mobile to enable this feature. This section includes the following topics: • Logging In and Out of ANM Mobile, page 19-6 • Using the Favorites Feature, page 19-6 • Monitoring Managed Object Status, page 19-7 • Modifying an Object’s Operating State or Weight, page 19-10 • Displaying Real Time Charts, page 19-12 • Using the ANM Mobile Setting Feature, page 19-12 • Setting Up and Viewing Mobile Device Alarm Notifications, page 19-13 19-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile Using ANM Mobile Logging In and Out of ANM Mobile This section shows how to log in to and out of ANM Mobile from your mobile device. Prerequisite If you want to log in and use the native app version of ANM Mobile, you must have the Cisco ANM Mobile app loaded on your mobile device. This no-charge app is available at the application store or market associated with any supported mobile device type. Procedure Step 1 From your mobile device, do one of the following depending on whether you are using a browser to access ANM Mobile or using the ANM Mobile native app: • Browser—Open the browser and in the address box, enter the IP address of the ANM server or ANM VA using the following format: https://ANM_IPaddress The Login window appears. Enter your username and password. • ANM Mobile app—Do the following: a. Click the ANM Mobile app icon to launch the application. The Login window appears. b. From the login window, enter the IP address and port number of the ANM server or ANM Virtual Appliance and your username and password. c. (Optional) Change the Save Credentials setting by doing the following: - Click ON to save your user credentials. This is the default. When set to ON, you just have to click Log In to log back in to ANM Mobile. - Click OFF to not save your user credentials. Step 2 Click Log In. The monitor page appears unless you have at least one favorite object specified, in which case the Favorites windows appears (see the “Using the Favorites Feature” section on page 19-6). Step 3 To log out of ANM Mobile, click Settings and click Log Out. Using the Favorites Feature The favorites feature allows you to create short cuts to ANM objects that you frequently access. When you specify at least one favorite object, the Favorites window becomes the home page that appears when you log in to ANM Mobile. Guidelines and Restrictions • Favorite objects that are no longer available are grayed out. Object may no longer be available for the following reasons: – The object no longer exists in the ANM server because the object or the object’s host Virtual Context was deleted. – An RBAC change was made that prevents access by the user. 19-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile Using ANM Mobile To remove a grayed out object from the favorites list, you must delete it. • If you are using the ANM Mobile native app and want to receive alarm notifications from ANM, you must specify favorites on ANM Mobile that match the objects that you select for alarm notifications when configuring an alarm threshold group on ANM. For more information, see the “Setting Up and Viewing Mobile Device Alarm Notifications” section on page 19-13. Procedure Step 1 Display the Favorites window by clicking the Favorites button located at the bottom of the window. The Favorites window appears. Step 2 To view a favorite object, click the object from the Favorites list. Step 3 To add an object to the Favorites window, do one of the following: • From the Favorites window, click the Add icon (+) to open the search GUI, from which you can locate and choose the object. To add multiple objects, repeat this step for each object. • From the detailed managed object window, click the Add icon (+). For more information, see the “Monitoring Managed Object Status” section on page 19-7. Step 4 To delete a favorite from the list, do the following: a. Click the favorite to delete and click Edit. The Edit view appears. b. From the Edit view, click the red Delete icon (–) located next to the favorite listing to delete. ANM Mobile removes the favorite from the list. Monitoring Managed Object Status You can monitor the operating status of the managed objects and drill down for details. Figure 19-2 shows a sample of the Device Monitor windows, which can display objects sorted as follows: • Service—Displays objects sorted by the following service types: Real Server, Virtual Servers, VIP Answers, and DNS Rules. • Device—Displays objects sorted by the following device types: ACE Modules, ACE Appliance, CSS, CSM, and GSS. 19-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile Using ANM Mobile Figure 19-2 ANM Mobile Monitor Windows: Service Type and Device Type Each object type includes three color-coded status function buttons that list the number of object types in each of the following operational states: • Up (green)—Objects in service. • Down (red)—Objects out of service. • Unknown (yellow)—Object operating state cannot be determined by ANM. The status function buttons allow you to display only the objects of the specified object type and operating state. Table 19-3 lists the details that you can view for each object type when you set the monitor display to Service. Table 19-3 Managed Object Details Object Type Attribute Virtual Server Name Policy Map IP address, protocol, and port number Device Admin status Operating status Server Farm Current Connections Connections per second Dropped Connections per second Dynamic Workload Scaling (DWS) Stat Age 19-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile Using ANM Mobile Guidelines and Restrictions ANM Mobile is limited to approximately 7 KB of memory for the monitored objects list. If you have more than 100 monitored objects, ANM Mobile may exhibit performance issues. To avoid performance issues associated with a large number of monitored objects, do the following: • Do not drill down to the detail list screen from the Monitor home page (see Figure 19-2). To display the detail information or the health status of a monitored object, use the search function from the Monitor home page by clicking the search icon (magnifying glass) and entering the object identifier. Real Server Name IP address Port Server Farm Device Admin status Operating status Weight Current connections Connections per second Dropped connections per second Virtual Machine (indicates if the real server is a virtual machine) Locality (OTV) Statistics Age VIP Answer SLB name VIP answer name IP address Config state PGSSM operation status Answer group Location PGSSM time DNS Rule Device name DNS Rule name Source name Domains Config state Answer group Owner PGSSM time Table 19-3 Managed Object Details (continued) Object Type Attribute 19-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile Using ANM Mobile If needed, refine your search criteria until the number of objects displayed is reduced to less than 100. When in the search window, limit your use of the drill down (>) option, which can also create performance issues. • For monitored objects that you track frequently, add them to your list of Favorites and access their information from there (see the “Using the Favorites Feature” section on page 19-6). Procedure Step 1 Click Monitor. The View All window appears. Step 2 Click one of the color-coded function buttons associated with an object type to drill down and display a list of objects associated with an object type and operating state (up, down, or unknown). The specified object type details windows appears, displaying a list of the objects in the chosen operating state (up, down, or unknown). Step 3 Do any of the following: • Click a specific object from the list to display details about the object. The information that displays varies depending on the object type (see Table 19-3). From the object details window, you can do the following: – Activate, suspend, or change the weight of an object (see the “Modifying an Object’s Operating State or Weight” section on page 19-10). – Display a real time chart of monitored statistics (see the “Displaying Real Time Charts” section on page 19-12). • Click the Search icon to open the search text box and search for a specific object. Begin entering the search criteria. Object matches display and become more specific as you narrow the search by entering additional search criteria. • Click the Refresh icon to refresh the display. • Click Back to return to the object details window. Related Topics • Modifying an Object’s Operating State or Weight, page 19-10 • Displaying Real Time Charts, page 19-12 Modifying an Object’s Operating State or Weight You can use ANM Mobile to activate or suspend a real server, virtual server, VIP answer or DNS rule. For real servers only, you can change the weight assigned to the server. Procedure Step 1 Use one of the following methods to display the details window of a specific object: 19-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile Using ANM Mobile • Choose Monitor > Service, choose a specific device type, and drill down (>) to the object details window. • Click Favorites, choose a specific favorite and drill down (>) to the object details window. • Click the Search icon (magnifying glass), enter the device search criteria, choose the device, and drill down (>) to the object details window. • Click Alarm, choose a specific device type and drill down (>) to the object details window. Step 2 From the object details window, do one of the following: • Click Activate to activate an object that s currently suspended. The Activate dialog box appears. In the dialog box, do the following: a. Enter a reason for the change. b. Click Deploy to execute the change or Cancel to ignore the change. • Click Suspend to suspend an object currently activated. The Suspend dialog box appears. In the dialog box, do the following: a. Enter a reason for the change. b. Choose one of the following types of suspend operations from the drop-down list: - Suspend—Takes the object out of service. For a real server, the ACE resets all non-TCP connections to the server. For TCP connections, existing flows are allowed to complete before the ACE takes the real server out of service. No new connections are allowed. The ACE resets all Secure Sockets Layer (SSL) connections to the real server. - Graceful—When executed on a primary server, the ACE gracefully shuts down the server with sticky connections as follows: – Tears down existing non-TCP connections to the server. – Allows current TCP connections to complete. – Allows new sticky connections for existing server connections that match entries in the sticky database. – Load balances all new connections (other than the matching sticky connections mentioned above) to the other servers in the server farm. – When executed on a backup real server, the ACE places the backup server in service standby mode. - Suspend and Clear Connections—The ACE performs the tasks described for Suspend and clears the existing connections to this server. c. Click Deploy to execute the change or Cancel to ignore the change. • (Real server only) Click Change Weight to change weight assigned to a real server. The Change Weight dialog box appears. In the dialog box, do the following: a. Enter a reason for the change. b. Enter the new weight value. The valid range is 1 to 100. c. Click Deploy to execute the change or Cancel to ignore the change. The activity indicator appears for 30 seconds until it is determined that the operation succeeded, failed, or timed out. If the operation is successful, the object detail window is reloaded with the latest data and updated timestamp. 19-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile Using ANM Mobile Displaying Real Time Charts You can display real time statistical information about the connections of a real server or a virtual server. Information that you can display in chart form are current connections, connections per second, or dropped connections per second. Guidelines and Restrictions The chart never displays more than 5 minutes worth of statistical information. Procedure Step 1 Use one of the following methods to display the details window of a specific real server or a virtual server: • Choose Monitor > Service, choose a specific device type, and drill down (>) to the object details window. • Click Favorites, choose a specific favorite and drill down (>) to the object details window. • Click the Search icon (magnifying glass), enter the device search criteria, choose the device, and drill down (>) to the object details window. • Click Alarm, choose a specific device type and drill down (>) to the object details window. Step 2 From the details window, click the Chart icon located next to the statistic to chart. The chart window appears. Step 3 Do the following: • Click the Refresh icon to refresh the display. • To adjust the polling time, click Settings (see the“Using the ANM Mobile Setting Feature” section on page 19-12). The default polling time is 10 seconds. • Click Back to return to the object details window. Using the ANM Mobile Setting Feature The ANM Mobile Setting feature allows you to do the following: • Display the ANM IP address. • Display ANM Mobile software information. • Adjust the connection timeout value and polling interval. • Enable or disable push notifications, sound, and alerts. • Submit an ANM user feedback form to Cisco. Procedure Step 1 From the All Devices or Favorites window, click Settings. The Settings window appears. Step 2 From the Settings window, do the following: 19-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile Using ANM Mobile • Click About to do the following: – Display details about the version of ANM Mobile that you are using and the version of ANM software being used by the ANM server or ANM Virtual Appliance that you are accessing. – Click UDID to display the unique device ID (UDID). • Click Advanced to access the Advanced Details window and modify the following settings: – Connection Timeout—Sets the amount of idle time (in seconds) at which the connection closes. Choose 10, 30 (default), or 60. – Polling Interval—Sets the frequency (in seconds) at which real time information, such as graph information, is updated. Choose 5, 10 (default), or 30. • Click the ON/OFF toggle buttons to enable or disable the following features: – Push Notifications—When enabled (ON), allows your mobile device to receive alarm notifications that ANM issues to a push notification service. For more information, see the “Setting Up and Viewing Mobile Device Alarm Notifications” section on page 19-13. – Sound—(Android only) When enabled (ON), your mobile device sounds an alert to let you know that it received an alarm notification from ANM. Note To modify this setting on an iPod, see the “Managing iPod Alarm Notification Sound and Alerts” section on page 19-16. – Alert—(Android only) When enabled (ON), your mobile device displays an alert message to let you know that it received an alarm notification from ANM. Note To modify this setting on an iPod, see the “Managing iPod Alarm Notification Sound and Alerts” section on page 19-16. • Click the Form pen icon ( ) to fill out and submit the ANM user feedback form hosted on www.ciscofeedback.vovici.com. Setting Up and Viewing Mobile Device Alarm Notifications Note The alarm notifications feature requires the ANM Mobile app on your mobile device. You can receive alarm notifications that ANM sends to your mobile device (see Figure 19-1) when specific virtual context alarm thresholds are exceeded. ANM Mobile app users can enable or disable the alarm notification feature, which allows them to choose when to receive alarm notifications from ANM. ANM administrators can enable or disable the alarm notification feature, which allows them to choose when to transmit alarm notifications to the ANM Mobile app. Supported real and virtual server alarm conditions are as follows: • Current connections—ANM can send an alarm notification when the number of active connections to a server exceeds a specific amount. • Operational state—ANM can send an alarm when a server’s operational state changes. 19-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile Using ANM Mobile Guidelines and Restrictions This topics includes the following guidelines and restrictions: • The ANM objects that you select for alarm notifications when configuring an alarm threshold group must match objects that you select as favorites on ANM Mobile. Alarm threshold groups are configured at the virtual context level; therefore, to receive alarm notifications for an object that you specify as a favorite, the object favorite must be part of the virtual context in the threshold group. • The alarms that ANM Mobile displays depends on how the user is authorized as follows: – Locally authorized users—ANM displays only alarms that are permitted based on the domains and roles assigned to the user account (see the Prerequisites for this topic). – Remotely authorized users—By default, ANM does not send alarm notifications to remotely authorized user accounts; however, you can modify the ANM configuration so that ANM sends all alarm notifications to this user type regardless of the domains and roles assigned to them (see the Prerequisites for this topic). • From ANM, you can do the following: – Enable or disable the alarm notification feature, which allows you to choose when to transmit alarm notifications to the ANM Mobile app (see the “Enabling Alarm Notifications on ANM Mobile” section on page 19-15). – Send a test alarm notification to a mobile device to test the notification channel (see the “Displaying Mobile Device Notifications and Testing the Notification Channel” section on page 18-70). You can send a test message to a mobile device even when you have globally disabled mobile alarm notifications in ANM. Prerequisites The prerequisites for this topic are as follows: • ANM prerequisites: – ANM software Version 5.1 or later. – Alarm threshold groups are configured on ANM for mobile device alarm notifications. For details about creating an alarm threshold group, see the “Configuring Alarm Notifications on ANM” section on page 17-57. – Alarm notifications are enabled globally in ANM. For details, see the “Enable Mobile Notifications from ANM” section on page 18-66. – For locally authorized users, their user account has the required role and domains associated with it. Note The user role must have the anm_threshold attribute set at least to View. For more information, see the “Managing User Accounts” section on page 18-17. – For remotely authorized users, the ANM configuration is modified to enable ANM to send these users alarm notifications. For more information, see the “Enabling Mobile Device Notifications for Remotely Authorized Users” section on page 18-69. • Mobile device prerequisites: – The ANM Mobile app is loaded on your supported mobile device. – ANM objects specified as favorites on your mobile device match the objects in an ANM alarm threshold group. For example, specific real or virtual servers that are favorites on your mobile device are also specified as objects in an ANM alarm threshold group. 19-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile Using ANM Mobile For information about specifying favorites on your mobile device, see the “Using the Favorites Feature” section on page 19-6. This section includes the following topics: • Enabling Alarm Notifications on ANM Mobile, page 19-15 • Viewing Alarm Notifications from ANM Mobile, page 19-15 Enabling Alarm Notifications on ANM Mobile From your mobile device, you can specify whether to receive or not receive alarm notifications from ANM by using the Setting button to modify the ANM Mobile operational settings. For details about using this button, see the “Using the ANM Mobile Setting Feature” section on page 19-12. Related Topics • Using the ANM Mobile Setting Feature, page 19-12 • Setting Up and Viewing Mobile Device Alarm Notifications, page 19-13 • Viewing Alarm Notifications from ANM Mobile, page 19-15 • Managing iPod Alarm Notification Sound and Alerts, page 19-16 Viewing Alarm Notifications from ANM Mobile From your mobile device, you can view alarm notifications that ANM sends to the device. For each notification, you can drill down to view the device details. Procedure Step 1 Click Alarms. The Alarm Summary window appears, displaying the list of received alarms that you are permitted to view (see the Prerequisites for this topic). Step 2 (Optional) Click the drill-down icon (>) associated with a specific alarm to display details about the alarm. The Alarm Detail window appears, displaying the following information: • Timestamp • Severity • Device • Service • Threshold Group • Category • Stat/Value Step 3 (Optional) From the Service category, click the drill-down (>) icon to display the object Details window related to the real or virtual server associated with the alarm notification. Step 4 (Optional) From the object Details window, do any of the following: 19-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 19 Using ANM Mobile Using ANM Mobile • Click View Graph to display the graphs associated the following real server and virtual server items: Current Connections, Connections/Sec, or Dropped Connection/Sec. For more information, see the “Displaying Real Time Charts” section on page 19-12. • Click Activate, Suspend, or Change Weight to change the object’s operating state or weight. For more information, see the “Modifying an Object’s Operating State or Weight” section on page 19-10. Related Topics • Setting Up and Viewing Mobile Device Alarm Notifications, page 19-13 • Enabling Alarm Notifications on ANM Mobile, page 19-15 • Managing iPod Alarm Notification Sound and Alerts, page 19-16 • Using the ANM Mobile Setting Feature, page 19-12 Managing iPod Alarm Notification Sound and Alerts You can manage the alarm notification sound and alert features on your iPod that let you know when an alarm notification is received from ANM. Note To manage the alarm notification sound and alert features on your Android device, see the “Using the ANM Mobile Setting Feature” section on page 19-12. Procedure Step 1 From your IPod Setting window, choose Notifications > ANM Mobile to drill down to the ANM Mobile settings. The Notifications, ANM Mobile window appears. Step 2 From the Notifications, ANM Mobile window, click the ON/OFF toggle buttons to enable or disable the following features: – Sound—When enabled (ON), your iPod sounds an alert to let you know that it received an alarm notification from ANM. – Alert—When enabled (ON), your iPod displays an alert message to let you know that it received an alarm notification from ANM. Related Topics • Enabling Alarm Notifications on ANM Mobile, page 19-15 • Viewing Alarm Notifications from ANM Mobile, page 19-15 CHAPTER 20-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 20 Troubleshooting Cisco Application Networking Manager Problems Date: 3/28/12 This chapter describes how to troubleshoot ANM issues. Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This chapter includes the following sections: • Changing ANM Software Configuration Attributes, page 20-1 • Discovering and Adding a Device Does Not Work, page 20-7 • Cisco License Manager Server Not Receiving Syslog Messages, page 20-7 • Using Lifeline, page 20-7 • Backing Up and Restoring Your ANM Configuration, page 20-11 For additional troubleshooting information, see the Installation Guide forCisco Application Networking Manager 5.2 or the Installation Guide forCisco Application Networking Manager 5.2 Virtual Appliance Changing ANM Software Configuration Attributes After you have installed the ANM, you can reconfigure ANM software configuration attributes, such as enabling HTTP(S) for Web Services, or the ports that ANM uses for communication with the network devices. For information about the ports that ANM uses, see Appendix A, “ANM Ports Reference.” This section includes the following topics: • Changing ANM Configuration Properties, page 20-2 • Example ANM Standalone Configuration, page 20-4 • Example ANM HA Configuration, page 20-5 20-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 20 Troubleshooting Cisco Application Networking Manager Problems Changing ANM Software Configuration Attributes • Example ANM Advanced Options Configuration Session, page 20-6 Changing ANM Configuration Properties This section shows how to change the ANM configuration properties. The procedure varies slightly depending on the ANM application type; ANM server or ANM Virtual Appliance. Procedure Step 1 Do one of the following depending on the ANM application type: • ANM server: From the Linux command line, log in as the root user. • ANM Virtual Appliance: Log in as administrator using SSH or console. Step 2 Do one of the following: • For a standard configuration change, enter the following depending on the ANM application type: – ANM server: /opt/CSCOanm/bin/anm-tool configure – ANM Virtual Appliance: anm-tool configure • To reconfigure with the advanced-options, enter the following depending on the ANM application type: – ANM server: /opt/CSCOanm/bin/anm-tool --advanced-options=1 configure – ANM Virtual Appliance: anm-tool configure advanced-options • (ANM server only) To switch between an HA and a non-HA system configuration, do one of the following: – To switch from a HA to a non-HA system configuration, enter the following: /opt/CSCOanm/bin/anm-tool --ha=0 configure – To switch from a non-HA to a HA system configuration, enter the following: /opt/CSCOanm/bin/anm-tool --ha=1 configure The Keep existing ANM configuration? [y/n]: prompt appears. Step 3 At the prompt, enter n (no). The current configuration information appears. For each configuration property, the current value is displayed in square brackets. Step 4 Do one of the following: • To accept the current value for a configuration property, press Enter. • To change a configuration property, enter the appropriate information. When reconfiguring ANM using the advanced-options command, the configuration sequence includes prompts applicable to the web server that serves requests for the ANM Web Service API. The Web Service API provides SOAP-based programmatic access to the functionality of ANM. By default, it is disabled. You can enable it using this option. The advanced options attributes and their default setting are as follows: • Enable HTTP for Web Server: false 20-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 20 Troubleshooting Cisco Application Networking Manager Problems Changing ANM Software Configuration Attributes Caution Remember that enabling HTTP makes the connection to ANM less secure. • Inbound Port for HTTP traffic to ANM Default: 80 • Enable HTTPS for Web Server: true • Inbound Port for HTTPS traffic to ANM Default: 443 • HTTP Port of Web Services: 8080 • Enable HTTP for Web Services: false • HTTPS Port of Web Services: 8443 • Enable HTTPS for Web Services: false • Idle session timeout in msec: 1800000 The idle session timeout applies to user sessions for the ANM GUI. Users who are idle for an amount of time greater than this value are automatically logged off the application. By default, this setting is 1800000 milliseconds, or 30 minutes. • Change the memory available to ANM process: low Check the available physical memory; if it is less than 3.5 G, then set the memory size to low (1 G), which is the default. If the available physical memory is greater than 3.5 G, set the memory size to high (2 G). Note If you set the memory size to high and ANM determines that there is not enough available physical memory, it sets the memory size to low. Note (ANM server only) When modifying the memory size in an ANM HA configuration, perform the change as follows: a. Stop both ANM servers (active and standby). b. Change the memory size on both ANM servers (Steps 1 to 4 above). c. Restart the ANM server that you want to operate in the active state (Step 5 below). d. Restart the standby ANM server (Step 5 below). After you have accepted or changed all of the configuration property values, a list of all the properties appears and the “Commit these values? [y/n/q]” prompt appears. Step 5 At the Commit prompt, do one of the following: • To accept the value and restart the ANM, enter y (yes). Note If you modified the advanced options, restarting ANM may interfere with active sessions in the ANM web interface. Note If you receive errors when attempting to change the HA properties configuration values, check the node ID to be sure they are not switched. • To go through the list of configuration properties again, enter n (no). 20-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 20 Troubleshooting Cisco Application Networking Manager Problems Changing ANM Software Configuration Attributes • To retain the original property values and exit the configuration session, enter q (quit). Example ANM Standalone Configuration This section contains an example of a configuration session for an ANM standalone system.The values shown in the brackets are the currently configured values. /opt/CSCOanm/bin/anm-tool configure Configuring ANM Checking ANM configuration files Keep existing ANM configuration? [y/n]: n Creating config file (/opt/CSCOanm/etc/cs-config.properties) Enable HTTP for Web Server [true]: Inbound Port for HTTP traffic to ANM Default [80]: Enable HTTPS for Web Server [true]: Inbound Port for HTTPS traffic to ANM Default [443]: These are the values: Enable HTTP for Web Server: true Inbound Port for HTTP traffic to ANM Default: 80 Enable HTTPS for Web Server: true Inbound Port for HTTPS traffic to ANM Default: 443 Commit these values? [y/n/q]: y Committing values ... done Keeping existing configuration: /opt/CSCOanm/lib/java/thirdparty/ctm_config.txt Stopping services Stopping monit services (/etc/monit.conf) ... (0) Stopping monit ... Stopped Stopping heartbeat ... Stopped Installing system configuration files Backing up //opt/CSCOanm/etc/my-local.cnf Setting service attributes Enabling mysql for SELinux setsebool: SELinux is disabled. Service monit is started by OS at boot time Starting mysql ... Started mysql status ... Ready Configuring mysql Checking mysql user/password Setting mysql privileges Disabling mysql replication Starting services Starting monit ...Starting monit daemon with http interface at [*:2812] Started 20-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 20 Troubleshooting Cisco Application Networking Manager Problems Changing ANM Software Configuration Attributes Example ANM HA Configuration Note The information in this section pertains to the ANM server application only. The following is an example of a configuration session for an ANM HA system. Standalone systems will not contain any HA properties but will include a limited property value configuration. The values shown in the brackets are the currently configured values. /opt/CSCOanm/bin/anm-tool configure Configuring ANM Checking ANM configuration files Keep existing ANM configuration? [y/n]: n Creating config file (/opt/CSCOanm/etc/cs-config.properties) Enable HTTP for Web Server [false]: true Inbound Port for HTTP traffic to ANM Default [80]: 80 Enable HTTPS for Web Server [true]: Inbound Port for HTTPS traffic to ANM Default [443]: Database Password [nI4ewPbmV51S]: passme HA Node 1 UName []: anm49.cisco.com HA Node 2 UName []: anm50.cisco.com HA Node 1 Primary IP [0.0.0.0]: 10.77.240.126 HA Node 2 Primary IP [0.0.0.0]: 10.77.240.100 HA Node 1 HeartBeat IP [0.0.0.0]: 10.10.10.1 HA Node 2 HeartBeat IP [0.0.0.0]: 10.10.10.2 HA Virtual IP [0.0.0.0]: 10.77.240.101 HA Node ID [1 or 2] []: 1 These are the values: Enable HTTP for Web Server: true Inbound Port for HTTP traffic to ANM Default: 80 Enable HTTPS for Web Server: true Inbound Port for HTTPS traffic to ANM Default: 443 Database Password: passme HA Node 1 UName: anm49.cisco.com HA Node 2 UName: anm50.cisco.com HA Node 1 Primary IP: 10.77.240.126 HA Node 2 Primary IP: 10.77.240.100 HA Node 1 HeartBeat IP: 10.10.10.1 HA Node 2 HeartBeat IP: 10.10.10.2 HA Virtual IP: 10.77.240.101 HA Node ID [1 or 2]: 1 Commit these values? [y/n/q]: y Committing values ... done Keeping existing configuration: /opt/CSCOanm/lib/java/thirdparty/ctm_config.txt Stopping services Stopping monit services (/etc/monit.conf) ... (0) Stopping monit ... Stopped Stopping heartbeat ... Stopped Installing system configuration files Setting service attributes Enabling mysql for SELinux Service monit is started by OS at boot time 20-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 20 Troubleshooting Cisco Application Networking Manager Problems Changing ANM Software Configuration Attributes Starting mysql ... Started Configuring mysql Checking mysql user/password Setting mysql privileges Enabling mysql replication Setting up database executing /opt/CSCOanm/lib/install/etc/dcmdb.sql ... done Starting services Starting monit ... Started Example ANM Advanced Options Configuration Session The following is an example of a configuration session for an ANM advanced options.The values shown in the brackets are the currently configured values. Note The anm-tool command in the example uses the ANM server version of the command for modifying the advanced options. The ANM Virtual Appliance version of the command is anm-tool configure advanced-options. The information that displays after entering the command is the same for both applications. /opt/CSCOanm/bin/anm-tool --advanced-options=1 configure Configuring ANM Checking ANM configuration files Keep existing ANM configuration? [y/n]: n Creating config file (/opt/CSCOanm/etc/cs-config.properties) Enable HTTP for Web Server [false]: Inbound Port for HTTP traffic to ANM Default [80]: Enable HTTPS for Web Server [true]: Inbound Port for HTTPS traffic to ANM Default [443]: HTTP Port of Web Services [8080]: Enable HTTP for Web Services [false]: HTTPS Port of Web Services [8443]: Enable HTTPS for Web Services [false]: Idle session timeout in msec [1800000]: Change the memory available to ANM process [low|high] [low]: These are the values: Enable HTTP for Web Server: false Inbound Port for HTTP traffic to ANM Default: 80 Enable HTTPS for Web Server: true Inbound Port for HTTPS traffic to ANM Default: 443 HTTP Port of Web Services: 8080 Enable HTTP for Web Services: false HTTPS Port of Web Services: 8443 Enable HTTPS for Web Services: false Idle session timeout in msec: 1800000 20-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 20 Troubleshooting Cisco Application Networking Manager Problems Discovering and Adding a Device Does Not Work Change the memory available to ANM process [low|high]: low Commit these values? [y/n/q]: y Committing values ... done Keeping existing configuration: /opt/CSCOanm/lib/java/thirdparty/ctm_config.txt Stopping services Stopping monit services (/etc/monit.conf) ... (0) Discovering and Adding a Device Does Not Work After IP discovery has checked the network and made a list of devices of each type, the device import may have failed when you tried to import the device. The device import may not have worked because IP discovery uses Telnet and SNMP to discover potential devices, while ANM requires SSH to import a device. So it is likely that IP discovery may have found some devices that cannot be imported or may not have found devices that could be imported. To update the device so that it can be imported by ANM, see the “Preparing Devices for Import” section on page 5-4. To add the device, use the Config > Devices > Add method. For detailed procedures, see the “Importing Network Devices into ANM” section on page 5-10. Cisco License Manager Server Not Receiving Syslog Messages Firewall settings are implemented as IP tables with Red Hat Enterprise Linux 5.2, and might drop syslog traffic. If you are not receiving syslog messages even after following the procedure documented in the “Enabling a Setup Syslog for Autosync for Use With an ACE” section on page 5-27, perform the procedure in this section. Procedure Step 1 Update the rules in your IP tables using the command line. Step 2 Make sure the default syslog port 514 is open as noted in Appendix A, “ANM Ports Reference.” Using Lifeline Diagnosing network or system-related problems that happen in real time can consume a considerable amount of time and lead to frustration even for a system expert. When a critical problem occurs within the ANM system or the network components managed by the ANM, you can use the troubleshooting and diagnostics tools provided by the Lifeline feature to report to the Cisco support line and generate a diagnostic package. Support engineers and developers can subsequently reconstruct your system and debug the problem using the comprehensive information captured in the lifeline. 20-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 20 Troubleshooting Cisco Application Networking Manager Problems Using Lifeline Lifeline takes a snapshot of the running system configuration, status, buffers, logs, thread dumps, messages, CLI device configuration commands, device show run commands, and so on. It gathers a period of historical network and system events that have been recorded directly preceding the event. If required, Lifeline can back up and package the ANM database or a file subdirectory or trace and package a period of traffic flow packets for a specified virtual context. The following sections describe how to use the Lifeline feature: • Guidelines for Using Lifeline, page 20-8 • Creating a Lifeline Package, page 20-8 • Downloading a Lifeline Package, page 20-9 • Adding a Lifeline Package, page 20-10 • Deleting a Lifeline Package, page 20-11 Guidelines for Using Lifeline Lifelines can be created when unwanted events occur. Under such circumstances, available resources could be extremely low (CPU and memory could be nearly drained). You should be aware of the following: • Create a Lifeline package after you encounter a problem that might require customer support assistance. The package is meant to be viewed by customer support. • Lifeline collects debug data from diagnostic generators based on priority – most important to least important. When the total data size reaches 200 MB, the collector stops collecting, and data from generators with lower priorities can be lost. For details on content, size, time, state, and any dropped data, see the Readme file included in each Lifeline package. • Lifeline collects the last 25 MB of data from the file and truncates the beginning content. • Lifelines are automatically packaged by the system in zip files. The naming convention for a lifeline package is “lifeline-yyMMdd-hhmmss.zip”. For example, lifeline-07062-152140.zip is a Lifeline package created at 3:21:40 PM, June 22, 2007. • Only one Lifeline package is created at a time. The system will reject a second request made before the first Lifeline has been packaged. • Lifeline times out in 60 minutes. • A maximum of 20 Lifeline packages are stored at a time. Creating a Lifeline Package You can create a lifeline package. Assumptions This section assumes the following: • ANM is installed and running. • You have reviewed the guidelines for managing lifelines (see the “Guidelines for Using Lifeline” section on page 20-8). 20-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 20 Troubleshooting Cisco Application Networking Manager Problems Using Lifeline • You have opened a case with Cisco technical support. Procedure Note Your user role determines whether you can use this option. Step 1 Choose Admin > Lifeline Management. Step 2 Enter a description for the package (required). The description can include information about why the package is being created, who requested the package, and so forth. Step 3 Click Save. The package is created in the following format: lifeline-yyMMdd-hhmmss.zip, and displays in the Lifelines pane.The package size, name, and generation date display in the New Lifeline window. Note Do not perform any module maintenance until the package is created. Step 4 After the package is created, do one of the following: • Click Download to save the package to a directory on your computer or to view the package contents. See the “Downloading a Lifeline Package” section on page 20-9. • Click Add to add the package to the ANM database. See the “Adding a Lifeline Package” section on page 20-10. • Click Delete to delete the package. See the “Deleting a Lifeline Package” section on page 20-11. Related Topics • Using Lifeline, page 20-7 • Creating a Lifeline Package, page 20-8 • Adding a Lifeline Package, page 20-10 • Downloading a Lifeline Package, page 20-9 Downloading a Lifeline Package Note Your user role determines whether you can use this option. You can download a package for displaying or saving to your local drive. Assumption You have created a package (see the “Creating a Lifeline Package” section on page 20-8). Procedure Step 1 Choose Admin > Lifeline Management. 20-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 20 Troubleshooting Cisco Application Networking Manager Problems Using Lifeline Step 2 Choose the package (Lifeline) from the list. Step 3 Click Download. The package is sent to your web browser, with which you can save or view the package. Note Do not perform any module maintenance until the package download to your web browser has completed. Related Topics • Using Lifeline, page 20-7 • Creating a Lifeline Package, page 20-8 • Adding a Lifeline Package, page 20-10 • Deleting a Lifeline Package, page 20-11 Adding a Lifeline Package Note Your user role determines whether you can use this option. You can add a package to the ANM database. Assumption You have created a package (see the “Creating a Lifeline Package” section on page 20-8). Procedure Step 1 Choose Admin > Lifeline Management. The Lifeline Management window appears. Step 2 In the Lifeline Management window, enter a description and click Add. The package is added to the Lifelines list, and the window refreshes. Note Do not perform any module maintenance until the package is added to the list. Related Topics • Using Lifeline, page 20-7 • Creating a Lifeline Package, page 20-8 • Downloading a Lifeline Package, page 20-9 • Deleting a Lifeline Package, page 20-11 20-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 20 Troubleshooting Cisco Application Networking Manager Problems Backing Up and Restoring Your ANM Configuration Deleting a Lifeline Package Note Your user role determines whether you can use this option. You can delete a package. Procedure Step 1 Choose Admin > Others > Lifeline Management. The Lifeline Management window appears. Step 2 From the list of lifelines in the Lifeline Management window, choose a lifeline to delete. The details of the lifeline display. Step 3 Click Delete. A confirmation popup window displays that requests you confirm the deletion. Step 4 Click OK to delete the package. The Lifeline Management window display updates. Related Topics • Using Lifeline, page 20-7 • Creating a Lifeline Package, page 20-8 • Adding a Lifeline Package, page 20-10 • Downloading a Lifeline Package, page 20-9 Backing Up and Restoring Your ANM Configuration You can create a backup of your ANM configuration and restore it if necessary. We recommend that you periodically create a backup of ANM. The procedures for creating a backup and restoring your ANM configuration vary depending on which of the following ANM applications you are using: • ANM server: See the Installation Guide forCisco Application Networking Manager 5.2 for the backup and restore procedures. • ANM Virtual Appliance: See the Installation Guide forCisco Application Networking Manager 5.2 Virtual Appliance for the backup and restore procedures. Note For details about using the ACE device backup and restore functions in ANM, see the “Performing Device Backup and Restore Functions” section on page 6-59. The backup and restore functions allow you to back up or restore the configuration and dependencies of an entire ACE or of a particular virtual context. 20-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Chapter 20 Troubleshooting Cisco Application Networking Manager Problems Backing Up and Restoring Your ANM Configuration A-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 APPENDIX A ANM Ports Reference Date: 3/28/12 ANM uses specific ports for its processes. Figure A-1 illustrates a typical ANM server deployment in a network. This illustration identifies the protocols and ports used by the different network devices in a typical deployment. • Table A-1 lists the ports used for ANM client (browser) or ANM server and ANM high availability communication. • Table A-2 lists the ports used for communication between ANM and managed devices. A-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix A ANM Ports Reference Figure A-1 ANM Server Deployment HTTP (TCP:80) or HTTPS (TCP:443) ANM (HA Primary) ANM (HA Secondary) SSH (TCP:22) HA (TCP:10444 & TCP: 10445) GSS Java RMI (TCP:2001 & TCP:3009) CSS DB (TCP: 3306) SSH (TCP:22) or Telnet (TCP:23) SNMP (UDP:161 & UDP:162) ACE module SSH (TCP:22) & HTTPS (TCP:443) SNMP (UDP:161 & UDP:162) SYSLOG (UDP:514) Chassis (C6K switch or 7600 router) SSH (TCP:22) or Telnet (TCP:23) CSM SNMP (UDP:161 & UDP:162) Note: For CSM, all communication is performed with the Chassis (Cat6K or 7600). SMTP (TCP: 25) User Email Gateway External NMS application SNMP (UDP: 162) 199929 ACE appliance SSH (TCP:22) & HTTPS (TCP:10443) SNMP (UDP:161 & UDP:162) SYSLOG (UDP:514) VMware Default HTTPS (TCP:443) vCenter Server A-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix A ANM Ports Reference Table A-1 Ports Used by ANM in a Network Deployment1 1. It is highly recommended that you run ANM on a stand-alone device. However, if you run ANM on a shared device, please note that ANM locally opens the following ports for internal communication: TCP Ports: 8980, 10003, 10004, 10023, 10443, 40000, 40001, 40002, 40003 UDP Ports: 6120, 10003 Port Description TCP (80) Default port if ANM is configured for access using HTTP (using anm-installer). TCP (443) Default port if ANM is configured for access using HTTPS (using default install option). TCP (3306) MySQL Database system (ANM HA installation opens this port to communicate with the peer ANM). TCP (10444) and TCP (10445) ANM License Manager (ANM HA installation opens these two ports to communicate with the peer ANM). TCP (25) Port used by ANM server to communicate to Email Gateway through SMTP. UDP (162) Port used by ANM server to send out trap notification to external NMS application. HTTP(8080) and HTTPS (8443) Web service ports. Table A-2 Ports Used by ANM for Communication with Managed Devices Device Type Port Description Chassis (Catalyst 6500 switch or Cisco 7600 router) SSH (TCP:22) or Telnet (TCP:23) Discover chassis configuration. ACE (appliance or module) HTTPS (TCP:443) For ACE module: XML/HTTPS interface on the device used to discover, configure, and monitor using specific show CLI commands. HTTPS (TCP:10443) For ACE appliance: XML/HTTPS interface on the device used to discover, configure, and monitor using specific show CLI commands. SSH (TCP: 22) Discovery and configuration of ACE licenses, certificates/keys (crypto) licensing, scripts, and checkpoints. SNMP (UDP: 161 & UDP:162) Monitor ACE through SNMP requests (UDP: 161) and receive trap notifications (UDP: 162). CSM SNMP (UDP: 161 & UDP:162) Monitor CSM through SNMP requests (UDP: 161) and receive trap notifications (UDP: 162). A-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix A ANM Ports Reference CSS SSH (TCP:22) or Telnet (TCP:23) Discover chassis configuration. SNMP (UDP: 161 & UDP:162) Monitor CSS through SNMP requests (UDP: 161) and receive trap notifications (UDP: 162) GSS SSH (TCP:22) Discover chassis configuration and monitoring operational status of DNS rules and VIP answers. RMI (TCP:2001 & TCP:3009) Activate/suspend DNS rules and VIP answers. vCenter Server Default HTTPS (TCP:443) Communicate with the vCenter Server and vSphere Client in a VMware virtual data center environment. For more information about using the plug-in that is available with ANM to integrate ANM with a VMware virtual data center environment, see Appendix B, “Using the ANM Plug-In With Virtual Data Centers.” Table A-2 Ports Used by ANM for Communication with Managed Devices (continued) Device Type Port Description B-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 APPENDIX B Using the ANM Plug-In With Virtual Data Centers Date: 3/28/12 This appendix describes how to integrate ANM sever with VMware vCenter Server, which is a third-party product for creating and managing virtual data centers. Using VMware vSphere Client, you can access ANM functionality and manage the ACE real servers that provide load-balancing services for the virtual machines in your virtual data center. Note When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed. If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM. This appendix includes the following sections: • Information About Using ANM With VMware vCenter Server, page B-2 • Information About the Cisco ACE SLB Tab in vSphere Client, page B-3 • Prerequisites for Using ANM With VMware vSphere Client, page B-4 • Guidelines and Restrictions, page B-5 • Registering or Unregistering the ANM Plug-in, page B-5 • Logging In To ANM from VMware vSphere Client, page B-7 • Using the Cisco ACE SLB Tab, page B-8 • Managing ACE Real Servers From vSphere Client, page B-12 • Using the VMware vSphere Plug-in Manager, page B-22 B-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Information About Using ANM With VMware vCenter Server Information About Using ANM With VMware vCenter Server This section describes how you can integrate ANM server into a VMware virtual data center environment. This feature enables you to access ANM functionality from within the VMware environment to provision the application delivery services that the ACE real servers provide. ANM version 3.1and later includes the ANM plug-in for vCenter Server that enables the integration of ANM with the VMware environment as shown in Figure B-1. Figure B-1 ANM Integrated With VMware vCenter Server and vSphere Client From the ANM GUI, you register the ANM plug-in by specifying a VMware vCenter Server and ANM server attributes that enables ANM to communicate with VMware vCenter Server and vSphere Client using HTTPS and default port 443. When the plug-in is registered, the VMware vSphere Client GUI displays the Cisco ACE SLB tab when you select a virtual machine (VM) from the client GUI. You click on the Cisco ACE SLB tab to log into ANM from the VMware vSphere Client and perform the following tasks: • Define a virtual machine (VM) as a real server on ANM and associate it with an existing ACE virtual context and server farm. • Monitor application traffic flow for virtual machines through the ACE. • Activate and suspend application traffic flows through the ACE for the associated real servers. • Add or delete real servers from the list of servers associated with a VM. VM VM VM 199935 VMware vCenter VMware vSphere Client Cisco Application Control Engine (ACE) Client Client Client Network Infrastructure Cisco ANM Dedicated Server or Virtual Appliance VMware ESX (i) Host VM VM VM VMware ESX (i) Host B-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Information About the Cisco ACE SLB Tab in vSphere Client Note In addition to ACE devices, the Cisco ACE SLB tab also displays services on the Content Services Switch (CSS) and real servers on the Cisco Content Switching Module (CSM) devices associated with a virtual machine. For these device types, from the Cisco ACE SLB tab, you can activate or suspend the services or real servers but you cannot add or delete these items. For information about how ANM maps real servers to VMware virtual machines, see the “Mapping Real Servers to VMware Virtual Machines” section on page 5-68. For more information about the Cisco ACE SLB tab, see the “Information About the Cisco ACE SLB Tab in vSphere Client” section on page B-3 and “Using the Cisco ACE SLB Tab” section on page B-8. Information About the Cisco ACE SLB Tab in vSphere Client This section describes the components of the Cisco ACE SLB tab that display in vSphere Client when you choose a VM from the VM tree (see Figure B-2). Figure B-2 Cisco ACE SLB Tab in vSphere Client Table B-1 describes the callouts in Figure B-2. B-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Prerequisites for Using ANM With VMware vSphere Client Prerequisites for Using ANM With VMware vSphere Client The prerequisites for integrating ANM with VMware vCenter Server and vSphere Client are as follows: • You must use ANM version 3.1 or later with VMware vSphere 4 or vSphere 5. • You must register the ANM plug-in from within ANM to enable communication between the two applications (see the “Registering or Unregistering the ANM Plug-in” section on page B-5). • If you are running VMware vSphere Client on a Windows Server 2003 or 2008 operating system, make sure that the following Internet security options (Internet options > Security setting) are enabled: – Allow META REFRESH – Allow scripting of Internet Explorer web browser control These options are not enabled by default. If they are disabled, the ANM plug-in will not allow you to log in to ANM for security reasons or you may encounter refresh problems with the Cisco ACE SLB tab. Note We recommend that you have VMware Tools installed on the guest OS of each VM to allow ANM to match a real server with a VM based on the IP address rather than a server name (see the “Mapping Real Servers to VMware Virtual Machines” section on page 5-68). Table B-1 Cisco ACE SLB Tab Components Item Description 1 Content area that displays the ACE real servers associated with the VM that you select from the VM tree located on the left (see the “Using the Cisco ACE SLB Tab” section on page B-8). 2 Upper set of function buttons that enable you to add or delete real servers from the content area and manage the displayed information (see the “Using the Cisco ACE SLB Tab” section on page B-8). 3 Cisco ACE SLB tab that you click to display and manage the ACE real servers for the selected VM. 4 Session information that provides the following information and functions: • Current user logged into ANM. • Logout link that you click on to close the session. • Help link that you click on to open the ANM online help for the Cisco ACE SLB tab. • ANM server time stamp of when the information displayed in the tab was last updated. 5 Recent Tasks area that displays VMware tasks. 6 Lower set of function buttons that you use to update the information displayed, activate or suspend a real sever, change the weight assigned to a real server, view real server connection information in graph form, view the topology map associated with a real server. For more information about these function buttons, see the following sections: • “Using the Cisco ACE SLB Tab” section on page B-8 • “Managing ACE Real Servers From vSphere Client” section on page B-12). B-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Guidelines and Restrictions Guidelines and Restrictions Follow these guidelines and restrictions when integrating ANM with VMware vCenter Server and vSphere Client: • There are no shared logins or trust established between ANM and vCenter Server when you open a session between the two servers. • You can configure both ANM and vCenter Server to use Active Directory for authentication. • From ANM, you must register the ANM plug-in before you can see the Cisco ACE SLB tab from VMware vSphere Client (see the “Registering or Unregistering the ANM Plug-in” section on page B-5). When you register the plug-in, the VMware vSphere Client display refreshes and displays the Cisco ACE SLB tab. • ANM supports one registered ANM plug-in instance only, which means that you can register only one plug-in at any given time. For example, if you register the plug-in from ANM Server A and then register the plug-in from ANM Server B, the following actions occur: – The ANM Server A plug-in is unregistered. – Any VMware vSphere Client that was running when the ANM Server B plug-in was registered will continue to display ANM Server A’s information in the Cisco ACE SLB tab. You must restart VMware vSphere Client to access and display ANM Server B’s information. • If you are going to uninstall ANM from the ANM server, make sure that you unregister the ANM plug-in before you uninstall ANM. If you do not unregister the plug-in before the uninstall, from VMware vSphere Client, the plug-in will display as registered but will fail to load. For information about unregistering the ANM plug-in, see the “Registering or Unregistering the ANM Plug-in” section on page B-5. For information about uninstalling ANM, see one of the following guides depending on your ANM application: – Installation Guide for Cisco Application Networking Manager 5.2 – Installation Guide for the Cisco Application Networking Manager 5.2 Virtual Appliance Registering or Unregistering the ANM Plug-in Note This feature requires the admin role for ANM. This section describes how to register the ANM plug-in from ANM, which allows you to access ANM ACE real server functionality from VMware vSphere Client. Registering the plug-in provides the client with a URL to access ANM and retrieve the required XML definition file. ANM uses HTTPS for communication with VMware vCenter Server. You can also unregister the ANM plug-in from ANM. Note Unregistering the ANM plug-in does not prevent access to the ANM server or remove the Cisco ACE SLB tab from any VMware vSphere Client display that was running when you unregistered the plug-in. You must restart the client to remove the Cisco ACE SLB tab from the display. A VMware vSphere Client restart is also required when you unregister a ANM plug-in from one ANM server and register another plug-in from a second ANM server. B-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Registering or Unregistering the ANM Plug-in Guidelines and Restrictions When registering the ANM plug-in, you specify the VMware vCenter Server and ANM server. If you specify the servers using server names rather than IP addresses, the names must be in DNS and must be consistent throughout the network. If the server names reside only in local /etc/host files, then use IP addresses in place of the server names; otherwise, the ANM server and vCenter Server may not be able to communicate and errors may occur, including the inability to enable the plug-in or the inability for real server mapping (empty tables). Procedure Step 1 From ANM, choose Admin > ANM Management > Virtual Center Plugin Registration. The VMware Virtual Center PlugIn Registration window appears. Step 2 Register or unregister the ANM plug-in using the information in Table B-2. Table B-2 Virtual Center Plugin Registration Field Description Virtual Center Server IP address of the VMware vCenter Server. Note Do not use a DNS name to specify the vCenter Server. Port Port number of the VMware vCenter Server. Virtual Center Server Username VMware vCenter Server username that has the administrator role or an equivalent role that has privilege on “Extension.” Virtual Center Server Password Password that corresponds to the VMware vCenter Server username. ANM Server DNS name or IP address of the ANM server that will be used by VMware vSphere Client. By default, ANM populates this field with the virtual IP address or hostname or all of the available IP addresses. If you enter a DNS name, make sure that the name can be resolved on the VMware vSphere Client side of the network. Note For ANM servers operating in an HA configuration, choose the shared alias IP address or VIP address for the HA pair so that the plug-in can still be used after an HA failover occurs. Status Current status of the registration or unregistration operation. Possible status states are as follows: • Blank (no status displayed)—The registration operation has not been invoked. • Success in registration—ANM has successfully completed the registration operation. • Failure—ANM is unable to complete the registration operation and displays an error message that indicates the problem encountered (see Table B-3). • Registering—ANM is in the process of registering the ANM plug-in. This state displays when you click the Registration button a second time before the process is complete. • Success in unregistration—ANM has successfully completed the unregistration operation. B-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Logging In To ANM from VMware vSphere Client Step 3 Do one of the following: • Click Register to register the ANM plug-in. ANM can now be accessed through VMware vSphere Client (see the “Logging In To ANM from VMware vSphere Client” section on page B-7). • Click UnRegister to unregister the ANM plug-in. Table B-3 describes the error messages that ANM can display when it encounters a problem with registering the plug-in. Logging In To ANM from VMware vSphere Client This section describes how to log into ANM from VMware vSphere Client and establish a session for accessing ANM functionality. The session remains active unless there is a web timeout, you log out, or there is an ANM or VMware vCenter Server restart. The default web session inactivity timeout is 30 minutes. Prerequisites From ANM, you must have the ANM plug-in registered before you can log into ANM from VMware vSphere Client (see the “Registering or Unregistering the ANM Plug-in” section on page B-5). Guidelines and Restrictions This topic includes the following guidelines and restrictions: • When registering the ANM plug-in, you specify the VMware vCenter Server and ANM server. If you specify the servers using server names rather than IP addresses, the names must be in DNS and must be consistent throughout the network. If the server names reside only in local /etc/host files, then use IP addresses in place of the server names; otherwise, the ANM server and vCenter Server may not be able to communicate and errors may occur, including the inability to enable the plug-in and log in to ANM or the inability for real server mapping (empty tables). For information about registering the plug-in, see the “Registering or Unregistering the ANM Plug-in” section on page B-5. Table B-3 Virtual Center Registration Failure Messages Error Message Root Cause Virtual center is not reachable, please correct value for the virtual center IP address or DNS name. The ANM server is unable to ping the specified VMware vCenter Server DNS name or IP address. Cannot access virtual center web service interface, please make sure that the value of the virtual center server is correct or the virtual server is up and running. The ANM server is able to ping VMware vCenter Server but it cannot connect to the webservice API. Most likely, the specified DNS name or IP address does not have the virtual center server running or the virtual server is not running. Invalid username or password for virtual center, please make sure that the username and password is correct. The specified username or password for VMware vCenter Server is not valid. User does not have permission to register or unregister plugin on virtual center server. The specified username is not the VMware vCenter Server administrator or does not have privilege on extension (plugin register/unregister/update). B-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Using the Cisco ACE SLB Tab • When logging into ANM from VMware vSphere Client and you have ANM configured to use remote authentication, such as RADIUS, TACACS+, or LDAPS/AD, use the credentials assigned to you for the specific remote authentication method. Procedure Step 1 From VMware vSphere Client, do one of the following: • To access ANM within the VMware vSphere Client window, choose a VM from the VM tree and click the Cisco ACE SLB tab. • To access ANM in a new browser window, right-click on a VM in the VM tree to open the submenu and choose Cisco ACE Activate/Suspend. The Security Alert popup window appears. This popup appears because ANM uses a Cisco self-signed certificate. Step 2 From the Security Alert popup window, click Yes to proceed. The popup window closes and the ANM login window appears. By default, the name of the user currently logged into VMware vSphere Client displays in the User Name field. Step 3 Enter your username (if it is not already displayed) and password. Step 4 Click Login. The Cisco Application Networking Manager window appears in the Cisco ACE SLB tab. For information about what displays in this window, see the “Using the Cisco ACE SLB Tab” section on page B-8. For information about how to use this window to manage the real servers, see the “Managing ACE Real Servers From vSphere Client” section on page B-12. Step 5 (Optional) To log out of ANM, click Logout. The session closes and the ANM login window appears in the Cisco ACE SLB tab. Using the Cisco ACE SLB Tab This section describes the Cisco device information and management functionality that is available when you click the Cisco ACE SLB tab. Note The ACE real server information displays only after you log into ANM from VMware vSphere Client (see the “Logging In To ANM from VMware vSphere Client” section on page B-7). The Cisco ACE SLB tab contains the ACE Reals (real servers) table. Table B-4 describes the real server information available in the table. B-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Using the Cisco ACE SLB Tab Table B-4 ACE Reals Table Fields Field Description Name Name of real server on the ACE, CSS, CSM, or CSM-S. Although the Cisco ACE SLB tab is primarily used to monitor and manage ACE real servers, you can also monitor, activate, and suspend CSS, CSM, and CSM-S devices from this tab. The real server name is a link that displays the Real Server Details popup window, which provides operating information about the server (see the “Monitoring Real Server Details Using vSphere Client” section on page B-19). IP Address Real server IP address. Port Real server port number. Admin State Administrative state of the real server as follows: • In Service • Out Of Service • In Service Standby. Note For CSM and CSM-S real servers, ANM infers the admin state based on the operational state that it receives through SNMP rather than the CLI, which may result in an admin state display that is not correct. For example, when you change the operational state of a CSM real server from Out of Service to Inservice, the admin state display should also change to In Service; however, the admin state display may remain set to Out of Service. B-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Using the Cisco ACE SLB Tab Oper State Operational state of the real server as follows: • ARP Failed—Corresponding VLAN interface is not configured for the real server. • Failed—Server has failed and will not be retried for the amount of time specified by its retry timer. • Inband probe failed—Server has failed the inband Health Probe agent. • Inservice—Server is in use as a destination for server load balancing client connections. • Inservice standby—Server is the backup real server, which remains inactive unless the primary real server fails. • Operation wait—Server is ready to become operational but is waiting for the associated redirect virtual server to be in service. • Out of service—Server is not in use by a server load balancer as a destination for client connections. • Probe failed—Server load-balancing probe to this server has failed. No new connections will be assigned to this server until a probe to this server succeeds. • Probe testing—Server has received a test probe from the server load balancer. • Ready to test—Server has failed and its retry timer has expired; test connections will begin flowing to it soon. • Return code failed—Server has been disabled because it returned an HTTP code that matched a configured value. • Test wait—Server is ready to be tested. This state is applicable only when the server is used for HTTP redirect load balancing. • Testing—Server has failed and has been given another test connection. The success of this connection is not known. • Throttle: DFP—DFP has lowered the weight of the server to throttle level; no new connections will be assigned to the server until DFP raises its weight. • Throttle: max clients—Server has reached its maximum number of allowed clients. • Throttle: max connections—Server has reached its maximum number of connections and is no longer being given connections. • Unknown—State of the server is not known. Conns Number of concurrent connections. Weight Weight assigned to the real server. Server Farm Server farm that the real server is associated with. Vserver Name of the Vserver. Table B-4 ACE Reals Table Fields (continued) Field Description B-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Using the Cisco ACE SLB Tab In the table, N/A indicates that either the information is not available from the database or that it is not being collected through SNMP. The Cisco ACE SLB tab also contains a number of function buttons that enable you to manage the displayed information and the real servers. Figure B-3 shows the function buttons that are located at the top of the ACE Reals table. Figure B-3 Cisco ACE SLB Tab Upper Function Buttons Table B-5 describes each of the function buttons shown in Figure B-3 Device ACE, CSS, CSM, or CSM-S on which the real server is configured. HA Indicators that display when the real server is part of a high availability pair. The indicators are as follows: • Asterisk (*)—The real server is associated with an HA pair and the HA configuration is complete. • Red dash (-)—The real server is associated with an HA pair; however, the HA configuration is incomplete. Typically, the HA pair are not properly configured for HA or only one of the servers has been imported into ANM. Ensure that both servers are imported into ANM and that they are configured as described in the “Configuring ACE High Availability” section on page 13-14. The table displays HA pair real servers together in the same row and they remain together no matter how you sort the information. Table B-4 ACE Reals Table Fields (continued) Field Description 248665 1 2 3 4 5 6 Table B-5 The Cisco ACE SLB Tab Upper Function Button Descriptions Number Function Description 1 Add Adds a real server to the list of servers that can service the VM (see the “Adding a Real Server” section on page B-13). Note This feature is available for ACE devices only. 2 Delete Deletes the selected server from the list of servers that can service the VM (see the “Deleting a Real Server Using vSphere Client” section on page B-14). Note This feature is available for ACE devices only. 3 AutoRefresh Enables the auto refresh feature and sets the refresh cycle time. Values are Off, 30 seconds, 1 minute, 2 minutes, or 5 minutes. 4 Filter Enables the column filter and provides access to saved filters. B-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Managing ACE Real Servers From vSphere Client Table B-6 describes the function buttons located across the bottom of the Cisco ACE SLB tab. Related Topics • Information About Using ANM With VMware vCenter Server, page B-2 • Logging In To ANM from VMware vSphere Client, page B-7 • Managing ACE Real Servers From vSphere Client, page B-12 • Using the VMware vSphere Plug-in Manager, page B-22 Managing ACE Real Servers From vSphere Client This section describes how to perform real server management tasks from the Cisco ACE SLB tab after you log into ANM from VMware vSphere Client (see the “Logging In To ANM from VMware vSphere Client” section on page B-7). These tasks include adding a VM as a real server to an existing server farm or suspending and activating the operation of a real server associated with a VM. This section includes the following topics: • Adding a Real Server, page B-13 • Deleting a Real Server Using vSphere Client, page B-14 • Activating Real Servers Using vSphere Client, page B-15 • Suspending Real Servers Using vSphere Client, page B-16 • Modifying Real Server Weight Value Using vSphere Client, page B-18 • Monitoring Real Server Details Using vSphere Client, page B-19 5 Refresh Refreshes the window. 6 Filter tool Filters over all columns. Table B-5 The Cisco ACE SLB Tab Upper Function Button Descriptions Number Function Description Table B-6 Cisco ACE SLB Tab Lower Function Button Descriptions Function Description Poll Now Polls the device to update the displayed information (see the “Refreshing the Displayed Real Server Information” section on page B-20. Activate Activates the services of the selected server (see the “Activating Real Servers Using vSphere Client” section on page B-15). Suspend Suspends the services of the selected server (see the “Suspending Real Servers Using vSphere Client” section on page B-16). Change Weight Changes the weight of the selected server (see the “Modifying Real Server Weight Value Using vSphere Client” section on page B-18). Graph Displays connection information for a selected real server in graph form. To exit a graph view and return to the ACE Real Server table, click Exit Graph. Topology Displays a network topology map for a selected real server (see “Displaying Network Topology Maps” section on page 17-68). To exit a topology map and return to the ACE Real Server table, click Exit. B-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Managing ACE Real Servers From vSphere Client • Refreshing the Displayed Real Server Information, page B-20 Adding a Real Server You can add one or more real servers to the list of ACE real servers associated with a VM. The Cisco ACE SLB tab allows you select a VM and define it as a real server on ANM, associating it with an existing ACE virtual context and server farm. Guidelines and Limitations You can add only one real server at a time. Repeat the procedure in this section for each real server that you want to add. Procedure Step 1 From the VM tree in VMware vSphere Client, do one of the following: • To display the ACE real server information in the current window, click on a VM and then click the Cisco ACE SLB tab. • To display the ACE real server information in a new window, right-click on a VM to open the submenu and choose Cisco ACE Activate/Suspend. The Security Alert popup window appears. This popup window appears because ANM uses a Cisco self-signed certificate. Step 2 From the Security Alert popup window, click Yes to proceed. The popup window closes and the Cisco Application Networking Manager window appears, displaying the ACE Reals table. Step 3 From the ACE Reals table, click Add. The Real Server Configurations dialog box appears. Step 4 From the Real Server Configurations dialog window, configure the real server to add using the information in Table B-7. Table B-7 Real Server Attributes Field Description Real Server Name Unique name for this server. By default, the name of the selected VM is displayed. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. Real Server IP Address Unique IP address in dotted-decimal format (such as 192.168.11.1). The drop-down list is populated with the IP address or addresses assigned to the selected VM. If no IP addresses were found for the VM, you can manually enter an IP address in this field. Real Server Port Real server port number. Valid entries are from 1 to 65535. Real Server Weight Weight to assign to this real server in a server farm. Valid entries are 1 to 100. The default is 8. B-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Managing ACE Real Servers From vSphere Client Step 5 Do one of the following: • Click Deploy Now. The Real Server Configurations dialog box closes and ANM adds the real server to the list of servers that can service the VM depending on how you set the Real Server State attribute. • Click Cancel. The Real Server Configurations dialog box closes and no real server is added. Related Topics • Logging In To ANM from VMware vSphere Client, page B-7 • Using the Cisco ACE SLB Tab, page B-8 • Deleting a Real Server Using vSphere Client, page B-14 • Activating Real Servers Using vSphere Client, page B-15 • Suspending Real Servers Using vSphere Client, page B-16 • Modifying Real Server Weight Value Using vSphere Client, page B-18 • Monitoring Real Server Details Using vSphere Client, page B-19 • Refreshing the Displayed Real Server Information, page B-20 Deleting a Real Server Using vSphere Client You can remove a real server from the list of servers that service the VM. Procedure Step 1 From the VM tree in VMware vSphere Client, do one of the following: • To display the ACE real server information in the current window, click on a VM and then click the Cisco ACE SLB tab. • To display the ACE real server information in a new window, right-click on a VM to open the submenu and choose Cisco ACE Activate/Suspend. Real Server State State of the real server: • In Service—ANM places the real server in the in service state when it is added. This is the default setting. • In Service Standby—ANM places the real server in the service standby state when it is added. • Out Of Service—ANM places the real server in the out of service state when it is added. ACE Virtual Context ACE virtual context that has the server farm that the real server is to be associated with. Serverfarm Server farms associated with the selected ACE virtual context. Virtual Servers Virtual server names and VIPs that are associated with the selected server farm. Table B-7 Real Server Attributes (continued) Field Description B-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Managing ACE Real Servers From vSphere Client The Security Alert popup window appears. This popup window appears because ANM uses a Cisco self-signed certificate. Step 2 From the Security Alert popup window, click Yes to proceed. The popup window closes and the Cisco Application Networking Manager window appears, displaying the ACE Reals table. Step 3 From the ACE Reals table, check the checkbox of each server that you want to delete from the table. Step 4 Click Delete. The confirmation popup window appears requesting you to verify that you want to delete the server. Step 5 In the confirmation popup window, click OK. The popup window closes and ANM removes the selected servers from the list of real servers. Related Topics • Logging In To ANM from VMware vSphere Client, page B-7 • Using the Cisco ACE SLB Tab, page B-8 • Adding a Real Server, page B-13 • Activating Real Servers Using vSphere Client, page B-15 • Suspending Real Servers Using vSphere Client, page B-16 • Modifying Real Server Weight Value Using vSphere Client, page B-18 • Monitoring Real Server Details Using vSphere Client, page B-19 • Refreshing the Displayed Real Server Information, page B-20 Activating Real Servers Using vSphere Client You can activate a real server that services a VM. Note If you are not using the ANM plug-in for vCenter Server to access ANM, see the “Activating Real Servers” section on page 8-14. Procedure Step 1 From the VM tree in VMware vSphere Client, do one of the following: • To display the ACE real server information in the current window, click on a VM and then click the Cisco ACE SLB tab. • To display the ACE real server information in a new window, right-click on a VM to open the submenu and choose Cisco ACE Activate/Suspend. The Security Alert popup window appears. This popup window appears because ANM uses a Cisco self-signed certificate. Step 2 From the Security Alert popup window, click Yes to proceed. The popup window closes and the Cisco Application Networking Manager window appears, displaying the ACE Reals table. B-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Managing ACE Real Servers From vSphere Client Step 3 From the ACE Reals table, check the check box of the servers that you want to activate and click Activate. The Activate Server window appears. Step 4 In the Reason field of the Activate Server window, enter a reason for this action. You might enter a trouble ticket, an order ticket, or a user message. Note Do not enter a password in this field. Step 5 Do one of the following: • Click OK to activate the server and to return to the ACE Reals table. The server appears in the table with the status Inservice. • Click Cancel to exit this procedure without activating the server and to return to the ACE Reals table. Related Topics • Logging In To ANM from VMware vSphere Client, page B-7 • Using the Cisco ACE SLB Tab, page B-8 • Suspending Real Servers Using vSphere Client, page B-16 • Modifying Real Server Weight Value Using vSphere Client, page B-18 • Monitoring Real Server Details Using vSphere Client, page B-19 • Refreshing the Displayed Real Server Information, page B-20 Suspending Real Servers Using vSphere Client You can suspend a real server that services a VM. Note If you are not using the ANM plug-in for vCenter Server to access ANM, see the “Suspending Real Servers” section on page 8-15. Procedure Step 1 From the VM tree in VMware vSphere Client, do one of the following: • To display the ACE real server information in the current window, click on a VM and then click the Cisco ACE SLB tab. • To display the ACE real server information in a new window, right-click on a VM to open the submenu and choose Cisco ACE Activate/Suspend. The Security Alert popup window appears. This popup window appears because ANM uses a Cisco self-signed certificate. Step 2 From the Security Alert popup window, click Yes to proceed. The popup window closes and the Cisco Application Networking Manager window appears, displaying the ACE Reals table. B-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Managing ACE Real Servers From vSphere Client Step 3 In the ACE Reals table, check the check box of the servers that you want to suspend and click Suspend. The Suspend Real Servers window appears. Step 4 In the Reason field of the Suspend Real Servers window, enter the reason for this action. You might enter a trouble ticket, an order ticket, or a user message. Note Do not enter a password in this field. Step 5 From the Suspend Real Servers Type drop-down list, choose one of the following: • Graceful—When executed on a primary server, the ACE gracefully shuts down the server with sticky connections as follows: – Tears down existing non-TCP connections to the server – Allows current TCP connections to complete – Allows new sticky connections for existing server connections that match entries in the sticky database – Load balances all new connections (other than the matching sticky connections mentioned above) to the other servers in the server farm When executed on a backup real server, the ACE places the backup server in service standby mode. Note For the CSS, when the device is in the In Service admin state and you perform a graceful suspend operation, ANM saves the last known non-zero service (or real server) weight, and then sets the weight to zero. ANM references the saved weight when performing an Activate operation. If the current weight is zero, and a non-zero weight has been saved for that service (or real server), the Activate operation also sets the weight to the saved value. To allow ANM to save and reset the weight value when gracefully suspending and then activating the CSS, you must have the device configured to permit SNMP traffic. For each device type, see the corresponding configuration guide to configure the device to permit SNMP traffic. When the CSS is in the In Service Standby admin state and you perform a graceful suspend operation, ANM does not set the weight to zero. • Suspend—The ACE resets all non-TCP connections to the server. For TCP connections, existing flows are allowed to complete before the ACE takes the real server out of service. No new connections are allowed. The ACE resets all Secure Sockets Layer (SSL) connections to the real server. • Suspend and Clear Connections—The ACE performs the tasks described for Suspend and clears the existing connections to this server. B-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Managing ACE Real Servers From vSphere Client Step 6 Do one of the following: • Click Deploy Now to suspend the server and to return to the ACE Reals table. The server appears in the table with the status Out Of Service. • Click Cancel to exit this procedure without suspending the server and to return to the ACE Reals table. Related Topics • Logging In To ANM from VMware vSphere Client, page B-7 • Using the Cisco ACE SLB Tab, page B-8 • Adding a Real Server, page B-13 • Deleting a Real Server Using vSphere Client, page B-14 • Activating Real Servers Using vSphere Client, page B-15 • Modifying Real Server Weight Value Using vSphere Client, page B-18 • Monitoring Real Server Details Using vSphere Client, page B-19 • Refreshing the Displayed Real Server Information, page B-20 Modifying Real Server Weight Value Using vSphere Client You can modify the weight value assigned to a real server that defines the connection capacity of the server in relation to the other real servers. The ACE uses the weight value that you specify for a server in the weighted round-robin and least-connections load-balancing predictors. Servers with a higher configured weight value have a higher priority with respect to connections than servers with a lower weight. For example, a server with a weight of 5 would receive five connections for every one connection for a server with a weight of 1. Note If you are not using the ANM plug-in for vCenter Server to access ANM, see the “Modifying Real Server Weight Value” section on page 8-17. Procedure Step 1 From the VM tree in VMware vSphere Client, do one of the following: • To display the ACE real server information in the current window, click on a VM and then click the Cisco ACE SLB tab. • To display the ACE real server information in a new window, right-click on a VM tree to open the submenu and choose Cisco ACE Activate/Suspend. The Security Alert popup window appears. This popup window appears because ANM uses a Cisco self-signed certificate. Step 2 From the Security Alert popup window, click Yes to proceed. The popup window closes and the Cisco Application Networking Manager window appears, displaying the ACE Reals table. Step 3 In the ACE Reals table, check the check box of the server that you want modify and click Change Weight. B-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Managing ACE Real Servers From vSphere Client The Change Weight Real Servers window appears. Step 4 In the Change Weight Real Servers window, enter the following information for the selected server: • Reason for change such as trouble ticket, order ticket, or user message. Note Do not enter a password in this field. • Weight value (for allowable ranges for each device type, see Table 8-5). Step 5 Do one of the following: • Click Deploy Now to accept your entries and to return to the ACE Reals table. The server appears in the table with the updated information. • Click Cancel to exit this procedure without saving your entries and to return to the ACE Reals table. Related Topics • Logging In To ANM from VMware vSphere Client, page B-7 • Using the Cisco ACE SLB Tab, page B-8 • Adding a Real Server, page B-13 • Deleting a Real Server Using vSphere Client, page B-14 • Activating Real Servers Using vSphere Client, page B-15 • Monitoring Real Server Details Using vSphere Client, page B-19 • Refreshing the Displayed Real Server Information, page B-20 Monitoring Real Server Details Using vSphere Client You can display detailed operating information about a real server. Procedure Step 1 From the VM tree in VMware vSphere Client, do one of the following: • To display the ACE real server information in the current window, click on a VM and then click the Cisco ACE SLB tab. • To display the ACE real server information in a new window, right-click on a VM to open the submenu and choose Cisco ACE Activate/Suspend. The Security Alert popup window appears. This popup window appears because ANM uses a Cisco self-signed certificate. Step 2 From the Security Alert popup window, click Yes to proceed. The popup window closes and the Cisco Application Networking Manager window appears, displaying the ACE Reals table. Step 3 In the ACE Reals table, click on the name of the real server whose details you want to view. The Real Server Details popup window appears and displays the following ACE statistical information: • Total Connections—Total number of load-balanced connections to this real server in the serverfarm. B-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Managing ACE Real Servers From vSphere Client • Connections Rate—Connections per second. • Dropped Connections—Total number of dropped connections because the current connection count exceeds the maximum number of allowed connections. • Dropped Connections Rate—Dropped connections per second. • Minimum Connections—Minimum number of connections that need to be supported by the real server in the serverfarm. • Maximum Connections—Maximum number of connections that can be supported by this real server in the serverfarm. Note The statistical information that ANM displays for the CSM and CSM-S is different from the ACE information described above. Also, ANM does not display the Real Server Details popup window for the CSS. Note To close the Real Server Details popup window, you may need to expand the display to access the “X” (close) located in the upper right hand section of the window. Related Topics • Logging In To ANM from VMware vSphere Client, page B-7 • Using the Cisco ACE SLB Tab, page B-8 • Adding a Real Server, page B-13 • Deleting a Real Server Using vSphere Client, page B-14 • Activating Real Servers Using vSphere Client, page B-15 • Suspending Real Servers Using vSphere Client, page B-16 • Modifying Real Server Weight Value Using vSphere Client, page B-18 • Refreshing the Displayed Real Server Information, page B-20 Refreshing the Displayed Real Server Information You can refresh the information that ANM displays for a real server. Procedure Step 1 From the VM tree in VMware vSphere Client, do one of the following: • To display the ACE real server information in the current window, click on a VM and then click the Cisco ACE SLB tab. • To display the ACE real server information in a new window, right-click on a VM to open the submenu and choose Cisco ACE Activate/Suspend. The Security Alert popup window appears. This popup window appears because ANM uses a Cisco self-signed certificate. B-21 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Managing ACE Real Servers From vSphere Client Step 2 From the Security Alert popup window, click Yes to proceed. The popup window closes and the Cisco Application Networking Manager window appears, displaying the ACE Reals table. Step 3 In the ACE Reals table, check the checkbox next to the name of the real server whose information you want to refresh. Step 4 Click Poll Now. ANM polls the selected device and updates the displayed information. Related Topics • Logging In To ANM from VMware vSphere Client, page B-7 • Using the Cisco ACE SLB Tab, page B-8 • Adding a Real Server, page B-13 • Deleting a Real Server Using vSphere Client, page B-14 • Activating Real Servers Using vSphere Client, page B-15 • Suspending Real Servers Using vSphere Client, page B-16 • Modifying Real Server Weight Value Using vSphere Client, page B-18 B-22 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Appendix B Using the ANM Plug-In With Virtual Data Centers Using the VMware vSphere Plug-in Manager Using the VMware vSphere Plug-in Manager You can use the VMware vSphere Client Plug-in Manager to verify that the ANM plug-in (Cisco ACE) is registered, view error messages, and enable or disable the plug-in. Procedure Step 1 From the VMware vSphere Client main menu, choose Plug-ins > Manage Plug-ins. The Plug-in Manager window appears. Table B-8 describes the Cisco plug-in information that displays in the Plug-in Manager window. Step 2 (Optional) To enable or disable the plug-in, from the list of plug-ins, right-click on the Cisco ACE plug-in and do one of the following: • Choose Enable. The Cisco ACE SLB tab appears in the VMware vSphere Client content area. This is the default setting. • Choose Disable. The Cisco ACE SLB tab is removed from the VMware vSphere Client content area. Related Topics Registering or Unregistering the ANM Plug-in, page B-5 Table B-8 VMware vSphere Client Plug-in Manager Item Description Plug-in Name Name of the Cisco plug-in, which is Cisco ACE. Vendor This field is blank. The vendor name, Cisco, is included in the plug-in name. Version Plug-in version number. Status Plug-in operating status: Enabled or Disabled. Description Plug-in description, which is Cisco ACE. Progress N/A Errors Errors related to the Cisco ACE plug-in, such as when the VMware vSphere Client cannot find the ANM server because it cannot resolve the server name. GL-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 GLOSSARY Date: 3/28/12 A ACE Cisco Application Control Engine, available as a module that resides in a Cisco Catalyst 6500 series chassis, Cisco 7600 series router, or as a standalone appliance. The ACE offers high-performance server load balancing (SLB), routing and bridging configuration, traffic policies, redundancy (high availability), virtualization for resource management, SSL, security features, and application acceleration and optimization. ACL Access Control List. A mechanism in computer security used to enforce privilege separation. An ACL identifies the privileges and access rights a user or client has to a particular object, such as a server, file system, or application. activate Places an entity into the resource pool for load balancing content requests or connections and starts the keepalive function. See also suspend. administrative distance The first criterion a router uses to determine which routing protocol to use if two protocols provide route information for the same destination. Administrative distance is a measure of the trustworthiness of the source of the routing information. Administrative distance has only local significance, and is not advertised in routing updates. The smaller the administrative distance value, the more reliable the protocol. The values range from 0 (zero) for a connected interface and 1 for a static route, to 255 for an unknown protocol. AES Advanced Encryption Standard. One of the possible encryption algorithms available for use in SNMP communications. ANM Mobile ANM feature that allows supported mobile devices to access to your ANM server or ANM Virtual Appliance and manage the network objects in much the same way you do from an ANM client. Using a mobile device, you can run ANM Mobile as a native application (app) or inside the mobile device browser. ANM server Dedicated server with ANM server software and Red Hat Enterprise Linux (RHEL) operating system installed on it. ANM Virtual Appliance VMware virtual appliance with ANM server software and Cisco Application Delivery Engine Operating System (ADE OS) installed on it. Cisco distributes ANM Virtual Appliance in Open Virtual Appliance (.OVA) format. ARP Address Resolution Protocol. Internet protocol used to map an IP address to a MAC address. Defined in RFC 826. Glossary GL-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 B building block Reusable configuration attributes that can be applied to virtual contexts for consistent, standardized implementation. BVI Bridge-Group Virtual Interface. Logical Layer 3-only interface associated with a bridge group when integrated routing and bridging (IRB) is configured. C CCM Cisco CallManager. A Cisco product that provides the software-based, call-processing component of the Cisco IP Telephony Solutions for the Enterprise, part of Cisco AVVID (Architecture for Voice, Video, and Integrated Data). CallManager acts as a signaling proxy for call events initiated over other common protocols such as SIP, ISDN (Integrated Services Digital Network), or MGCP (Media Gateway Control Protocol). certificate chain A certificate chain is a hierarchal list of certificates used in SSL that includes the subject’s certificate, the root CA certificate, and any intermediate CA certificates. certificate signing request See CSR. checkpoint A snapshot in time of a known stable ACE running configuration before you begin to modify it. If you encounter a problem with the modifications to the running configuration, you can roll back the configuration to the previous stable configuration checkpoint. Cisco.com Replaces the Cisco Connection Online website. Use this site to access customer service and support. class map A mechanism for classifying types of network traffic. The ANM uses class maps to classify the network traffic that is received and transmitted by the ACE. Types of traffic include Layer 3/Layer 4 traffic that can pass through the ACE, network management traffic that can be received by the ACE, and Layer 7 HTTP load-balancing traffic. CSR Certificate Signing Request. A message sent to a certificate authority, such as VeriSign and Thawte to a apply for a digital identity certificate for use with SSL. The request includes information that identifies the SSL site, such as location and serial number, and a public key that you choose. The request may also provide any additional proof of identity required by the certificate authority. Cisco IOS Software The Cisco system software that allows centralized, integrated, and automated installation and management of internetworks, while ensuring support for a wide variety of protocols, media, services, and platforms. context See virtual context. D DES Data Encryption Standard. One of the possible encryption algorithms available for use in SNMP communications. Glossary GL-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 DFP Dynamic Feedback Protocol. A protocol that allows load-balanced servers (both local and remote) to dynamically report changes in their status and their ability to provide services. distinguished name Used for SSL, a set of attributes that provides the certificate authority with the information it needs to authenticate your site. Dynamic Workload Scaling (DWS) ACE feature that permits on-demand access to remote resources, such as VMs, that you own or lease from an Internet service provider or cloud service provider. E event A message from the ANM that informs you of activities on parts of the system, including each virtual context, the management system, and hardware components. event type Alarm, Log, Audit, Attack Log exception A group of related faults. F fault An abnormal condition that occurs when a system component exceeds a performance threshold or is not functioning properly. File Transfer Protocol See FTP. FTP File Transfer Protocol. Application protocol, part of the TCP/IP protocol stack, used for transferring files between network nodes. FTP is defined in RFC 959. H H.323 An umbrella recommendation from the ITU Telecommunication Standardization Sector (ITU-T) that defines the protocols that provide audio-visual communication sessions on any packet network. It is a part of the H.32x series of protocols which also address communications over Integrated Services Digital Network (ISDN), Public switched telephone network (PSTN) or Signaling System 7 (SS7). H.323 is commonly used in Voice over IP (VoIP, Internet Telephony, or IP Telephony) and Internet Protocol (IP)-based videoconferencing.H.323 defines a common set of CODECs, call setup and negotiating procedures, and basic data transport methods. HSRP Hot Standby Router Protocol. A networking protocol that provides network redundancy for IP networks, ensuring that user traffic immediately and transparently recovers from first hop failures in network edge devices or access circuits. Glossary GL-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 I ICMP Internet Control Message Protocol. Network layer Internet protocol that reports errors and provides other information relevant to IP packet processing. Documented in RFC 792. Internet Control Message Protocol See ICMP. interface 1. A network connection. 2. A connection between two systems or devices. 3. In telephony, a shared boundary defined by common physical interconnection characteristics, signal characteristics, and meanings of interchanged signals. L load balancing An action that spreads network requests among available servers within a cluster of servers, based on a variety of algorithms. M MD5 Message Digest 5 or Message-Digest Algorithm. One of the possible encryption algorithms available for use in SNMP communications. MIB Database of network management information that is used and maintained by a network management protocol, such as SNMP or CMIP. The value of a MIB object can be changed or retrieved using SNMP or CMIP commands, usually through a GUI network management system. MIB objects are organized in a tree structure that includes public (standard) and private (proprietary) branches. N NAT Name Address Translation. A method of connecting multiple computers to the Internet (or any other IP network) using one IP address. O object group A logical grouping of similar objects, such as servers, clients, services, or networks. Creating an object group allows you to apply common attributes to a number of objects without specifying each object individually. organizations An organization allows you to configure AAA server lookup for your users or set up users who work for a service provider customer. Organizations in the Cisco ANM system are defined by the system administrator. Glossary GL-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 P PAT Port Address Translation. A mechanism that allows many devices on a LAN to share one IP address by allocating a unique port address at Layer 4. ping A common method for troubleshooting the accessibility of devices. A ping tests an ICMP echo message and its reply. Because ping is the simplest test for a device, it is the first to be used. If ping fails, try using traceroute. Run ping to view the packets transmitted, packets received, percentage of packet loss, and round-trip time in milliseconds. port 1. An interface on an internetworking device (such as a router); a physical entity. 2. In IP terminology, an upper-layer process that receives information from lower layers. Ports are numbered, and each numbered port is associated with a specific process. For example, SMTP is associated with port 25. A port number is also called a well-known address. 3. To rewrite software or microcode so that it will run on a different hardware platform or in a different software environment than that for which it was originally designed. R RAS Registration, Admission, and Status Protocol. Protocol that is used between endpoints and the gatekeeper to perform management functions. RAS signalling function performs registration, admissions, bandwidth changes, status, and disengage procedures between the VoIP gateway and the gatekeeper. RBAC Role-Based Access Control. A mechanism that allows privileges to be assigned to defined roles. The roles are then assigned to real users, allowing or limiting access to specific features as appropriate for each role. real server A real server is a physical device assigned to a server farm. redundancy In internetworking, the duplication of devices, services, or connections so that, in the event of a failure, the redundant devices, services, or connections can perform the work of those that failed. resource class A defined set of resources and allocations available for use by a device (such as an ACE). Using resource classes prevents a single device from using all available resources. role See user role. RSA Rivest, Shamir, and Adelman Signatures. A public-key cryptographic system used for authentication. RTSP Real Time Streaming Protocol. A client-server multimedia presentation control protocol, designed to address the needs for efficient delivery of streamed multimedia over IP networks. Glossary GL-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 S SCCP Skinny Client Control Protocol. A proprietary terminal control protocol owned and defined by Cisco as a messaging set between a skinny client and the Cisco CallManager (CCM). Examples of skinny clients include the Cisco 7900 series of IP phone such as the Cisco 7960, Cisco 7940 and the 802.11b wireless Cisco 7920, along with Cisco Unity voicemail server. See also Skinny. server farm A collection of servers that contain the same content. Server Load Balancer See SLB. service A destination location where a piece of content resides physically. Also referred to in general terms for this release as including content rules, owners, virtual servers, real servers, and so on. Simple Message Transfer Protocol See SMTP. SIP Session Initiation Protocol. Protocol developed by the IETF MMUSIC Working Group as an alternative to H.323. SIP features are compliant with IETF RFC 2543, published in March 1999. SIP equips platforms to signal the setup of voice and multimedia calls over IP networks. Skinny Skinny is a lightweight protocol which allows for efficient communication with Cisco CallManager. See also SCCP. SLB Server Load Balancer. A device that makes load balancing decisions based on application availability, server capacity, and load distribution algorithms, such as round robin or least connections. Using load balancing and server/application feedback, an SLB device determines a real server for the packet flow and sends this information to the requesting forwarding agent. After the optimal destination is decided on, all other packets in the packet flow are directed to a real server by the forwarding agent, increasing packet throughput. special configuration file Managed file resource on an ACE module, such as a piece of a configuration file or a keep-alive script. SMTP Simple Message Transfer Protocol. Internet protocol that provides email services. sticky A feature that ensures that the same client gets the same server for multiple connections. It is used when applications require a consistent and constant connection to the same server. If you are connecting to a system that keeps state tables about your connection, sticky allows you to get back to the same real server again and retain the statefulness of the system. suspend Removes an entity from the resource pool for future load-balancing content requests or connections. Suspending a service or device does not affect existing content flows, but it prevents additional connections from accessing the suspended entity or content. See also activate. T TCP Transport Control Protocol. Connection-oriented transport layer protocol that provides reliable full-duplex data transmission. TCP is part of the TCP/IP protocol stack. template See building block. Glossary GL-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 threshold A range in which you expect your network to perform. If a threshold is exceeded or goes below the expected bounds, you examine the areas for potential problems. You can create thresholds for a specific device. traceroute A diagnostic tool that helps you understand why ping fails or why applications time out. Using it, you can view each hop (or gateway) on the route to your device and how long each took. Transport Control Protocol See TCP. U URI Uniform Resource Identifier. Type of formatted identifier that encapsulates the name of an Internet object, and labels it with an identification of the name space, thus producing a member of the universal set of names in registered name spaces and of addresses referring to registered protocols or name spaces. [RFC 1630] user role A mechanism for granting access to features and functionality to a user account. The Cisco Application Networking Manager includes four predefined roles: System Administrator, Server Manager, Network Manager, and Service Provider Customer. V virtual context A concept that allows users to partition an ACE into multiple virtual devices. Each virtual context contains its own set of policies, interfaces, resources, and administrators, allowing administrators to more efficiently manage system resources and services. There are two types of contexts; the Admin context and a user context. The Admin context is the default context that the ACE provides. The Admin context, which contains the basic settings for each virtual device or context, allows a user to configure and manage all contexts. When a user logs into the Admin context, he or she has full system administrator access to the entire ACE and all contexts and objects within it. The Admin context provides access to network-wide resources, for example, a syslog server or context configuration server. All global commands for ACE settings, contexts, resource classes, and so on, are available only in the Admin context. A user context, which is created by a user, has access to the resources in which the context was created. For example, a user context that was created by an administrator while in Admin context, by default, has access to all resources in an ACE device. Any user created by someone in a user-defined context, only has access to the resources within that context. In addition, roles are assigned to users, which determine the commands and resources that are available to that user. VLAN Virtual LAN. Group of devices on one or more LANs that are configured (using management software) so that they can communicate as if they were attached to the same wire, when in fact they are located on a number of different LAN segments. Because VLANs are based on logical instead of physical connections, they are extremely flexible. VLAN Trunking Protocol See VTP. virtual server A virtual server represents groups of real servers and are associated with a real server farm. Glossary GL-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 VMware vCenter Server Third-party product for creating and managing virtual data centers, which includes VMware vSphere Client and virtual machines. VTP VLAN Trunking Protocol. A Layer 2 messaging protocol that maintains VLAN configuration consistency by managing the addition, deletion, and renaming of VLANs within a VTP domain. VTP minimizes misconfigurations and configuration inconsistencies that can result in a number of problems, such as duplicate VLAN names, incorrect VLAN-type specifications, and security violations. VTP domain Also called a VLAN management domain, a domain composed of one or more network devices that share the same VTP domain name and that are interconnected with trunks. W Web server A machine that contains Web pages that are accessible by others. IN-1 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 INDEX Numerics 7600 series router adding VLANs 5-48 configuring access ports 5-43 interfaces 5-42 primary attributes 5-38 routed ports 5-46 switch virtual interfaces 5-45 trunk ports 5-44 managing 5-66 synchronizing configurations 5-66 viewing all modules 5-79 ports 5-42 VLAN managing 5-48 modifying 5-51 viewing 5-49 A AAA server, authenticating ANM users 18-38 About button 1-9 acceleration configuring 7-53 configuring globally on ACE appliances 15-9 FlashForward 15-2 traffic policies 15-2 typical configuration flow 15-2 access control, configuring on VLAN interfaces 12-14 access control list (ACL) 6-78 access credentials, configuring 5-29 access ports, configuring 5-43 account password 1-6 accounts user, managing 18-17 ACE changing passwords 5-77 class map configuring 14-7 match conditions 14-8 configuration options 6-11 definition GL-1 license ANM license requirements 6-36 details 6-42 managing 6-36 removing 6-39 updating 6-40 viewing 6-36 parameter maps 10-2 policy map configuring 14-32 rules and actions 14-34 traffic policies 14-2 viewing license details 6-42 virtual server protocols 7-11 ACE 1.0 module class maps 14-7 configuration building block 16-6 parameter maps 10-2 policy maps 14-32 traffic policies 14-2 virtual server protocols 7-11 Index IN-2 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 ACE 2.0 module class map types 14-7 configuration building block 16-6 parameter map generic 10-8 RTSP 10-20 SIP 10-21 Skinny 10-23 parameter maps 10-2 policy maps 14-32 sticky types 9-2 traffic policies 14-2 virtual server protocols 7-11 ACE appliance changing passwords 5-75 class maps 14-7 configuration building block 16-6 configuring 5-34 licenses configuration 6-42 statistics 6-42 optimization parameter map 10-12 parameter maps 10-2 policy maps 14-32 synchronizing configurations 5-66 traffic policies 14-2 updating passwords 5-75 virtual server protocols 7-11 ACE appliances SSH, enabling 5-6 ACE license and required ANM licenses 6-36 details 6-42 managing 6-36 removing 6-39 updating 6-40 viewing 6-36 ACE module configuring 5-34 configuring access credentials 5-29 discovery enabling SSH access 5-28 process 5-31 monitoring discovery status 5-33 replace 5-82 synchronizing configurations 5-67 viewing by 7600 series router 5-79 by chassis 5-79 ACE modules ACE 2.0 SNMP polling 5-7 adding to ANM 5-16 HTTPS, enabling 5-6 OK/Pass state requirement 5-16 SSH, enabling 5-6 ACE network topology overview 3-12 ACL configuration overview 6-78 configuring EtherType attributes 6-87 extended ACL attributes 6-82 for VLANs 12-14 object groups 6-89 creating 6-79 deleting 6-100 managing 6-99 objects ICMP service parameters 6-97 IP addresses 6-91 protocols 6-93 subnet objects 6-92 TCP/UDP service parameters 6-94 resequencing 6-87 viewing by context 6-99 ACL object group configuring 6-89 Index IN-3 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 network objects IP addresses 6-91 subnet objects 6-92 service objects ICMP service parameters 6-97 protocols 6-93 TCP/UDP service parameters 6-94 ACLs, creating 6-79 action, setting for policy maps 14-34 action list application acceleration, configuring 14-85, 15-3 configuration options 7-55 HTTP header modify, configuring 14-85 HTTP header modify, SSL header insertion, configuring 14-85 HTTP header modify, SSL URL rewrite, configuring 14-85 activate, definition GL-1 activating DNS rules for GSS 7-75 real servers 8-14, B-15 virtual servers 7-71 adding ACE modules 5-16 CSM 5-19, 5-20 devices to ANM 5-10 domains 5-63 resource classes 6-46 SSL CSR parameters 11-25 parameter map cipher info 11-20 parameter maps 11-18, 11-27 user-defined groups 5-72 Admin context, first virtual context 6-2 administrative distance, definition GL-1 admin password 18-14 advanced editing mode 1-16 AES, definition GL-1 alarms configuring for notification 17-57 viewing 17-65 all-match policy map 14-32 ANM customizing default page 2-4 homepage 2-1, 2-3 ANM applications 1-2 ANM interface logging in 1-5 overview 1-8 password, changing account 1-7 login 1-7 table conventions 1-14 customizing 1-15 ANM server auto-sync settings 18-61 change audit logs 18-61 change audit logs, viewing 18-61 configuring attributes 18-57 license file name 18-54 polling, enabling 18-57 statistics 18-56 ANM template editor edit application template definition 4-18 overview 4-29 application acceleration configuring 7-53 action lists 7-55 globally on ACE appliances 15-9 monitoring 17-43 overview 15-2 traffic policies 15-2 typical configuration flow 15-2 virtual server, additional configuration options 7-57 application definition definitions create 4-20 Index IN-4 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 delete 4-29 export 4-26 import 4-26 test 4-28 application template definitions ANM template editor 4-29 edit 4-15 edit with ANM template editor 4-18 edit with external editor 4-19 managing 4-15 overview 4-1 system template 4-1 user-defined template 4-2 application template instance overview 4-2 application template instances create 4-4 delete deleting application template instance 4-13 deploy 4-7 duplicate 4-10 edit 4-9 list of instances 4-3 managing 4-3 view details 4-12 applying configuration building blocks 16-9 Appscope, configuration options 7-60 ARP definition GL-1 attributes BVI interfaces 12-20 DNS probes 8-57 Echo-TCP probes 8-58 Echo-UDP probes 8-58 Finger probes 8-58 for sticky group types 9-11 FTP probes 8-59 health monitoring 8-53 high availability 13-15 HTTP content sticky group 9-11 HTTP cookie sticky group 9-12 HTTP header sticky group 9-13 HTTP probes 8-60 HTTPS probes 8-61 IMAP probes 8-63 IP netmask sticky group 9-13 Layer 4 payload sticky group 9-14 new device 5-12 parameter map connection 10-3 DNS 10-25 generic 10-8 HTTP 10-10 optimization 10-12 RTSP 10-20 SIP 10-21 Skinny 10-24 POP probes 8-64 predictor method 7-42, 8-40 RADIUS sticky groups 9-14 RADIUS probes 8-65 real servers 8-6, 8-37 resource class 6-45 resource classes 6-45 RTSP header sticky groups 9-15 probes 8-65 scripted probes 8-66 server farms 7-34, 8-31 SIP-TCP probes 8-67 SIP-UDP probes 8-68 SMTP probes 8-69 SNMP 6-27 SNMP probes 8-69 SSL certificate export 11-16 Index IN-5 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 certificate import 11-8, 11-9 CSR parameters 11-25 for virtual servers 7-17 key export 11-17 key pair import 11-12 parameter map cipher info 11-20 parameter maps 11-18, 11-27 sticky group 9-8 TCP probes 8-70 Telnet probes 8-70 UDP probes 8-71 V6 prefix sticky group 9-13 virtual context 6-3, 6-13, 6-14 virtual servers 7-8 VLAN interfaces 12-6 VM probes 8-72 auditing building block configuration 6-101 resource classes 6-49 audit log configuring purge settings 18-58 audit logs ANM server change audit 18-61 audit sync settings configuring 18-61 authenticating ANM users with AAA server 18-38 authorization group certificate, configuring for SSL 11-32 autostate, enabling supervisor VLAN notification 12-5 autosync setting up syslog settings for 6-105 B backup defaults 6-61 bandwidth optimization, configuring 7-53 building block applying 16-9 configuration audit 6-101 changes and version numbers 16-4 options 16-2 primary attributes 16-8 configuring 16-7 creating 16-5 enable feature 16-5 extracting from virtual contexts 16-6 overview 16-1 primary attributes 16-8 tagging 16-4, 16-9 types 16-6 using 16-1 versions 16-4 viewing use 16-11 buttons descriptions 1-11 Graph The Component With Issue 17-66 BVI, definition GL-2 BVI interfaces attributes 12-20 configuring 12-19 viewing by context 12-25 C caching, dynamic 15-2 certificate exporting for SSL 11-15 importing for SSL 11-7 SSL 11-5 certificate chain, definition GL-2 certificate signing request, definition GL-2 chain group certificate, configuring for SSL 11-23 chain group parameters, configuring for SSL 11-23 changing account password 1-7 admin password 18-14 Index IN-6 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 domain information 5-63 login password 1-7 role rules 5-61 user passwords 18-14 chassis adding VLANs 5-48 changing passwords 5-75 configuring 5-34 access credentials 5-29 access ports 5-43 interfaces 5-42 primary attributes 5-38 routed ports 5-46 switch virtual interfaces 5-45 trunk ports 5-44 discovery process 5-31 managing 5-66 monitoring discovery status 5-33 running discovery 5-31 SSH, enabling 5-5 synchronizing configurations 5-66 Telnet default 5-5 viewing all modules 5-79 ports 5-42 VLAN managing 5-48 modifying 5-51 viewing 5-49 checking status of the Cisco ANM server 18-52 checkpoint, configuration creating 6-55 deleting 6-56 displaying 6-57 rolling back to 6-56 Cisco IOS software, definition GL-2 cisco-sample-cert 11-6 cisco-sample-key 11-6 class map ACE device support 14-7, 14-8 configuring 14-6 definition GL-2 deleting 14-6, 14-8 match conditions generic server load balancing 14-23 Layer 3/4 management traffic 14-12 Layer 3/4 network traffic 14-9 Layer 7 FTP command inspection 14-22 Layer 7 HTTP deep packet inspection 14-17 Layer 7 server load balancing 14-14 Layer 7 SIP deep packet inspection 14-30 RADIUS server load balancing 14-25 RTSP server load balancing 14-26 SIP server load balancing 14-27 overview 14-2, 14-3 setting match conditions 14-8 use with real servers 8-3 command inspection, FTP commands 14-22 configuration back up and restore overview 6-59 create a backup 6-62 restore 6-66 configuration attributes Appscope 7-60 delta optimization 7-57 device VLAN 5-48 extended ACL 6-83 health monitoring 8-53 high availability 13-15 HTTP return code maps 8-46 parameter map connection 10-3 DNS 10-25 generic 10-8 HTTP 10-10 optimization 10-12 RTSP 10-20 Index IN-7 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 SIP 10-21 Skinny 10-24 predictor method 7-42, 8-40 probe DNS 8-57 Echo-TCP 8-58 Echo-UDP 8-58 Finger 8-58 FTP 8-59 HTTP 8-60 HTTPS 8-61 IMAP 8-63 POP 8-64 RADIUS 8-65 RTSP 8-65 scripted 8-66 SIP-TCP 8-67 SIP-UDP 8-68 SMTP 8-69 SNMP 8-69 TCP 8-70 Telnet 8-70 UDP 8-71 VM 8-72 real server 8-6, 8-37 resource class 6-45 server farm 7-34, 8-31 SNMP users 6-30 SSL 7-17 sticky group 9-8 sticky type 7-47 syslog 6-20 trunk ports 5-44 virtual context 6-3 virtual server 7-8 configuration building block applying 16-9 configuring 16-7 creating 16-5 options 16-2 overview 16-1 tagging 16-4, 16-9 using 16-1 versions 16-4 configuration checkpoint and rollback service creating configuration checkpoint 6-55 deleting configuration checkpoint 6-56 displaying checkpoint information 6-57 overview 6-54 rolling back configuration 6-56 configuration options building blocks 16-2 by ACE device type 6-11 virtual contexts 6-9 configuration primary attributes virtual context 6-14 configurations synchronizing for ACE modules 5-67 for devices 5-66 for high availability 13-30 for virtual contexts 6-105 configuration synchronization 13-11 configuration template. See building block. configuration values, changing 20-1 configuring 7600 series router 5-34, 5-38 access ports 5-43 interfaces 5-42 switch virtual interfaces 5-45 trunk ports 5-44 acceleration 7-53 access credentials 5-29 access ports 5-43 ACE appliance passwords 5-75 ACE passwords 5-77 ACE SNMP for polling 5-7 ACE syslog messages 5-27, 18-62 Index IN-8 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 ACLs 6-79, 12-14 EtherType 6-87 extended 6-82 object groups 6-89 resequencing 6-87 action lists 7-55 action lists for application acceleration 15-3 action lists for HTTP header modify 14-85 application acceleration action lists 7-55 bandwidth optimization 7-53 building block primary attributes 16-8 building blocks 16-7 BVI interfaces 12-19 chassis 5-34, 5-38 access ports 5-43 interfaces 5-42 trunk ports 5-44 chassis passwords 5-75 class map match conditions generic server load balancing 14-23 Layer 3/4 management traffic 14-12 Layer 3/4 network traffic 14-9 Layer 7 FTP command inspection 14-22 Layer 7 HTTP deep packet inspection 14-17 Layer 7 server load balancing 14-14 Layer 7 SIP deep packet inspection 14-30 RADIUS server load balancing 14-25 RTSP server load balancing 14-26 SIP server load balancing 14-27 class maps 14-6 CSM 5-34 CSS 5-34, 5-35 CSS passwords 5-75 devices 5-34 DNS probe expect address 8-73 gigabit Ethernet interfaces 12-32 global application acceleration on ACE appliances 15-9 optimization on ACE appliances 15-9 GSS 5-36 GSS passwords 5-75 health monitoring general attributes 8-53 high availability groups 13-17, 13-19 host tracking 13-25 interface tracking 13-24 peer host probes 13-28 peers 13-15 synchronization 13-11 tracking and failure detection 13-23 host probes for high availability 13-26 HTTP probe headers 8-74 HTTP retcode maps 8-46 HTTPS probe headers 8-74 latency optimization 7-53 Layer 2 VLANs 5-50 Layer 3 VLANs 5-51 Layer 7 default load balancing 7-50 load balancing real servers 8-5 server farms 8-30 sticky groups 9-7 virtual servers 7-30 NAT 7-63, 12-26 object groups ICMP service parameters 6-97 IP addresses 6-91 protocols 6-93 subnet objects 6-92 TCP/UDP service parameters 6-94 OID for SNMP probes 8-76 optimization 7-53 action lists 7-55 traffic policies 15-6 organization passwords 18-10 parameter maps connection 10-3 DNS 10-25 Index IN-9 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 generic 10-8 HTTP 10-9 optimization 10-12, 15-6 RTSP 10-20 SIP 10-21 Skinny 10-23 PAT 12-27 policy map rules and actions 14-34 generic server load balancing 14-35 Layer 3/4 management traffic 14-39 Layer 3/4 network traffic 14-41 Layer 7 FTP command inspection 14-48 Layer 7 HTTP deep packet inspection 14-51 Layer 7 HTTP optimization 14-57 Layer 7 server load balancing 14-61 Layer 7 SIP deep packet inspection 14-68 Layer 7 Skinny deep packet inspection 14-71 RADIUS server load balancing 14-73 RDP server load balancing 14-75 RTSP server load balancing 14-76 SIP server load balancing 14-79 policy maps 14-32 port channel interfaces 12-35 probe attributes 8-56 probe expect status 8-74 protocol inspection 7-18 real servers 8-17, B-18 resource classes global 6-46 local 6-52 routed ports 5-46 server farm predictor method 8-39 shared objects 7-10 SNMP 6-27 communities 6-28 credentials 5-30 notification 6-33 on virtual contexts 6-27 trap destination hosts 6-32 version 3 users 6-29 SSL chain group parameters 11-23 CSR parameters 11-24 for virtual servers 7-17 OCSP service 11-29 parameter map 11-18 parameter map cipher 11-20 proxy service 11-27 static routes 5-39, 12-28 sticky groups 7-47, 9-7 sticky statics 9-15 switch virtual interfaces 5-45 syslog logging 6-19 log hosts 6-23 log messages 6-24 log rate limits 6-26 Telnet credentials 5-29 Telnet on chassis 5-5 traffic policies 14-1 trunk ports 5-44 virtual context 6-1, 6-8, 6-106 class maps 14-6 global policies 6-35 policy maps 14-32 primary attributes 6-14 resource classes 6-52 system attributes 6-13 virtual server configuration overview 7-2 default load balancing 7-50 Layer 7 load balancing 7-30 NAT 7-63 optimization 15-9 properties 7-11 protocol inspection 7-18 shared objects 7-9 Index IN-10 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 SSL termination service 7-17 VLAN interface access control 12-14 interface policy maps 12-14 interfaces 12-6 Layer 2 5-50 Layer 3 5-51 VLAN groups 5-52 VSS passwords 5-75 connection parameter map attributes 10-3 configuring 10-3 TCP options 10-7 using 8-77 connectivity, testing between devices 17-71 context back up and restore overview 6-59 configuration options 6-9 configuring 6-8 application acceleration 15-1 BVI interfaces 12-19 global policies 6-35 load balancing 7-1 optimization 15-1 primary attributes 6-14 resource classes 6-52 static routes 12-28 traffic policies 14-1 virtual servers 7-1 VLAN interfaces 12-6 create a configuration backup 6-62 creating 6-2 definition GL-7 deleting 6-107 editing 6-106 extracting configurations for building blocks 16-6 modifying 6-106 polling restarting 6-108 viewing status 6-104 restore a configuration 6-66 synchronizing configurations 6-105 sync status 6-103 upgrading 6-107 using for configuration building blocks 16-6 controlling access to Cisco ANM 18-3 conventions in ANM table 1-14 cookie client 9-3 sticky client identification 9-3 copying ACE licenses 6-37 creating ACLs 6-79 application template definition 4-20 application template instance 4-4 building blocks 16-5 domains 18-34 user accounts 18-19 user roles 18-29 virtual contexts 6-2 creating ACLs 6-79 credentials modifying 5-30 SNMP 5-30 Telnet 5-29 CSM adding to ANM 5-19, 5-20 configuring 5-34 primary attributes 5-34 viewing by chassis 5-79 CSR configuring parameters 11-24 definition GL-2 generating for SSL 11-26 CSS changing passwords 5-75 Index IN-11 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 configuring 5-34 primary attributes 5-35 synchronizing configurations 5-66 customizing tables 1-15 D Data Center Interconnect (DCI) overview 1-3 data dictionary 17-53 deep packet inspection HTTP class map match conditions 14-17 policy map rules and actions 14-51 SIP class map match conditions 14-30 policy map rules and actions 14-68 Skinny policy map rules and actions 14-71 default distance values 5-40 deleting ACLs 6-100 application template definition 4-29 class map in use 14-6 device RBAC user accounts 5-56 domains 5-65, 18-37 high availability groups 13-23 host probes for high availability 13-27 organizations 18-16 peer host probes 13-29 resource classes 6-51, 6-53 role rules 5-61 roles or domains 5-54 SSL objects 11-2 user accounts 18-23 user-defined groups 5-75 user roles 5-60, 18-32 virtual contexts 6-107 delta optimization configuration options 7-57 description 15-2 deploying application template instance 4-7 configuration building blocks 16-9 staged virtual servers 7-87 DES, definition GL-2 device adding to ANM 5-10 back up and restore overview 6-59 configuring 5-34 create a configuration backup 6-62 management overview 5-2 managing 5-1 monitoring 17-24 polling restarting 5-78 status 5-79 restore a configuration 6-66 viewing All Devices table 5-78 device audit trail logs monitoring 18-59 device groups, monitoring 17-23 device tree overview 1-10 discovery enabling SSH on ACE modules 5-28 monitoring progress 5-31, 5-33 process 5-31 running 5-31 displaying current user sessions 18-24 list of users 18-18 network domains 18-33 organizations 18-16 user roles 18-28 users who have a selected role 18-29 Index IN-12 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 distinguished name, definition GL-3 DNS configuring protocol inspection 7-19 parameter map attributes 10-25 configuring 10-25 probe attributes 8-57 expect address 8-73 DNS rules, and GSS 7-75 domains deleting 5-54 duplicate application template instance 4-10 duplicating domains 18-35 organizations 18-15 user accounts 18-20 user-defined groups 5-74 user roles 18-31 dynamic caching 15-2 Dynamic Workload Scaling brief summary and illustration 1-3 configure Nexus 7000 8-27 overview 8-26 VM controller 8-29 server farm 7-36, 8-33 E Echo-TCP probe attributes 8-58 Echo-UDP probe attributes 8-58 e-commerce applications, sticky requirements 9-1 using stickiness 9-4 edit application template definition 4-15 application template instance 4-9 role rules 5-61 enabling ACE syslog messages 5-27 setup syslog for Autosync 5-27 SNMP polling from ANM 5-7 write mem on Config > Operations 18-63 Ethernet interfaces, configuring 12-32 EtherType ACL, configuring 6-87 event definition GL-3 monitoring 17-55 event type, definition GL-3 exception, definition GL-3 expert options, for virtual contexts 6-101 export application template definition 4-26 export historical statistics 17-52 exporting SSL certificates 11-15 key 11-17 key pair 11-16 extended ACL configuration options 6-83 resequencing entries 6-87 F failover 13-9 fault, definition GL-3 fault tolerance groups 13-8 task overview 13-14 Feedback button 1-9 filtering tables 1-14 Finger probe attributes 8-58 first-match policy map 14-32 FlashForward object acceleration 15-2 FTP, configuring protocol inspection 7-19 Index IN-13 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 FTP command inspection available commands 14-22 class map match conditions 14-22 policy map rules and actions 14-48 FTP probe attributes 8-59 FTP strict, and RFP standards 14-48 FT VLAN 13-10 G generic parameter map attributes 10-8 configuring 10-8 generic server load balancing class map match conditions 14-23 policy map rules and actions 14-35 global acceleration and optimization, ACE appliances 15-9 global policies, configuring for virtual contexts 6-35 global resource class 6-44 applying to contexts 6-47 auditing 6-49 configuring 6-46 deleting 6-51 deploying 6-48 modifying 6-50 using 6-46 graphs, historical trend and real time 17-48 Graph The Component With Issue button 17-66 groups GSS DNS rules, managing 7-76 GSS VIP answers, managing 7-76 real servers, managing 8-10 virtual servers, managing 7-67 VLAN, assigning 12-4 VLAN, creating 12-3 GSS Answer Table 7-73, 7-75 changing passwords 5-75 DNS rules, activating suspending 7-75 DNS rules groups, managing 7-76 primary attributes 5-36 VIP answer groups, managing 7-76 VIP Answer table, managing 7-73 guided setup ACE hardware setup 3-5 ACE network topology overview 3-12 application setup 3-14 importing devices 3-4 operating considerations 3-4 overview 3-1 tasks and related topics 3-2 virtual context setup 3-10 guidelines for managing domains 18-33 user accounts 18-17 user roles 18-25 H hash load-balancing methods address 8-2 cookie 8-2 header 8-2 url 8-3 header deletion 14-86 insertion 14-85, 14-86 rewrite 14-85, 14-86 health monitoring configuring 8-49 for real servers 8-51 general attributes 8-53 inband 7-37, 8-34 overview 8-49 probe types 8-51 TCL scripts 8-50 heartbeat packets 13-9 Index IN-14 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Help button 1-9 high availability ANM requirements 5-8 clearing links between ACE appliances 13-17 pairs 13-17 configuration attributes 13-15 configuring groups 13-17 host probes 13-26 host tracking process 13-25 interface tracking process 13-24 overview 13-6 peer host probes 13-28 peers 13-15 deleting groups 13-23 host probes 13-27 peer host probes 13-29 failover detection 13-23 importance of synchronizing configurations 13-30 modifying groups 13-19 protocol 13-8 reconciling an SSL certificate/key pair 13-32 switching over a group 13-22 task overview 13-14 tracking status 13-23 historical statistics, export 17-52 historical trend graph 17-48 homepage customizing default page 2-4 link descriptions 2-1 overview 2-1 pages in ANM 2-3 HSRP, definition GL-3 HTTP configuring protocol inspection 7-20 content sticky group attributes 9-11 sticky type 9-3 cookie sticky group attributes 9-12 sticky type 9-3 deep packet inspection class map match conditions 14-17 policy map rules and actions 14-51 header sticky client identification 9-4 sticky group attributes 9-13 sticky type 9-4 load balancing conditions and options 7-32 optimization policy map rules and actions 14-57 parameter map attributes 10-10 configuring 10-9 parameter maps 8-77 probe attributes 8-60 configuring headers 8-74 retcode maps 8-46 return code map configuration options 8-46 protocol inspection conditions and options 7-23 HTTP header deletion 14-86 insertion 14-85, 14-86 rewrite 14-85, 14-86 HTTP header insertion 14-85 HTTPS ACE modules, enabling 5-6 configuring protocol inspection 7-20 load balancing conditions and options 7-32 probe attributes 8-61 configuring headers 8-74 protocol inspection conditions and options 7-23 Index IN-15 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 I ICMP service parameters, for object groups 6-97 IMAP probe attributes 8-63 import application definition definition 4-26 Import Failed, configuration status 6-103, 6-105 importing ACE licenses 6-37 ACE modules 5-16 CSM 5-19, 5-20 device failures 20-7 overview 5-10 SSL certificates 11-7 keys 11-11 inband health monitoring 7-37, 8-34 connection failure count 7-37, 8-34 reset timeout 7-37, 8-34 resume service 7-38, 8-35 installing ACE appliance licenses 6-37 interface ANM 1-8 buttons 1-11 configuring on 7600 series routers 5-42 on chassis 5-42 definition GL-4 gigabit Ethernet, configuring 12-32 table conventions 1-14 IP addresses, for object groups 6-91 IP discovery failure 20-7 IP netmask for sticky client identification 9-4 sticky group attributes 9-13 sticky type 9-4 IPv6 considerations 1-3 IPv6 prefix sticky type 9-4 K key exporting for SSL 11-17 importing for SSL 11-11 SSL 11-10 key pair, generating 11-14 L latency optimization, configuring 7-53 Layer 2 VLANs, configuring 5-50 Layer 3/4 management traffic class map match conditions 14-12 policy map rules and actions 14-39 network traffic class map match conditions 14-9 policy map rules and actions 14-41 Layer 3 VLANs, configuring 5-51 Layer 4 payload sticky group attributes 9-14 sticky type 9-4 Layer 7 configuring load balancing 7-30 default load balancing on virtual servers 7-50 FTP command inspection class map match conditions 14-22 policy map rules and actions 14-48 HTTP deep packet inspection class map match conditions 14-17 policy map rules and actions 14-51 HTTP optimization policy map rules and actions 14-57 load balancing HTTP/HTTPS conditions and options 7-32 setting match conditions 7-31 Index IN-16 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 server load balancing class map match conditions 14-14 policy map rules and actions 14-61 SIP deep packet inspection class map match conditions 14-30 policy map rules and actions 14-68 Skinny deep packet inspection policy map rules and actions 14-71 least bandwidth, load-balancing method 8-3 leastconns, load-balancing method 8-3 least loaded, load-balancing method 8-3 license errors, removing 18-55 managing for ACE devices 6-36 relationship between ANM and ACE licenses 6-36 removing ACE licenses 6-39 updating ACE licenses 6-40 viewing ACE license details 6-42 licenses ANM, removing 18-55 installing 6-37 lifeline guidelines for use 20-8 overview 20-7 lifeline management 18-72 load balancing configuration overview 7-1 configuring real servers 8-1, 8-5 server farms 8-1, 8-30 sticky groups 9-7 virtual servers 7-30 definition GL-4 hash address 8-2 hash cookie 8-2 hash header 8-2 hash url 8-3 least bandwidth 8-3 leastconns 8-3 least loaded 8-3 monitoring on probes 17-40 monitoring on real servers 17-37 monitoring on statistics 17-41 monitoring on virtual servers 17-33 overview 7-1, 8-1 predictors 8-2 response 8-3 roundrobin 8-3 local resource class 6-44 auditing 6-49 configuring 6-52 deleting 6-53 using 6-51 logging, syslog levels 6-19 logging in to ANM 1-5 Logout button 1-9 M managing 7600 series routers 5-66 ACLs 6-99 ANM 18-51 chassis 5-66 devices 5-1 domains 18-32 organizations 18-9 real servers 8-9 resource classes 6-43 user accounts 18-17 user roles 18-25 virtual contexts 6-103 virtual servers 7-66 VLANs 5-48 map real server to vCenter Server 5-68 match condition class map Index IN-17 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 generic server load balancing 14-23 Layer 3/4 management traffic 14-12 Layer 3/4 network traffic 14-9 Layer 7 FTP command inspection 14-22 Layer 7 HTTP deep packet inspection 14-17 Layer 7 server load balancing 14-14 Layer 7 SIP deep packet inspection 14-30 RADIUS server load balancing 14-25 RTSP server load balancing 14-26 SIP server load balancing 14-27 setting for class maps 14-8 Layer 7 load balancing 7-31 optimization 7-54 SIP protocol inspection 7-27 MD5, definition GL-4 menus, understanding 1-9 merged ACL 6-78 MIB, definition GL-4 MIME types, supported 10-26 mobile device registered devices 18-70 modifying deployed virtual servers 7-88 domains 5-65, 18-36 global resource class 6-50 high availability groups 13-19 organizations 18-14 real servers 8-17, B-18 staged virtual servers 7-88 user accounts 5-55, 18-21 user-defined groups 5-73 user roles 5-60, 18-31 virtual contexts 6-106 module configuring access credentials 5-29 discovery process 5-31 monitoring discovery progress 5-31 running discovery 5-31 viewing by chassis 5-79 by router 5-79 monitoring alarms 17-65 device audit trail logs 18-59 devices 17-3 events 17-55 load balancing 17-33, 17-37, 17-40 load balancing statistics 17-41 traffic 17-30 MSFC, adding switched virtual interface to 12-5 multi-match policy map 14-32 N Name Address Translation configuring 12-26 definition GL-4 NAT configuring 12-26 configuring for virtual servers 7-63 definition GL-4 Navigation pane 1-9 network object group configuring 6-89 IP addresses 6-91 subnet objects 6-92 network topology maps 17-68 O object, configuring for virtual servers 7-9 object group configuring for ACLs 6-89 GSS VIP answers and DNS rules 7-76 real servers 8-10 Index IN-18 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 virtual servers 7-67 ICMP service parameters 6-97 IP addresses 6-91 protocols 6-93 subnet objects 6-92 TCP/UDP service parameters 6-94 OCSP service, configuring for SSL 11-29 optimization additional configuration options 7-57 configuration overview 15-6 configuring 7-53 action lists 7-55 globally on ACE appliances 15-9 match conditions 7-54 parameter maps 15-6 traffic policies 15-6 delta optimization 15-2 enabling on virtual servers 15-9 match criteria 7-54 overview 15-2 parameter maps 8-77 traffic policies 15-2 typical configuration flow 15-2 virtual server, additional configuration options 7-57 optimization parameter map attributes 10-12 configuring 10-12 organizations definition GL-4 Out of Sync, configuration status 6-103, 6-105 Overlay Transport Virtualization (OTV) 1-3 overview ACL configuration 6-78 adding supported devices 5-10 admin icon 18-2 application acceleration 15-2 building blocks 16-1 class maps 14-2, 14-3 configuration building blocks 16-1 global and local resource classes 6-44 health monitoring 8-49 importing devices 5-10 load balancing 7-1, 8-1 load-balancing predictors 8-2 managing devices 5-2 optimization 15-2 optimization traffic policies 15-6 parameter maps 10-1 policy maps 14-2, 14-4 protocol inspection 14-6 real server 8-3 resource classes 6-43 server farm 8-3, 8-5 server health monitoring 8-49 server load balancing 8-1 SSL 11-1 stickiness 9-1 sticky group 9-6 sticky table 9-6 traffic policies 14-1 user-defined groups 5-72 using SSL keys and certificates 11-3 virtual server 7-2 P parameter expander functions 7-61, 10-18 parameter map ACE device support 10-2 attributes connection 10-3 DNS 10-25 generic 10-8 HTTP 10-10 optimization 10-12 RTSP 10-20 SIP 10-21 Skinny 10-24 Index IN-19 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 configuring connection 10-3 DNS 10-25 for SSL 11-18 generic 10-8 HTTP 10-9 optimization 10-12, 15-6 RTSP 10-20 SIP 10-21 Skinny 10-23 overview 10-1 types of 10-2 using with Layer 3/Layer 4 policy maps 14-5 policy maps 10-1 using with Layer 3/Layer 4 policy maps 8-77 parameter map cipher, configuring for SSL 11-20 passwords, changing admin 18-14 for accounts 1-7 for ACE appliance 5-75 for chassis 5-75 for CSS 5-75 for GSS 5-75 for the ACE 5-77 for VSS 5-75 in login window 1-7 PAT configuring 12-27 definition GL-5 peers, high availability 13-15 ping between devices 17-71 definition GL-5 policy map 14-34 ACE device support 14-32 associating with VLAN interface 12-14 configuring 14-32 match type all-match 14-32 first-match 14-32 multi-match 14-32 overview 14-2, 14-4 rule and action topic reference 14-34 rules and actions generic server load balancing 14-35 Layer 3/4 management traffic 14-39 Layer 3/4 network traffic 14-41 Layer 7 FTP command inspection 14-48 Layer 7 HTTP deep packet inspection 14-51 Layer 7 HTTP optimization 14-57 Layer 7 server load balancing 14-61 Layer 7 SIP deep packet inspection 14-68 Layer 7 Skinny deep packet inspection 14-71 RADIUS server load balancing 14-73 RDP server load balancing 14-75 RTSP server load balancing 14-76 SIP server load balancing 14-79 setting rules and actions 14-34 polling enabling 18-57 parameters, setting 17-46 restarting for devices 5-78 for virtual contexts 6-108 status for devices 5-79 for virtual contexts 6-104 POP probe attributes 8-64 port number, configuring for probes 8-54 Port Address Translation configuring 12-27 definition GL-5 port channel interfaces attributes 12-37 configuring 12-35 ports Index IN-20 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 ANM, used for ANM client (browser) to ANM server communication A-1 ANM, used for managed device communication A-1 definition GL-5 reference A-1 predictor hash address 8-2 hash cookie 8-2 hash header 8-2 hash url 8-3 least bandwidth 8-3 leastconns 8-3 least loaded 8-3 response 8-3 roundrobin 8-3 predictor method attributes 7-42, 8-40 configuring for server farms 8-39 primary attributes 7600 series routers 5-38 chassis 5-38 configuration building blocks 16-8 CSM 5-34 CSS 5-35 GSS 5-36 virtual contexts 6-14 probe attribute tables 8-56 configuring expect status 8-74 configuring for health monitoring 8-51 configuring SNMP OIDs 8-76 DNS 8-57 Echo-TCP 8-58 Echo-UDP 8-58 Finger 8-58 FTP 8-59 HTTP 8-60 HTTPS 8-61 IMAP 8-63 POP 8-64 port number 8-54 RADIUS 8-65 RTSP 8-65 scripted 8-66 scripting using TCL 8-50 SIP-TCP 8-67 SIP-UDP 8-68 SMTP 8-69 SNMP 8-69 TCP 8-70 Telnet 8-70 types for real server monitoring 8-51 UDP 8-71 VM 8-72 process, for traffic classification 14-3 protocol inspection configuring for virtual servers 7-18 configuring match criteria HTTP and HTTPS 7-22 SIP 7-27 HTTP/HTTPS conditions and options 7-23 overview 14-6 SIP conditions and options 7-28 virtual server options 7-19 protocol names and numbers 6-86 protocols for object groups 6-93 for virtual servers 7-11 proxy service, configuring for SSL 11-27 R RADIUS probe attributes 8-65 server load balancing class map match conditions 14-25 policy map rules and actions 14-73 sticky group attributes 9-14 Index IN-21 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 sticky type 9-5 RBAC, definition GL-5 RDP server load balancing policy map rules and actions 14-75 real server activating 8-14, B-15 adding to server farm 8-37 configuration attributes 8-6, 8-37 configuring 8-5 load balancing service 8-1 definition GL-5 groups 8-10 health monitoring 8-49, 8-51 modifying 8-17, B-18 overview 8-3 suspending 8-15, B-16 viewing all 8-18 real time graph 17-48 redundancy configuration requirements 13-12 configuration synchronization 13-11 definition GL-5 FT VLAN 13-10 protocol 13-8 task overview 13-14 registered mobile device list 18-70 removing ACE license 6-39 ANM license files 18-55 rules from roles 5-61 resource, required for sticky groups 9-7 resource class adding 6-46 allocation constraints 6-44 applying global resource classes 6-47 attributes 6-45 auditing local and global resource classes 6-49 configuring globally 6-46 locally 6-52 definition GL-5 deleting global resource class 6-51 local resource class 6-53 deploying global resource class 6-48 global 6-44 local 6-44 managing 6-43 modifying 6-50 overview 6-43 using global classes 6-46 local classes 6-51 viewing use by contexts 6-54 resources, allocation constraints 6-44 resource usage, viewing 17-26 response load-balancing method 8-3 restarting ANM (see the Installation Guide) 18-56 restarting device polling 5-78 restore defaults 6-61 role definition GL-7 deleting 5-54 role-based access control authenticating ANM users with AA server 18-38 containment overview 18-4 definition GL-5 roundrobin, load-balancing predictor 8-3 routed ports, configuring 5-46 routes, configuring static routes 5-39 RSA, definition GL-5 RTSP header sticky group attributes 9-15 sticky type 9-5 parameter map Index IN-22 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 attributes 10-20 configuring 10-20 probe attributes 8-65 server load balancing class map match conditions 14-26 policy map rules and actions 14-76 rule changing for roles 5-61 setting for policy maps 14-34 S sample SSL certificate and key pair 11-6 screens, understanding 1-9 scripted probe attributes 8-66 overview 8-50 secondary IP addresses 12-14 secondary IP groups 12-14 security ACL 6-78 server activating real 8-14, B-15 virtual 7-71 managing 8-9 suspending real 8-15, B-16 virtual 7-72 server farm adding real servers 8-37 configuration attributes 7-34, 8-31 configuring HTTP return error-code checking 8-46 load balancing 8-1, 8-30 predictor method 8-39 definition GL-6 Dynamic Workload Scaling 7-36, 8-33 health monitoring 8-49 inband health monitoring 7-37, 8-34 overview 8-3, 8-5 predictor method attributes 7-42, 8-40 viewing list of 8-48 Server Load Balancer (SLB), definition GL-6 server load balancing generic class map match conditions 14-23 generic policy map rules and actions 14-35 Layer 7 class map match conditions 14-14 Layer 7 policy map rules and actions 14-61 overview 7-1, 8-1 RADIUS class map match conditions 14-25 RADIUS policy map rules and actions 14-73 RDP policy map rules and actions 14-75 RTSP class map match conditions 14-26 RTSP policy map rules and actions 14-76 SIP class map match conditions 14-27 SIP policy map rules and actions 14-79 service, definition GL-6 service object group configuring 6-89 ICMP service parameters 6-97 protocols 6-93 TCP/UDP service parameters 6-94 setup sequence SSL 11-4 setup syslog for Autosync, enabling 5-27 shared object and deleting virtual servers 7-10 configuring 7-10 configuring for virtual servers 7-9 SIP configuring protocol inspection 7-21 deep packet inspection class map match conditions 14-30 policy map rules and actions 14-68 header sticky type 9-5 parameter map attributes 10-21 configuring 10-21 Index IN-23 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 protocol inspection conditions and options 7-28 server load balancing class map match conditions 14-27 policy map rules and actions 14-79 SIP-TCP probe attributes 8-67 SIP-UDP probe attributes 8-68 Skinny deep packet inspection policy map rules and actions 14-71 parameter map attributes 10-24 configuring 10-23 SMTP configuring for email notifications 17-68 probe attributes 8-69 SNMP configuration attributes 6-27 configuring communities 6-28 for virtual contexts 6-27 notification 6-33 trap destination hosts 6-32 version 3 users 6-29 credentials 5-30 enabling collection 6-108 enabling polling 5-7 probe attributes 8-69 supported versions 5-7 trap destination host configuration 6-32 user configuration attributes 6-30 special characters for matching string expressions 14-84 special configuration file, definition GL-6 SSH ACE appliance, enabling 5-6 ACE modules, enabling 5-6 chassis, enabling 5-5 enabling on ACE modules for discovery 5-28 SSHv2, chassis requirement in ANM 5-6 SSL certificate exporting 11-15 exporting attributes 11-16 importing 11-7 importing attributes 11-8, 11-9 overview 11-3 sample 11-6 using 11-5 configuring authorization group certificates 11-32 chain group certificates 11-23 chain group parameters 11-23 CSR parameters 11-24 for virtual servers 7-17 OCSPservice 11-29 parameter map 11-18 parameter map cipher 11-20 proxy service 11-27 CSR parameters 11-25 editing CSR parameters 11-25 parameter map cipher info 11-20 parameter maps 11-18, 11-27 exporting certificates 11-15 key pairs 11-16 keys 11-17 generating CSR 11-26 key pair 11-14 header insertion, configuring 14-89 importing certificates 11-7 keys 11-11 key exporting 11-17 importing 11-11 overview 11-3 using 11-10 Index IN-24 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 key pair exporting 11-16 generating 11-14 importing attributes 11-12 sample 11-6 objects, deleting 11-2 overview 11-1 parameter map cipher table 11-20 parameter maps 11-18, 11-27 procedure overview 11-3 redirect authentication failure 11-21 sample certificate and key pair 11-6 setup sequence using 11-4 URL rewrite, configuring 14-88 SSL certificate, using 11-5 SSL header insertion, configuring 14-85, 14-89 SSL key, using 11-10 SSL setup sequence, using 11-4 SSL URL rewrite, configuring 14-85 staged virtual server deploying 7-87 viewing all 7-87 static route configuring 5-39, 12-28 statistics ANM server 18-56 status, Cisco ANM server 18-52 Status bar 1-9 stickiness cookie-based 9-3 HTTP content 9-3 HTTP cookie 9-3 HTTP header 9-4 IP netmask 9-4 IPv6 prefix 9-4 Layer 4 payload 9-4 overview 9-1 RADIUS 9-5 RTSP header 9-5 SIP header 9-5 sticky group 9-6 sticky table 9-6 types 9-2 sticky cookies for client identification 9-3 definition GL-6 e-commerce application requirements 9-1 groups 9-6 HTTP header for client identification 9-4 IP netmask for client identification 9-4 overview 9-2 types 9-2 sticky group attributes HTTP content 9-11 HTTP cookie 9-12 HTTP header 9-13 IP netmask 9-13 Layer 4 payload 9-14 RADIUS 9-14 RTSP header 9-15 V6 prefix 9-13 configuration options 7-47, 9-8 configuring load balancing 9-7 sticky statics 9-15 overview 9-6 required resource allocation 9-7 type-specific attributes 9-11 viewing 9-15 sticky statics, configuring for sticky groups 9-15 sticky table overview 9-6 sticky type IP netmask 9-4 HTTP content 9-3 HTTP cookie 9-3 Index IN-25 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 HTTP header 9-4 IPv6 prefix 9-4 Layer 4 payload 9-4 RADIUS 9-5 RTSP header 9-5 SIP header 9-5 string expression, special characters 14-84 subnet objects, for object groups 6-92 supervisor assigning VLAN groups to the ACE 12-4 supervisor module, viewing by chassis 5-79 suspend, definition GL-6 suspending DNS rules for GSS 7-75 real servers 8-15, B-16 virtual servers 7-72 switched virtual interface, adding to MSFC 12-5 switchover 13-9 switch virtual interfaces, configuring 5-45 synchronization of configuration 13-11 synchronizing ACE module configurations 5-67 configurations for high availability 13-30 contexts created in CLI 7-2, 7-4 device configurations 5-66 virtual context configurations 6-105 sync status, virtual contexts 6-103 syslog configuration attributes 6-20 configuring logging 6-19 logging levels 6-19 log hosts 6-23 log messages 6-24 log rate limits 6-26 settings for synchronizing with ACE CLI autosync 6-105 syslog, setup for Autosync 5-27 syslog logging, configuring 6-19 syslog messages enabling ACE 5-27 overwriting the ACE logging device-id 18-62 system templates 4-1 T table conventions 1-14 customizing 1-15 default distance values 5-40 filtering information in 1-14 ICMP type numbers and names 6-98 protocol names and numbers 6-86 topic reference for policy map rules and actions 14-34 table conventions 1-14 tables for probe attributes 8-56 for sticky group attributes 9-11 TACACS+ server, authenticating ANM users 18-38 tagging building blocks 16-4, 16-9 takeover, forcing in high availability 13-22 task overview, redundancy 13-14 TCL script health monitoring 8-50 overview 8-50 TCP options for connection parameter maps 10-7 probe attributes 8-70 service parameters for object groups 6-94 Telnet configuring credentials 5-29 import method for chassis 5-5 probe attributes 8-70 template. See building block. template editor 4-29 edit application template definition 4-18 templates system 4-1 Index IN-26 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 user-defined 4-2 terminating current user sessions 18-24 test application definition definition 4-28 threshold, definition GL-7 topic reference for configuring rules and actions 14-34 topology maps 17-68 traceroute, definition GL-7 traffic, monitoring 17-30 traffic class components 14-4 traffic classification process 14-3 traffic policy ACE device support 14-2 components 14-4 configuring 14-1 for application acceleration 15-2 for optimization 15-2 lookup order 14-5 overview 14-1 troubleshooting importing, ACE module state 5-16 IP discovery 20-7 troubleshooting, using lifeline 20-7 trunk ports, configuring 5-44 types of user 18-5 U UDP probe attributes 8-71 UDP service parameters, for object groups 6-94 understanding domains 18-7 operations privileges 18-6 roles 18-6 user groups 18-7 Unprovisioned, configuration status 6-103, 6-105 updating, configuration values 20-1 updating ACE licenses 6-40 upgrading virtual contexts 6-107 URL rewrite, configuring 14-88 user-defined groups adding 5-72 deleting 5-75 duplicating 5-74 modifying 5-73 overview 5-72 user-defined templates 4-2 user roles, definition GL-7 using ACLs 6-78 building blocks 16-1 virtual contexts 6-2 V V6 prefix sticky group attributes 9-13 versions of building blocks 16-4 view application template instance details 4-12 viewing 18-61 7600 series router VLANs 5-49 ACE license details 6-36 ACLs by context 6-99 all devices 5-78 all real servers 8-18 all server farms 8-48 all sticky groups 9-15 all virtual servers 7-81 building block use 16-11 BVI interfaces by context 12-25 chassis VLANs 5-49 configuration building block use 16-11 current user sessions 18-24 license information 6-42 ports 5-42 resource class use on contexts 6-54 Index IN-27 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 staged virtual servers 7-87 virtual server details 7-81 virtual servers by context 7-65 VLAN interfaces by context 12-18 VIP Answer table, and GSS 7-73 virtual context back up and restore overview 6-59 comparing configuration with building block 6-101 configuration attributes 6-3 audit 6-101 options 6-8, 6-9 primary attributes 6-14 configuring 6-1 BVI interfaces 12-19 class map match conditions 14-8 class maps 14-6 global policies 6-35 load balancing services 7-1 policy map rules and actions 14-34 policy maps 14-32 primary attributes 6-14 resource classes 6-52 SNMP 6-27 static routes 12-28 syslog 6-19 system attributes 6-13 VLAN interfaces 12-6 create a configuration backup 6-62 creating 6-2 definition GL-7 deleting 6-107 description 6-2 expert options 6-101 managing 6-103 modifying 6-106 monitoring resource usage 17-26 polling restarting 6-108 viewing status 6-104 restore a configuration 6-66 synchronizing configurations 6-105 sync status 6-103 syslog setup for autosync 6-105 upgrading 6-107 using for configuration building blocks 16-6 overview 6-2 viewing all contexts 6-103 BVI interfaces 12-25 polling status 6-104 resource class use 6-54 sync status 6-103 VLANS 12-18 virtual data center B-1, B-2 Virtual Local Area Network (VLAN), definition GL-7 virtual server 7-30, 7-57 activating 7-71 additional options 7-3 advanced view properties 7-12 and user roles 7-3 application acceleration 7-53 application acceleration, additional configuration options 7-57 basic view properties 7-16 configuration methods 7-4 recommendations 7-4 configuration subsets 7-8 configuring 7-1, 7-2, 7-7 application acceleration 7-53 default Layer 7 load balancing 7-50 in ANM 7-2 in CLI 7-2, 7-4 Layer 7 load balancing 7-30 NAT 7-63 optimization 7-53, 15-9 Index IN-28 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 properties 7-11 protocol inspection 7-18 shared objects 7-9 SSL 7-17 definition GL-7 deleting and shared objects 7-10 deployed servers, modifying 7-88 deploying staged servers 7-87 groups 7-67 GSS answer table 7-73, 7-75 load balancing default 7-50 Layer 7 7-30 managing 7-66 minimum configuration 7-2 modifying deployed servers 7-88 staged servers 7-88 optimization 7-53 overview 7-2 properties advanced view 7-12 basic view 7-16 protocols 7-11 recommendations for configuring 7-4 shared objects 7-5, 7-9 SSL attributes 7-17 staged servers deploying 7-87 modifying 7-88 viewing 7-87 suspending 7-72 viewing all 7-81 by context 7-65 details 7-81 servers 7-65 staged servers 7-87 VLAN adding to 7600 series router 5-48 adding to chassis 5-48 configuring access control 12-14 ACLs 12-14 Layer 2 VLANs 5-50 Layer 3 VLANs 5-51 NAT 12-26 policy maps 12-14 creating VLAN groups 5-52 definition GL-7 FT VLAN for redundancy 13-10 interface access control 12-14 attributes 12-6 configuring 12-6 NAT pools 12-26 policy maps 12-14 viewing 12-18 managing 5-48 modifying on 7600 series router 5-51 on chassis 5-51 viewing by 7600 series router 5-49 by chassis 5-49 VLAN group, creating 5-52 VLAN interfaces attributes 12-6 configuring 12-6 access control 12-14 for virtual contexts 12-6 policy maps 12-14 viewing by context 12-18 VLANs configuring 12-3 configuring on the supervisor 12-3 enabling autostate supervisor notification 12-5 groups, assigning 12-4 Index IN-29 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 groups, creating 12-3 secondary IP addresses, configuring 12-14 switched virtual interfaces, adding to MSFC 12-5 VLAN Trunking Protocol, definition GL-8 VM probe attributes 8-72 VMware ANM plug-in B-2 Cisco ACE SLB tab details B-3 overview B-3 information about B-2 mananging real servers B-12 map real server to vCenter Server 5-68 vCenter Server B-2 vSphere Client B-2 VSS changing passwords 5-75 VTP, definition GL-8 VTP domain, definition GL-8 W Web server, definition GL-8 weighted roundrobin. See roundrobin write mem on Config > Operations, enabling 18-63 Index IN-30 User Guide for the Cisco Application Networking Manager 5.2 OL-26572-01 Mode de introduction manuel de profil de configuration d'IPSec sur RV160 et RV260 Objectif L'objectif de ce document est de t'afficher comment configurer le profil IPSec pour le mode de introduction manuel sur des Routeurs de gammes RV160 et RV260. Introduction IPsec s'assure que vous avez la communication privée sécurisée au-dessus de l'Internet. Il donne deux ou plus héberge l'intimité, l'intégrité, et l'authenticité pour les informations confidentielles de transmission au-dessus de l'Internet. IPsec est utilisé généralement dans un réseau privé virtuel (VPN), mis en application à la couche IP, et peut aider beaucoup d'applications qui manquent de la Sécurité. Un VPN est utilisé pour fournir un mécanisme de communication protégée pour les données sensibles et les informations IP qui sont transmises par un réseau unsecure tel que l'Internet. Il fournit une solution flexible pour que des utilisateurs distants et l'organisation protège n'importe quelles informations confidentielles contre d'autres interlocuteurs sur le même réseau. Le mode de introduction manuel réduit la flexibilité et les options d'IPsec. Il exige de l'utilisateur de fournir le matériel de base et les informations nécessaires d'association de sécurité à chaque périphérique qui est configuré. L'introduction de manuel ne mesure pas bien car il est habituellement meilleur utilisé dans un petit environnement. Il est seulement recommandé d'utiliser cette méthode si l'implémentation de l'échange de clés Internet (IKE) (IKE)v1 ou IKEv2 sur ce routeur n'est pas identique que votre routeur distant ou si un des Routeurs ne prend en charge pas l'IKE. Dans des ces cas, vous pourriez manuellement entrer les clés. Il est recommandé pour configurer le mode de introduction automatique pour le profil IPSec au lieu du mode de introduction manuel si votre routeur prend en charge IKEv1 ou IKEv2 et suit les mêmes normes. En utilisant le manuel introduisant le mode, assurez-vous que votre clé dedans sur votre routeur local est la clé sur le routeur distant et la clé dedans sur votre routeur distant est la clé sur votre routeur local. Un exemple de la configuration pour les deux Routeurs serait : Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) Première publication: 1 Janvier 02012 Dernière modification: 18 Juin 2012 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 LES SPÉCIFICATIONS ET INFORMATIONS RELATIVES AUX PRODUITS PRÉSENTÉS DANS CE MANUEL SONT SUSCEPTIBLES DE MODIFICATIONS SANS PRÉAVIS. TOUTES LES DÉCLARATIONS, INFORMATIONS ET RECOMMANDATIONS FOURNIES DANS CE MANUEL SONT EXACTES À NOTRE CONNAISSANCE, MAIS SONT PRÉSENTÉES SANS GARANTIE D'AUCUNE SORTE, EXPRESSE OU IMPLICITE. LES UTILISATEURS ASSUMENT L'ENTIÈRE RESPONSABILITÉ DE L'APPLICATION DE TOUT PRODUIT. LA LICENCE DE LOGICIEL ET LA GARANTIE LIMITÉE DU PRODUIT CI-JOINT SONT DÉFINIES DANS LES INFORMATIONS FOURNIES AVEC LE PRODUIT ET SONT INTÉGRÉES AUX PRÉSENTES SOUS CETTE RÉFÉRENCE. SI VOUS NE TROUVEZ PAS LA LICENCE DE LOGICIEL OU LA GARANTIE LIMITÉE, CONTACTEZ VOTRE REPRÉSENTANT CISCO POUR EN OBTENIR UNE COPIE. Les informations ci-dessous concernent la conformité FCC des dispositifs de classe A : Cet équipement a été testé et respecte les limites relatives aux dispositifs numériques de classe A conformément au chapitre 15 des règles FCC. Ces limites sont destinées à fournir une protection raisonnable contre les interférences nuisibles causées lorsque l'équipement est utilisé dans un environnement commercial. Cet équipement génère, utilise et peut émettre des fréquences radio et, s'il n'est pas installé et utilisé conformément au manuel de l'utilisateur, peut causer des interférences susceptibles de perturber les communications radio. L'utilisation de cet équipement dans un environnement résidentiel est susceptible de causer des interférences nuisibles, auquel cas les utilisateurs sont priés de corriger ces interférences à leurs frais. Les informations ci-dessous concernent la conformité FCC des dispositifs de classe B : Cet équipement a été testé et respecte les limites relatives aux dispositifs numériques de classe B conformément au chapitre 15 des règles FCC. Ces limites sont destinées à fournir une protection raisonnable contre les interférences nuisibles causées lorsque l'équipement est utilisé dans un environnement résidentiel. Cet équipement génère, utilise et peut émettre desfréquencesradio et,s'il n'est pasinstallé et utilisé conformément aux instructions, peut causer desinterférences susceptibles de perturber les communicationsradio. Nous ne pouvonstoutefois pas vous garantir qu'aucune installation ne causera desinterférences. Si l'équipement provoque desinterférences au niveau de la réception de la radio ou de la télévision, ce qui peut être constaté en l'allumant et en l'éteignant, l'utilisateur est invité à essayer de remédier à ces interférences en appliquant une ou plusieurs des mesures ci-dessous : • Réorientez ou déplacez l'antenne de réception. • Augmentez la distance entre l'équipement et le récepteur. • Connectez l'équipement à une prise sur un autre circuit que celui sur lequel le récepteur est connecté. • Rapprochez-vous d'un revendeur ou d'un technicien radio/TV expérimenté pour obtenir de l'aide. Toute modification apportée à ce produit sans l'autorisation de Cisco peut invalider l'approbation FCC ainsi que votre droit à utiliser le produit. L'implémentation par Cisco de la compression d'en-tête TCP est une adaptation d'un programme développé par l'Université de Californie, Berkeley (UCB) dans le cadre de la version du domaine public de l'UCB du système d'exploitation UNIX. Tous droits réservés. Copyright © 1981, Regents of the University of California. PAR DÉROGATION À TOUTE AUTRE GARANTIE DÉFINIE ICI, TOUS LES FICHIERS DE DOCUMENTATION ET LOGICIELS DE CES FOURNISSEURS SONT FOURNIS "EN L'ÉTAT" AVEC TOUS LEURS DÉFAUTS. CISCO ET LES FOURNISSEURS SUSMENTIONNÉS DÉCLINENT TOUTE GARANTIE EXPLICITE OU IMPLICITE, NOTAMMENT CELLES DE QUALITÉ MARCHANDE, D'APTITUDE À UN BUT PARTICULIER ET DE NON-CONTREFAÇON, AINSI QUE TOUTE GARANTIE EXPLICITE OU IMPLICITE LIÉE A DES NÉGOCIATIONS, À UN USAGE OU À UNE PRATIQUE marques Cisco. EN AUCUN CAS CISCO OU SES FOURNISSEURS NE SAURAIENT ÊTRE TENUS POUR RESPONSABLES DE DOMMAGES INDIRECTS, SPÉCIAUX, CONSÉQUENTS OU ACCIDENTELS, Y COMPRIS ET SANS LIMITATION, LA PERTE DE PROFITS OU LA PERTE OU LES DOMMAGES DE DONNÉES CONSÉCUTIVES À L'UTILISATION OU À L'IMPOSSIBILITÉ D'UTILISER CE MANUEL, MÊME SI CISCO OU SES FOURNISSEURS ONT ÉTÉ AVERTIS DE LA POSSIBILITÉ DE TELS DOMMAGES. Cisco et le logo Cisco sont des marques ou des marques déposées de Cisco et/ou de ses filiales aux États-Unis et dans d'autres pays. Pour afficher la liste des marques Cisco, rendez-vous à l'adresse :http://www.cisco.com/go/trademarkshttp://www.cisco.com/go/trademarks. Les autres marques mentionnées sont la propriété de leurs détenteurs respectifs. L'utilisation du mot "partenaire" n'implique aucune relation de partenariat entre Cisco et toute autre entreprise. (1110R) Les adresses IP (Internet Protocol) utilisées dans ce document sont fictives. Tous les exemples, sorties d'affichage de commandes et chiffres présents dans ce document ne sont donnés qu'à titre indicatif. Toute utilisation d'une adresse IP réelle dans un contenu illustratif serait involontaire et pure coïncidence. © 2012 Cisco Systems, Inc. All rights reserved. TABLE DES MATIÈRES Préface xi Introduction xi Informations complémentaires xii Didacticiels d'apprentissage électronique du téléphone IP Cisco Unified 7900 Series xii Consignes de sécurité et informations relatives aux performances xiii Coupure de courant xiii Périphériques externes xiii Sécurité des produits Cisco xiv Fonctions d'accessibilité xiv Fonctions de votre téléphone IP Cisco Unified 1 Boutons et matériel 1 Définitions de ligne et d'appel 5 Icônes de ligne et d'appel 6 Fonctions de l'écran du téléphone 7 Navigation dans le menu d'application 8 Système d'aide du téléphone 9 Disponibilité des fonctions 9 Protocoles de signalisation SIP et SCCP 10 Économies d'énergie 11 Installation du téléphone 13 Connexions du téléphone IP Cisco Unified 7931G 13 Verrouillage de câble du téléphone 14 Réglage du support du combiné 15 Enregistrement TAPS 15 Prise en charge de casques 16 Qualité audio 16 Informations sur le casque sans fil 16 Fonctions d'appel 17 Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) iii Options d'appels de base 17 Passage d'un appel 18 Passage d'un appel à l'aide du haut-parleur 18 Passage d'un appel à l'aide du casque 19 Rappel d'un numéro 19 Composition d'un numéro à partir d'un journal des appels 19 Options des appels supplémentaires 19 Passage d'un appel lorsqu'un autre est actif (sur une ligne différente) 20 Passage d'un appel à l'aide de la numérotation simplifiée 20 Composition d'un numéro depuis le répertoire d'entreprise sur le téléphone 20 Avertissement lorsque le poste occupé ou qui sonne est disponible (rappel) 21 Passage d'un appel prioritaire (qui a la préséance) 21 Composition d'un numéro à partir d'une entrée du carnet d'adresses personnel 21 Passage d'un appel à l'aide d'un code de facturation ou de suivi 22 Utiliser la fonction d'accès vocal mobile pour passer un appel depuis un téléphone portable 22 Passage d'un appel à l'aide de la numérotation simplifiée 22 Passage d'un appel à l'aide du carnet d'adresses personnel 22 Réponse à un appel 23 Déconnexion de l'appel 24 Mise en attente et reprise des appels 25 Mettre un appel en attente 26 Reprendre un appel mis en attente sur la ligne active 26 Plusieurs appels 26 Mouvement des appels en cours 26 Transférer un appel en cours d'un téléphone portable vers un téléphone de bureau qui partage la même ligne (transfert de session) 27 Transférer un appel en cours d'un téléphone portable vers un téléphone de bureau 27 Transférer un appel en cours d'un téléphone portable vers des périphériques Cisco Unified qui partagent la même ligne (transfert de session) 27 Coupure micro 28 Désactiver ou rétablir le son de l'appel 28 Transfert des appels 28 Transfert d'un appel sans parler au destinataire du transfert 29 Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) iv Table des matières Comment informer le destinataire du transfert avant de lui transférer un appel (transfert par consultation) 29 Transfert de l'appel vers le système de messagerie vocale 29 Transférer un appel actif, qui sonne ou en attente vers un système de messagerie vocale 30 Renvoi d'appels 30 Configurer et annuler le renvoi de tous les appels à partir du téléphone 31 Configuration ou annulation du renvoi d'appels 32 Ne pas déranger 32 Activation et désactivation de la fonction NPD 32 Configuration des paramètres NPD 33 Conférences 33 Conférence ad hoc 33 Création d'une conférence en appelant chacun des participants 34 Ajout de participants à la conférence 34 Comment se joindre à la conférence 35 Joindre des appels existants sur une même ligne téléphonique 35 Comment joindre des appels existants sur plusieurs lignes téléphoniques 35 Conférence Meet-Me 36 Démarrage d'une conférence Meet-Me 36 Comment se joindre à une conférence Meet-Me 36 Liste des participants à la conférence 37 Contrôle de la conférence à l'aide de la liste des participants 37 Vérification de la sécurité de la conférence 38 Appels intercom 38 Passage d'un appel intercom vers le numéro intercom préconfiguré 39 Passage d'un appel intercom vers un numéro intercom 39 Réception d'un appel intercom 39 Gestion avancée des appels 39 Numérotation simplifiée 40 Passage d'un appel à l'aide des boutons de numérotation simplifiée 40 Passage d'un appel à l'aide de la numérotation simplifiée avec le combiné raccroché 40 Passage d'un appel avec la numérotation simplifiée avec le combiné décroché 41 Établir une conférence avec la numérotation simplifiée avec le combiné décroché 41 Transférer un appel avec la numérotation simplifiée avec le combiné décroché 41 Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) v Table des matières Passage d'un appel avec la numérotation simplifiée avec le combiné décroché dans un appel en attente 42 Passage d'un appel à l'aide de la numérotation simplifiée 42 Interception d'appels 42 Réponse à un appel entrant qui sonne sur un autre poste de votre groupe d'interception d'appels 43 Réponse à un appel qui sonne sur un autre poste en dehors de votre groupe de prise d'appel 43 Réponse à un appel qui sonne sur un autre poste dans le groupe ou dans le groupe associé 43 Réponse à un appel qui sonne sur un poste donné (numéro de ligne) 44 Parcage d'appels 44 Stocker et récupérer l'appel actif à l'aide du Parcage d'appels 45 Diriger et stocker un appel actif vers un numéro de parcage d'appels dirigé 45 Récupérer un appel parqué depuis un numéro de parcage d'appels dirigé 45 Envoi, stockage et récupération un appel actif vers un numéro de parcage d'appels dirigé 46 Groupes de recherche 46 Connexion et déconnexion des groupes de recherche 46 Lignes partagées 46 Icône Utilisé à distance 47 Informations sur les appels et l'insertion 47 Confidentialité 47 Informations ligne partagée 47 Empêcher ou autoriser les autres personnes à afficher ou vos appels sur une ligne partagée ou à s'y insérer 48 Fonctions de supervision de ligne occupée 48 Utiliser l'interception d'appels FLO pour répondre à un appel qui sonne 49 Appels sécurisés 49 Suivi des appels douteux 51 Informer l'administrateur système d'un appel douteux ou malveillant 51 Appels prioritaires 51 Cisco Extension Mobility 52 Connexion au service EM 53 Déconnexion du service EM 53 Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) vi Table des matières Modifier PIN à l'aide du service Modifier les informations d'identification 53 Modifier le PIN à l'aide de la touche Modifier le PIN 54 Appels professionnels à l'aide d'un seul numéro de téléphone 54 Mobile Connect et Accès vocal mobile 54 Mettre en attente l'appel intercepté sur un téléphone portable 55 Vous connecter à la fonction d'accès vocal mobile 56 Activation de Mobile Connect depuis un téléphone portable 56 Désactiver Mobile Connect depuis un téléphone portable 56 Activer ou désactiver l'accès de connexion mobile à toutesles destinations distantes à partir de votre téléphone de bureau 57 Combiné, casque et haut-parleur 59 Combiné 59 Casque 60 Casque large bande 60 Haut-parleur 60 Réponse automatique avec casque ou haut-parleur 61 Personnalisation du téléphone 63 Personnalisation des sonneries et de l'indicateur de messages 63 Modifier la sonnerie 63 Régler le niveau de la sonnerie du téléphone 64 Modifier le mode de fonctionnement du témoin de message vocal sur le combiné 64 Modification de l'indicateur sonore du message vocal 64 Personnalisation de l'écran du téléphone 64 Modifier la luminosité de l'écran du téléphone 65 Modifier la langue de l'écran du téléphone 65 Changer le libellé de ligne 65 Régler le contraste 66 Paramètre du rétroéclairage 66 Journaux des appels et répertoires 67 Journaux des appels 67 Affichage des journaux d'appels 68 Affichage des détails d'un enregistrement d'appel donné 68 Effacer l'ensemble des enregistrements des appels de tous les journaux des appels 68 Effacer tous les enregistrements des appels d'un journal spécifique 68 Effacer un seul enregistrement d'appel 69 Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) vii Table des matières Composition d'un numéro à partir d'un journal des appels lorsqu'aucun autre appel n'est en cours 69 Composition d'un numéro à partir d'un journal des appels avec un autre appel en cours 69 Recomposer un numéro international à partir des journaux des appels reçus et en absence. 70 Fonctions du répertoire 70 Répertoire d'entreprise 71 Composition d'un numéro à partir d'un répertoire d'entreprise lorsqu'aucun autre appel n'est en cours 71 Composition un numéro à partir d'un répertoire d'entreprise avec un appel en cours 71 Répertoire personnel 72 Accéder au répertoire personnel pour le carnet d'adresses personnel et les codes de numérotation rapide 72 Recherche d'une entrée du carnet d'adresses personnel 72 Composition d'un numéro à partir d'une entrée du carnet d'adresses personnel 73 Supprimer une entrée du carnet d'adresses personnel 73 Modifier une entrée du carnet d'adresses personnel 73 Ajout d'une entrée au carnet d'adresses personnel 74 Ajouter un nouveau code de numérotation simplifiée sans utiliser d'entrée du carnet d'adresses personnel 74 Rechercher des codes de numérotation simplifiée 74 Passage d'un appel à l'aide de la numérotation rapide 75 Supprimer un code de numérotation rapide 75 Se déconnecter du répertoire personnel 75 Messages vocaux 77 Identification du message vocal 77 Configurer le service de messagerie vocale 78 Écouter des messages vocaux ou accéder au système de messagerie vocale 78 Pages Web Options utilisateur 79 Connexion et déconnexion des pages Web Options utilisateur 79 Sélection d'un périphérique depuis la page Web Options utilisateur 80 Opérations de la page Web Options utilisateur 80 Sélectionner une option de configuration 80 Configuration des fonctions et des systèmes sur le Web 80 Répertoire personnel sur le Web 81 Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) viii Table des matières Ajout d'une nouvelle entrée au carnet d'adresses personnel 81 Recherche d'une entrée du carnet d'adresses personnel 81 Modification d'une entrée du carnet d'adresses personnel 81 Suppression d'une entrée du carnet d'adresses personnel 82 Affecter un bouton de ligne à votre carnet d'adresses personnel 82 Outil de synchronisation du carnet d'adresses 82 Paramétrage de la numérotation rapide 83 Affectation d'un code de numérotation rapide à une entrée du carnet d'adresses personnel 83 Affectation d'un code de numérotation rapide au numéro de téléphone sans entrée du carnet d'adresses personnel 83 Recherche d'une entrée de numérotation rapide 84 Modifier un numéro de téléphone correspondant à un numéro rapide 84 Supprimer un numéro rapide du carnet d'adresses personnel 84 Affectation d'une touche de fonction pour la numérotation rapide 85 Configuration de la numérotation simplifiée sur le Web 85 Configuration des boutons de numérotation simplifiée 85 Configurer des codes de numérotation abrégée 86 Configuration du service téléphonique sur le Web 86 S'abonner à un service 87 Recherche de services 87 Modification ou résiliation de services 87 Modification du nom de service 88 Ajout de service au bouton de fonction programmable 88 Paramètres des utilisateurs 88 Modification du mot de passe du navigateur 89 Changer le PIN 89 Modification de la langue des options utilisateur 89 Modification de la langue de l'écran du téléphone 89 Paramètres de ligne sur le Web 90 Configurer le renvoi d'appels par ligne 90 Modification du paramètre d'indicateur de message vocal par ligne 90 Modification du paramètre d'indicateur de message vocal audible par ligne 91 Modification du libellé de ligne pour l'écran du téléphone 91 Téléphone et liste d'accès pour Mobile Connect 91 Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) ix Table des matières Création d'une liste d'accès 92 Ajout d'une nouvelle destination distante 92 Cisco WebDialer 93 Utiliser WebDialer avec le répertoire Options utilisateur 94 Utiliser WebDialer avec un autre répertoire d'entreprise en ligne (au lieu du répertoire Options utilisateur) 94 Vous déconnecter de WebDialer 94 Configuration, affichage ou modification des préférences de WebDialer 95 Options supplémentaires 97 Dépannage 99 Problèmes 99 Pas de tonalité ou impossible de passer un appel 99 Touche manquante 100 Impossible d'utiliser la fonction Rappel 100 Message d'erreur de renvoi de tous les appels 100 Le téléphone ne répond pas 101 Message d'erreur de sécurité 101 Impossible d'accéder au menu Paramètres 101 Données de dépannage du téléphone 102 Outil de génération de rapports qualité 102 Garantie 103 Conditions générales de la garantie matérielle limitée à un an de Cisco 103 Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) x Table des matières Préface Le Guide de l'utilisateur du téléphone IP Cisco Unified 7931 pour Cisco Unified Communications Manager explique comment installer et utiliser le téléphone IP Cisco Unified 7931. Ce chapitre contient les sections ci-dessous : • Introduction, page xi • Informations complémentaires, page xii • Didacticiels d'apprentissage électronique du téléphone IP Cisco Unified 7900 Series, page xii • Consignes de sécurité et informations relatives aux performances, page xiii • Sécurité des produits Cisco, page xiv • Fonctions d'accessibilité, page xiv Introduction Ce guide propose une présentation générale des fonctions disponibles sur votre téléphone. Parcourez-le dans son intégralité pour prendre connaissance de toutesles possibilités de votre téléphone. Vous pouvez également consulter le tableau ci-après, qui permet d'accéder d'un seul clic aux sections les plus utilisées. Pour... Procédez comme suit Lorsque vous avez besoin d'aide, appuyez sur la touche ( ) > du téléphone. Apprendre à utiliser le téléphone par vous-même Reportez-vous à Consignes de sécurité et informations relatives aux performances, à la page xiii. Prendre connaissance des consignes de sécurité importantes Raccorder le téléphone Reportez-vous à Installation du téléphone, à la page 13. Reportez-vous à Fonctions de votre téléphone IP Cisco Unified, à la page 1. Utiliser le téléphone une fois qu'il est installé En savoir plussur les Boutons et touches Reportez-vous à Boutons et matériel, à la page 1. de fonctions Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) xi Pour... Procédez comme suit Passer des appels Reportez-vous à Options d'appels de base, à la page 17. Reportez-vous à Mise en attente et reprise des appels, à la page 25. Mettre des appels en attente Désactiver le micro durant les appels Reportez-vous à Coupure micro, à la page 28. Transférer les appels Reportez-vous à Transfert des appels, à la page 28. Établir des conférences Reportez-vous à Conférences, à la page 33. Configurer la numérotation simplifiée Reportez-vous à Numérotation simplifiée, à la page 40. Partager un numéro de téléphone Reportez-vous à Interception d'appels, à la page 42. Utiliser le mode haut-parleur du Reportez-vous à Combiné, casque et haut-parleur, à la page 59. téléphone Reportez-vous à Personnalisation des sonneries et de l'indicateur de messages, à la page 63. Modifier le volume de la sonnerie ou de l'appel Consulter les appels en absence Reportez-vous à Journaux des appels, à la page 67. Écouter vos messages vocaux Reportez-vous à Messages vocaux, à la page 77. Informations complémentaires Vous pouvez accéder à la documentation Cisco la plus récente à l'adresse : http://www.cisco.com/en/US/products/hw/phones/ps379/tsd_products_support_series_home.html Vous pouvez accéder au site Web de Cisco à l'adresse : http://www.cisco.com/ Les informations les plus récentes sur les licences sont disponibles à l'adresse : http://www.cisco.com/en/US/docs/voice_ip_comm/cuipph/all_models/openssl_license/7900_ssllic.html Didacticiels d'apprentissage électronique du téléphone IP Cisco Unified 7900 Series (Uniquement sur les téléphones SCCP) Les didacticiels d'apprentissage électronique du téléphone IP Cisco Unified 7900 utilisent le son et l'animation pour présenter lesfonctions d'appel de base. Depuis un ordinateur, vous pouvez accéder en ligne aux didacticiels Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) xii Préface Informations complémentaires d'apprentissage électronique de plusieurs modèles de téléphones. Pour rechercher le didacticiel (en anglais uniquement) correspondant à votre modèle de téléphone, reportez-vous à la liste des documentations à l'adresse : http://www.cisco.com/en/US/products/hw/phones/ps379/products_user_guide_list.html Même s'il n'existe pas de didacticiel d'apprentissage électronique pour votre modèle de téléphone, reportez-vous aux didacticiels du téléphone IP Cisco Unified 7900 pour découvrir les caractéristiques et fonctions communes aux téléphones IP Cisco Unified. Remarque Consignes de sécurité et informations relatives aux performances Les sections ci-dessous contiennent des informations sur l'impact des coupures de courant et des périphériques externes sur votre téléphone IP Cisco Unified. Coupure de courant Pour accéder au service d'urgence, votre téléphone doit être sous tension. En cas de coupure de courant, le service d'appel d'urgence et de réparation ne fonctionnera pastant que le courant n'est pasrétabli. Il est possible que vous deviez alorsréinitialiser ou reconfigurer l'équipement pour pouvoir utiliser le service d'appel d'urgence et de réparation. Périphériques externes Cisco recommande d'utiliser des périphériques externes (par exemple, des casques), des câbles et des connecteurs de bonne qualité, blindés contre les interférences produites par les signaux de fréquences radio et audio. En fonction de la qualité de ces périphériques et de leur proximité par rapport à d'autres appareils, comme des téléphones portables ou des radios bidirectionnelles, des parasites sonores sont toujours susceptibles de se produire. Dans ce cas, Cisco vous recommande d'appliquer une ou plusieurs des mesures ci-dessous : • Éloignez le périphérique externe de la source émettrice des signaux de fréquences radio ou audio. • Maintenez les câbles du périphérique externe éloignés de la source émettrice des signaux de fréquences radio ou audio. • Utilisez des câbles blindés pour le périphérique externe ou des câbles dotés d'un blindage supérieur et d'un meilleur connecteur. • Raccourcissez le câble du périphérique externe. • Utilisez des structures en ferrite ou d'autres dispositifs de ce type pour les câbles du périphérique externe. Cisco ne peut pas garantir les performances des périphériques, des câbles et des connecteurs externes. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) xiii Préface Consignes de sécurité et informations relatives aux performances Dans les pays de l'Union européenne, n'utilisez que des haut-parleurs, des microphones et des casques externes conformes à la Directive 89/336/CE sur la compatibilité électromagnétique (CEM). Précaution Sécurité des produits Cisco Ce produit, qui intègre des fonctions cryptographiques, est soumis aux lois des États-Unis et des autres pays qui en régissent l'importation, l'exportation, le transfert et l'utilisation. La fourniture de produits cryptographiques Cisco n'autorise pas un tiers importer, à exporter, à distribuer ou à utiliser le chiffrement. Les importateurs, exportateurs, distributeurs et utilisateurs sont responsables du respect des lois des États-Unis et des autres pays. Lorsque vous utilisez ce produit, vous acceptez de respecter les lois et les réglementations applicables. Si vous n'êtes pas en mesure de respecter les lois des États-Unis et celles des autres pays, renvoyez-nous ce produit immédiatement. Pour plus d'informations sur les réglementations américaines concernant les exportations, reportez-vous à l'adresse suivante : http://www.access.gpo.gov/bis/ear/ear_data.html. Fonctions d'accessibilité Les téléphones IP Cisco Unified de la série 7900 offrent des fonctions d'accessibilité pour les malvoyants, les malentendants et les personnes à mobilité réduite. Pour plus d'informations sur les fonctions de ces téléphones, reportez-vous à Fonctions d'accessibilité du téléphone IP Cisco Unified 7900. Pour plus d'informations sur l'accessibilité, vous pouvez également vous reporter au site Web Cisco : http://www.cisco.com/web/about/responsibility/accessibility/index.html Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) xiv Préface Sécurité des produits Cisco CHAPITRE 1 Fonctions de votre téléphone IP Cisco Unified Le téléphone IP Cisco Unified 7931G est un téléphone haut de gamme qui permet une communication vocale via le réseau de données utilisé par votre ordinateur. Ainsi, vous pouvez émettre et recevoir des appels, en mettre en attente, en transférer, établir des conférences, etc. Il est conçu pour répondre aux besoins de communication dans un environnement de trafic téléphonique modéré et d'exigences d'appelspécifiques. Doté de touches dédiées de mise en attente, de rappel et de transfert facilitant la gestion des appels, il intègre également des fonctions d'amélioration de la productivité qui permettent d'accroître vos capacités d'administration : • L'accès aux données du réseau, aux applications XML et aux services Web. • La personnalisation en ligne des fonctions et des services du téléphone à partir de vos pages Web Options utilisateur Cisco Unified CM. • Un système d'aide en ligne complet qui affiche des informations sur l'écran du téléphone. Ce chapitre contient les sections ci-dessous : • Boutons et matériel, page 1 • Définitions de ligne et d'appel, page 5 • Fonctions de l'écran du téléphone, page 7 • Navigation dans le menu d'application, page 8 • Système d'aide du téléphone, page 9 • Disponibilité des fonctions, page 9 • Protocoles de signalisation SIP et SCCP, page 10 • Économies d'énergie, page 11 Boutons et matériel Utilisez l'illustration ci-dessous pour identifier les boutons et les composants matériels du téléphone. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 1 Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 2 Fonctions de votre téléphone IP Cisco Unified Boutons et matériel Élément Description En fonction de la configuration du téléphone, les boutons programmables (ou touches de ligne) permettent d'accéder aux éléments ci-dessous : • Lignes téléphoniques et lignes intercom (boutons de ligne) • Numérossimplifiés(boutons de numérotation simplifiée, y compris avec la fonction FLO) • Services Web (par exemple, bouton du carnet d'adresses personnel) • Fonctions d'appel (par exemple, Confidentialité et Conférence) • Fonctions locales (par exemple, menu d'application, Casque et Paramètres) Les boutons s'allument pour indiquer les états : Vert, fixe : appel actif ou appel intercom bidirectionnel Vert, clignotant : appel en attente Orange fixe : fonction de confidentialité en cours d'utilisation, appel intercom unidirectionnel, NPD, connexion établie à un groupe de recherche ou activation d'une fonction locale, notamment d'un casque Orange clignotant : appel entrant ou renvoyé Rouge fixe : ligne distante en cours d'utilisation (ligne partagée, état FLO ou appel mobile en cours) Rouge clignotant : appel distant en attente Les touches de ligne sont numérotées de 24 à 1, dans l'ordre décroissant et de la gauche et vers la droite alternativement. 1 Boutons programmables 2 Étiquette papier Identifie chaque bouton par des informations sur la ligne ou la fonction. 3 Touches Chacune de ces touches active une option (affichée sur l'écran du téléphone). Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 3 Fonctions de votre téléphone IP Cisco Unified Boutons et matériel Élément Description 4 Bouton Attente Met les appels en attente. 5 Bouton Transfert Transfère un appel vers un autre numéro. 6 Bouton Bis Appelle le dernier numéro composé. Permet de composer des numéros de téléphone, de saisir des lettres et de sélectionner des options de menu. 7 Clavier Active ou désactive le microphone. Lorsque le microphone est coupé, le bouton est allumé. 8 Bouton Coupure du micro Contrôle le volume du combiné, du casque et du haut-parleur (en mode décroché), ainsi que le volume de la sonnerie (en mode raccroché). 9 Bouton Volume Active ou désactive le mode haut-parleur. Lorsque le mode haut-parleur est activé, le bouton est allumé. 10 Bouton haut-parleur 11 Combiné Fonctions identiques à celles d'un combiné traditionnel. Signale un appel entrant ou un nouveau message vocal. Clignote pour indiquer un appel entrant et reste allumé lorsqu'un message est en attente. 12 Témoin lumineux du combiné Affiche des informations telles que l'état de la ligne et des appels, les numéros de téléphone et la touche. 13 Écran du téléphone Modèle de téléphone IP Cisco Indique le numéro du modèle de votre téléphone IP Cisco Unified. Unified 14 Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 4 Fonctions de votre téléphone IP Cisco Unified Boutons et matériel Élément Description Bouton de navigation • Permet de faire défiler vers le haut ou vers le bas de façon à afficher les menus et à sélectionner leurs options • Permet de faire défiler vers la gauche pour ouvrir l'écran Détails et afficher les numéros d'annuaire, ainsi que lesfonctions affectées à chaque bouton de ligne (dans l'écran d'appel) • Permet de faire défiler vers la droite pour fermer l'écran Détails Pavé de navigation à 4 directions et bouton Sélectionner (au centre) 15 Bouton Sélectionner : sélectionnez une ligne à l'aide du bouton de navigation, puis procédez comme suit : • Si le bouton est mis en correspondance avec un numéro d'annuaire et : ◦ Si la ligne est inactive, appuyez sur pour passer un appel. ◦ Si un appel en attente est sur la ligne, appuyez sur le bouton pour reprendre l'appel. ◦ Si un appel est actif sur la ligne, le bouton Sélectionner est sans effet. • Si le bouton est mis en correspondance avec une fonction, appuyez sur pour accéder à celle-ci. Définitions de ligne et d'appel Il est facile de faire l'amalgame entre les termes lignes et appels. • Lignes : Le téléphone compte 24 boutons programmables (reportez-vous à Boutons et matériel, à la page 1). En général, l'administrateur système affecte un certain nombre de ces lignes (jusqu'à 24) à l'établissement et à la réception des appels. Chacune est associée à un numéro d'annuaire ou à un numéro intercom que vos contacts peuvent utiliser pour vous appeler. Certaines lignes peuvent partager le même numéro d'annuaire, tandis que d'autres peuvent avoir un numéro spécifique.Pour afficher voslignestéléphoniques, utilisez le bouton de navigation pour parcourir la liste d'affichage des boutons programmables (reportez-vous à Fonctions de l'écran du téléphone, à la page 7). Les boutons configurés comme deslignes affichent le numéro d'annuaire et le numéro de bouton associés. Par exemple, si le numéro d'annuaire “3105” est affecté au bouton 1, la ligne s'affiche sous la forme de "3105:01" sur l'écran du téléphone. Chaque ligne est également associée à une icône afin que vous puissiez identifier la fonction (reportez-vous à Icônes de ligne et d'appel, à la page 6). • Appels : chaque ligne peut prendre en charge un seul appel. Même si plusieurs lignes partagent un numéro d'annuaire, chacune peut prendre en charge un appel. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 5 Fonctions de votre téléphone IP Cisco Unified Définitions de ligne et d'appel Icônes de ligne et d'appel Votre téléphone affiche des icônes destinées à déterminer l'état de la ligne et celui de l'appel, ainsi que l'accessibilité des fonctions sur chaque ligne. État de la ligne ou de Description l'appel Icône État de l'appel Combiné raccroché Aucune activité d'appel sur cette ligne. Combiné décroché Vous êtes en train de composer un numéro ou un appel sortant sonne. Appel connecté Vous êtes connecté avec votre interlocuteur. Transfert des appels Le renvoi d'appel est activé sur cette ligne. activé Un appel sonne sur l'une de vos lignes ou une ligne surveillée par FLO sonne ( Interception d'appels FLO). Reportez-vous à Fonctions de supervision de ligne occupée, à la page 48. Appel qui sonne Vous avez mis un appel en attente. Reportez-vous à Mise en attente et reprise des appels, à la page 25. Appel en attente Un autre téléphone qui partage votre ligne a mis un appel en attente. Reportez-vous à Mise en attente et reprise des appels, à la page 25. Appel distant en attente Un autre téléphone qui partage votre ligne a un appel connecté. Reportez-vous à Lignes partagées, à la page 46. Utilisé à distance Appel authentifié Reportez-vous à Appels sécurisés, à la page 49. Appel chiffré Reportez-vous à Appels sécurisés, à la page 49. La ligne intercom n'est pas utilisée. Reportez-vous à Appels intercom, à la page 38. Ligne intercom inactive La ligne intercom envoie ou reçoit des données audio unidirectionnelles. Reportez-vous à Appels intercom, à la page 38. Intercom unidirectionnel Appuyez sur le bouton de la ligne intercom pour activer le son bidirectionnel avec l'appelant intercom. Reportez-vous à Appels intercom, à la page 38. Intercom bidirectionnel Accès aux fonctions Le menu d'application est affecté à cette touche de ligne. Reportez-vous à Navigation dans le menu d'application, à la page 8. Menu d'application Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 6 Fonctions de votre téléphone IP Cisco Unified Icônes de ligne et d'appel État de la ligne ou de Description l'appel Icône Le menu Paramètres est affecté à cette touche de ligne. Reportez-vous à Personnalisation du téléphone, à la page 63. Menu Paramètres Le menu Répertoires est affecté à cette touche de ligne. Reportez-vous à Journaux des appels et répertoires, à la page 67. Menu Répertoires Le menu Messages est affecté à cette touche de ligne. Reportez-vous à Messages vocaux, à la page 77. Menu Messages Le menu Services est affecté à cette touche de ligne. Reportez-vous à Configuration du service téléphonique sur le Web, à la page 86. Menu Services Cette option permet d'utiliser un casque avec votre téléphone. Reportez-vous à Combiné, casque et haut-parleur, à la page 59. Bouton Casque La fonction Conférence est affectée à cette touche de ligne. Reportez-vous à Conférences, à la page 33. Bouton Conférence Une fonction d'appel est affectée à cette touche de ligne. Reportez-vous au texte de description en regard de l'icône pour vérifier la fonction. Autre fonction d'appel La fonction d'accès mobile est affectée à cette touche de ligne. Reportez-vous à Appels professionnels à l'aide d'un seul numéro de téléphone, à la page 54. Mobilité Une fonction d'appel affectée à cette touche de ligne est activée. Reportez-vous au texte de description en regard de l'icône pour vérifier la fonction. Fonction activée Un bouton de numérotation simplifiée est affecté à cette touche de ligne. Reportez-vous à Interception d'appels, à la page 42, à Configuration du service téléphonique sur le Web, à la page 86 et à Fonctions de supervision de ligne occupée, à la page 48. Numérotation simplifiée ou fonction FLO associée Astuce L'administrateursystème peut vousremettre une étiquette papier préimprimée destinée à rappeler l'affectation des touches de ligne. Si ce n'est pas le cas, enlevez l'étiquette vierge et apposez-y vos propres libellés. Fonctions de l'écran du téléphone La figure ci-dessous représente l'écran de votre téléphone lorsqu'il est inactif. Il s'agit de l'écran “Aperçu.” Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 7 Fonctions de votre téléphone IP Cisco Unified Fonctions de l'écran du téléphone 1 Date et heure Affiche la date et l'heure actuelles. Affiche le numéro de téléphone (numéro d'annuaire) de votre ligne téléphonique principale. 2 Ligne téléphonique principale Les boutons programmables peuvent servir pour les lignes téléphoniques, les lignes intercom, la numérotation simplifiée, les services téléphoniques, ainsi que les fonctions d'appel ou locales. Indicateurs des boutons programmables 3 Les icônes et les descriptions précisent la configuration de ces boutons. Pour connaître la signification des icônes, reportez-vous à Icônes de ligne et d'appel, à la page 6. 4 Étiquettes de touche Chacune décrit la fonction d'une touche. Affiche les icônes du mode audio, les informations d'état et les invites. 5 Ligne d'état La figure ci-dessousreprésente l'écran de votre téléphone principal en cours d'appel. Ils'agit de l'écran “Détails.” 1 Aperçu Affiche le numéro et l'icône d'état de chaque ligne. Affiche les détails concernant les fonctions locales et d'appel affectées à la touche de ligne sélectionnée. Dans l'exemple ci-dessus, l'écran affiche des informations 2 Écran Détails sur l'appel connecté, comme le numéro d'annuaire, la durée de connexion et l'état de l'appel. Utilisez le bouton de navigation pour faire défiler les détails et consulter ceux relatifs à d'autres lignes. Les fonctions locales et d'appel affichent les noms d'étiquette et les icônes dans l'écran Détails. Reportez-vous à Icônes de ligne et d'appel, à la page 6. Navigation dans le menu d'application Le menu d'application permet d'accéder aux fonctions locales du téléphone. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 8 Fonctions de votre téléphone IP Cisco Unified Navigation dans le menu d'application Pour... Procédez comme suit... Appuyez sur > pour afficher la liste des applications: Messages, Répertoire, Paramètres, Services et Aide. (En général, le menu d'application est affecté au bouton 24 , en haut de la colonne de gauche.) Accéder au menu d'application Faire défiler une liste ou Utilisez le bouton de navigation. un menu Utilisez le bouton de navigation pour mettre en surbrillance l'option de menu souhaitée, puis appuyez sur ou Sélect. Vous pouvez également composer sur le clavier le numéro de l'option de menu. Sélectionner une option de menu Appuyez sur Quitter. (Si vous appuyez sur Quitter alors que vous êtes dans le niveau supérieur d'un menu, ce dernier se ferme.) Remonter d'un niveau dans un menu Fermer un menu (et Appuyez une ou plusieurs fois sur Quitter jusqu'à ce que le menu se ferme. revenir au menu d'application) Quitter Appuyez sur ou sur Quitter. le menu d'application Astuce Vous pouvez également affecter des boutons à certaines options du menu d'application (Paramètres, Répertoires, Services, Messages). Utilisez le bouton de navigation pour parcourir l'aperçu et reportez-vous à Icônes de ligne et d'appel, à la page 6 pour identifier ces lignes. Système d'aide du téléphone Votre téléphone comprend un système complet d'aide en ligne. Pour afficher l'aide du téléphone, appuyez sur, puis sélectionnez > > Aide. En général, le menu d'application est affecté au bouton 24, situé en haut de la colonne de gauche. Disponibilité des fonctions En fonction de la configuration de votre système téléphonique, certaines fonctions décrites dans ce guide sont susceptibles de ne pas être disponibles dans votre cas ou de fonctionner différemment.Pour plus d'informations sur le fonctionnement ou sur la disponibilité des fonctions, contactez un membre de l'équipe d'assistance ou votre administrateur système. Vous pouvez accéder aux fonctions en utilisant les touches ou en appuyant sur une touche de ligne. Vous pouvez configurer certaines de ces fonctions, mais votre administrateur contrôle la plupart d'entre elles. Voici quelques informations concernant l'accès aux fonctions au moyen des touches et des boutons de ligne. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 9 Fonctions de votre téléphone IP Cisco Unified Système d'aide du téléphone Fonction Touche Étiquette et icône du bouton de ligne Rappel Rappel Rappel Renvoi d'appels RenvTt Renvoi de tous les appels Parcage d'appels Parquer Parquer Interception d'appels Intrcpt Intrcpt Conférence Conf. Conférence Liste de conférence ListConf Liste de conférence Ne pas déranger NPD Ne pas déranger Comment mettre fin à un appel FinApp Comment mettre fin à un appel Interception d'appels de groupe GrpIntr Interception d'appels de groupe Attente Attente bouton Groupe de recherche Groupmt Groupe de recherche Identification d'un appel malveillant IDAM ID des appels malveillants Conférences Meet-Me Meet-Me Meet-Me Mobilité Mobilité Mobilité NvAppel NvAppel NvAppel Autre interception AGrpIntr Autre interception bouton Bis Bis Supprimer le dernier participant à une conférence SupDerA Supprimer dernier participant bouton Transfert Transfert Prise en charge vidéo ModeVid. Vidéo Protocoles de signalisation SIP et SCCP Votre administrateur système configure votre téléphone avec un des deux protocoles de signalisation : SIP (Session Initiation Protocol) ou SCCP (Skinny Call Control Protocol). Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 10 Fonctions de votre téléphone IP Cisco Unified Protocoles de signalisation SIP et SCCP Les fonctions disponibles sur le téléphone dépendent du protocole choisi. Le présent manuel définit les fonctions spécifiques à chaque protocole. Pour savoir quel protocole est utilisé par votre téléphone, contactez votre administrateur système. Économies d'énergie Votre téléphone prend en charge le programme EnergyWise de Cisco. Afin d'économiser de l'énergie, votre administrateursystème a défini des périodes de veille (arrêt) et de réveil (mise en marche)sur votre téléphone. Si votre administrateur système a activé l'alerte sonore, une sonnerie retentit dix minutes avant l'heure prévue de mise en veille. Cette alerte respecte le calendrier suivant : • 10 minutes avant l'arrêt, l'alerte retentit quatre fois • 7 minutes avant l'arrêt, l'alerte retentit quatre fois • 4 minutes avant l'arrêt, l'alerte retentit quatre fois • 30 secondes avant l'arrêt, l'alerte retentit 15 fois ou sonne jusqu'à ce que le téléphone s'arrête Si votre téléphone est inactif au moment de l'arrêt, un message vous rappelle qu'il est sur le point de s'arrêter. Pour qu'il reste allumé, appuyez sur n'importe quelle touche de votre téléphone. Si vous n'appuyez sur aucune touche, votre téléphone s'arrête. Si votre téléphone est actif (un appel est en cours, par exemple), votre téléphone attend d'être inactif pendant un certain temps avant de vous informer qu'il est sur le point de s'arrêter. Avant l'arrêt, un message vous rappelle que le téléphone est sur le point de s'arrêter. Votre téléphone se met en marche à l'heure définie. Pour réveiller le téléphone avant l'heure prévue, contactez votre administrateur. Les périodes de veille et de réveil ont également été définies en fonction de vos jours de travail habituels. Si ces conditions évoluent (par exemple,si vos horaires ou vosjours de travail ne sont plusles mêmes), demandez à votre administrateur système de reconfigurer votre téléphone. Pour plus d'informations sur le programme EnergyWise et votre téléphone, contactez votre administrateur système. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 11 Fonctions de votre téléphone IP Cisco Unified Économies d'énergie Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 12 Fonctions de votre téléphone IP Cisco Unified Économies d'énergie CHAPITRE 2 Installation du téléphone Ce chapitre présente les sections ci-dessous sur la façon d'installer manuellement votre téléphone. • Connexions du téléphone IP Cisco Unified 7931G, page 13 • Réglage du support du combiné, page 15 • Enregistrement TAPS, page 15 • Prise en charge de casques, page 16 Connexions du téléphone IP Cisco Unified 7931G La figure et le tableau ci-dessous indiquent comment connecter votre téléphone. 1 Port de l'adaptateur CC (CC48V) Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 13 2 Port réseau (10/100 SW) 3 Port d'accès (10/100 PC) 4 Port casque 5 Port du combiné Verrouillage de câble du téléphone Vous pouvez sécuriser le téléphone IP Cisco Unified sur un bureau à l'aide d'un système de verrouillage de câble d'ordinateur portable. Le verrou se connecte à la fente de sécurité à l'arrière du téléphone et le câble peut être attaché au bureau de manière sécurisée. La fente de sécurité est adaptée à un verrou de 20 mm. Les câbles de verrouillage d'ordinateurs portables compatibles comprennent le verrouillage de câble d'ordinateur portable Kensington et les câbles de verrouillage d'ordinateur portable d'autres fabricants qui peuvent s'adapter dans la fente de sécurité à l'arrière du téléphone. Reportez-vous à la figure ci-dessous. Figure 1: Connecter un système de verrouillage de câble au téléphone IP Cisco Unified Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 14 Installation du téléphone Verrouillage de câble du téléphone Réglage du support du combiné Si votre téléphone est fixé au mur, vous devrez peut-être régler le support pour éviter que le combiné ne s'en détache. Procédure Étape 1 Décrochez le combiné et retirez la plaquette en plastique du support du combiné. Étape 2 Faites pivoter la plaquette de 180 degrés. Étape 3 Tenez la plaquette entre deux doigts, les encoches tournées dans votre direction. Étape 4 Alignez la plaquette avec l'emplacement dans le support, puis appuyez dessus de façon égale pour l'y insérer. Une extension ressort en haut de la plaquette qui a pivoté. Étape 5 Replacez le combiné sur son support. Enregistrement TAPS TAPS peut être utilisé pour un nouveau téléphone ou pour en remplacer un existant. Pour enregistrer un téléphone à l'aide de l'outil TAPS, décrochez le combiné, saisissez le numéro de poste TAPS fourni par votre administrateur système, puis suivez les instructions vocales. Il est possible que vous deviez saisir la totalité de votre numéro de poste, y compris l'indicatif régional. Lorsque votre téléphone affiche un message de confirmation, raccrochez. Le téléphone redémarre. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 15 Installation du téléphone Réglage du support du combiné Prise en charge de casques Bien que CiscoSystemsréalise certains essaisinternessur des casques de fournisseurstierssusceptibles d'être utilisés avec les téléphones IP Cisco Unified, Cisco ne certifie ni ne promeut de produits de fournisseurs de casques ou de combinés. Cisco recommande d'utiliser des casques de bonne qualité, blindés contre les interférences produites par les signaux de fréquences radio (RF) ou audio (AF). En fonction de la qualité des casques et de leur proximité par rapport à d'autres périphériques tels que des téléphones portables et des radios bidirectionnelles, des parasites sonores ou des échos sont toujours susceptibles de se produire. Un ronflement ou un bourdonnement peut être entendu soit par l'interlocuteur uniquement, soit par l'interlocuteur et par l'utilisateur du téléphone IP Cisco Unified. Lesronflements et les bourdonnements peuvent être provoqués par diversessources extérieures: lampes électriques, moteurs électriques ou grands écrans d'ordinateur, par exemple. Dans certains cas, il est possible de réduire ou d'éliminer le ronflement à l'aide d'un groupe amplificateur de, puissance local ou d'un injecteur de, puissance. Remarque En raison de ces contraintes environnementales et matérielles liées aux différents sites de déploiement des téléphonesIP Cisco Unified, il n'existe pas de solution de casque unique optimale pour tousles environnements. Cisco recommande aux clients de tester les casques dans l'environnement prévu afin de déterminer leurs performances avant de prendre une décision d'achat et de les déployer à grande échelle. Rubriques connexes Périphériques externes, à la page xiii Qualité audio Au delà des performances physiques, mécaniques et techniques, la qualité du son d'un casque doit sembler bonne pour l'utilisateur comme pourson interlocuteur. La qualité sonore estsubjective et Cisco ne peut garantir les performances d'aucun casque. Un certain nombre de casques de grandsfabricants ont toutefois été signalés comme fonctionnant bien avec les téléphones IP Cisco Unified. Pour plus d'informations, reportez-vous à la documentation du casque. Informations sur le casque sans fil Vousrechercherez plus d'informationssur les casquessansfil fonctionnant avec la commande de commutation à distance pour casque sans fil à l'adresse suivante (en anglais) : http://www.cisco.com/pcgi-bin/ctdp/Search.pl 1 Dans la zone de liste Enter Solution, choisissez IP Communications. La zone de liste Select a Solution Category s'affiche. 2 Choisissez l'option IP Phone Headsets pour afficher une liste des partenaires du programme de développement technologique. Si vous voulez rechercher un partenaire du Programme de développement de technologies en particulier, saisissez le nom de ce partenaire dans le champ Saisir le nom d'une société. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 16 Installation du téléphone Prise en charge de casques CHAPITRE 3 Fonctions d'appel Lestâches de gestion de base des appelss'appuientsur un ensemble de fonctions et de services. La disponibilité des fonctions peut varier. Pour plus d'informations, contactez votre administrateur système. Ce chapitre contient les sections ci-dessous : • Options d'appels de base, page 17 • Options des appels supplémentaires, page 19 • Réponse à un appel, page 23 • Déconnexion de l'appel, page 24 • Mise en attente et reprise des appels, page 25 • Plusieurs appels, page 26 • Mouvement des appels en cours, page 26 • Coupure micro, page 28 • Transfert des appels, page 28 • Transfert de l'appel vers le système de messagerie vocale, page 29 • Renvoi d'appels, page 30 • Ne pas déranger, page 32 • Conférences, page 33 • Appels intercom, page 38 • Gestion avancée des appels, page 39 Options d'appels de base Les procédures ci-dessous décrivent des méthodes simples pour passer un appel depuis votre téléphone IP Cisco Unified. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 17 Astuces • Vous pouvez composer un numéro avec le combiné raccroché et sans tonalité (prénumérotation). Pour utiliser la prénumérotation, saisissez un numéro, soulevez le combiner pour décroche, puis appuyez sur Composer, sur ( ) ou sur . • Lors de la prénumérotation, le téléphone tente d'anticiper le numéro que vous êtes en train de composer. Pour ce faire, il utilise le journal des appels composés afin d'afficher les numéros correspondants (le cas échéant). Cette opération s'appelle la numérotation automatique. Pour appeler un numéro affiché par le biais de cette fonction, accédez à celui-ci, puis décrochez le combiné ou appuyez sur le bouton Sélect. • Si vous faites une erreur lorsque vous composez le numéro, appuyez sur << pour effacer les chiffres. • Si les interlocuteurs d'un appel entendent un bip, l'appel est peut-être surveillé ou enregistré. Pour plus d'informations, contactez votre administrateur système. • Pour démarrer ou pour arrêter un enregistrement, appuyez sur Enregistrer sur votre téléphone. • Votre téléphone peut être configuré pour la consignation des appels internationaux, qui est indiquée par un symbole “+” sur les journaux des appels, le rappel ou les entrées du répertoire des appels. Pour plus d'informations, contactez votre administrateur système. Rubriques connexes Combiné, casque et haut-parleur, à la page 59 Journaux des appels, à la page 67 Passage d'un appel Procédure Décrochez le combiné, puis composez le numéro. Passage d'un appel à l'aide du haut-parleur Procédure Étape 1 Appuyez sur Étape 2 Saisissez un numéro. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 18 Fonctions d'appel Passage d'un appel Passage d'un appel à l'aide du casque Procédure Appuyez sur ( ), puis saisissez un numéro. (La touche 23 est généralement affectée au casque.) Rappel d'un numéro Procédure Appuyez sur pour composer le numéro. Composition d'un numéro à partir d'un journal des appels Procédure Étape 1 Appuyez sur , puis sélectionnez Répertoires. Étape 2 Sélectionnez l'une des options ci-dessous : • Appels en absence • Appels reçus • Appels composés Étape 3 Faites défiler jusqu'au numéro souhaité, puis appuyez sur Composer. Options des appels supplémentaires Vous pouvez passer des appels à l'aide des fonctions et services spéciaux éventuellement disponibles sur votre téléphone. Pour plus d'informations sur ces options supplémentaires, contactez votre administrateur système. Astuces • Pour passer un appel à l'aide de votre profil Extension Mobility, connectez-vous au service Extension Mobility sur un téléphone. • Pour vérifier si une ligne associée à un numéro simplifié est occupée avant de l'appeler, recherchez les indicateurs de fonction de ligne occupée. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 19 Fonctions d'appel Passage d'un appel à l'aide du casque Rubriques connexes Cisco Extension Mobility, à la page 52 Fonctions de supervision de ligne occupée, à la page 48 Mise en attente et reprise des appels, à la page 25 Numérotation simplifiée, à la page 40 Journaux des appels, à la page 67 Appels prioritaires, à la page 51 Répertoire personnel, à la page 72 Appels professionnels à l'aide d'un seul numéro de téléphone, à la page 54 Répertoire personnel sur le Web, à la page 81 Paramétrage de la numérotation rapide, à la page 83 Passage d'un appel lorsqu'un autre est actif (sur une ligne différente) Procédure Étape 1 Appuyez sur pour ouvrir une nouvelle ligne. Le premier appel est automatiquement mis en attente. Étape 2 Saisissez un numéro. Passage d'un appel à l'aide de la numérotation simplifiée Procédure Effectuez l'une des opérations ci-dessous : a) Appuyez sur ( ). b) Utilisez la fonction de numérotation abrégée. c) Utilisez la fonction de numérotation rapide. Composition d'un numéro depuis le répertoire d'entreprise sur le téléphone Procédure Étape 1 Appuyez sur ( ) > Répertoires > Répertoire d'entreprise Étape 2 (le nom peut varier). Étape 3 Saisissez un nom, puis appuyez sur Recher. Étape 4 Mettez une entrée de la liste en surbrillance et décrochez. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 20 Fonctions d'appel Passage d'un appel lorsqu'un autre est actif (sur une ligne différente) Avertissement lorsque le poste occupé ou qui sonne est disponible (rappel) Remarque La fonction Rappel n'est pas disponible lorsqu'un appel est chaperonné. Procédure Étape 1 Appuyez sur Rappel lorsque vous entendez la tonalité d'occupation ou la sonnerie. Étape 2 Raccrochez. Le téléphone vous avertit lorsque la ligne se libère. Étape 3 Passez de nouveau l'appel. Passage d'un appel prioritaire (qui a la préséance) Procédure Étape 1 Saisissez le numéro d'accès MLPP. Étape 2 Saisissez un numéro de téléphone. Composition d'un numéro à partir d'une entrée du carnet d'adresses personnel Procédure Étape 1 Appuyez sur ( ) > Répertoires > Répertoire personnel pour vous connecter. Étape 2 Sélectionnez Carnet d'adresses personnel, puis recherchez une liste. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 21 Fonctions d'appel Avertissement lorsque le poste occupé ou qui sonne est disponible (rappel) Passage d'un appel à l'aide d'un code de facturation ou de suivi Procédure Étape 1 Composez un numéro. Étape 2 Lorsque vous entendez la tonalité, saisissez un code d'affaire client (CMC) ou un code d'autorisation forcée (FAC). Utiliser la fonction d'accès vocal mobile pour passer un appel depuis un téléphone portable Procédure Étape 1 Pour connaître votre numéro d'accès vocal mobile et votre PIN, contactez votre administrateur système. Étape 2 Composez le numéro d'accès vocal mobile qui vous a été attribué. Étape 3 Saisissez le numéro de votre téléphone portable, si vous y êtes invité, ainsi que votre PIN. Étape 4 Appuyez sur 1 pour passer un appel vers un téléphone IP d'entreprise. Étape 5 Composez le numéro d'un téléphone de bureau autre que le vôtre. Passage d'un appel à l'aide de la numérotation simplifiée Pour que vous puissiez utiliser cette option, votre administrateur système doit la configurer et affecter une URL de service au bouton de ligne. Pour plus d'informations, contactez votre administrateur système. Procédure Étape 1 Appuyez sur le bouton de ligne Numérotation simplifiée. Étape 2 Faites défiler la liste ou saisissez le code de numérotation simplifiée pour rechercher et sélectionner une entrée. Le système compose le numéro spécifié. Passage d'un appel à l'aide du carnet d'adresses personnel Pour que vous puissiez utiliser cette option, votre administrateur système doit la configurer et affecter une URL de service au bouton de ligne. Pour plus d'informations, contactez votre administrateur système. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 22 Fonctions d'appel Passage d'un appel à l'aide d'un code de facturation ou de suivi Procédure Étape 1 Appuyez sur le bouton de ligne de votre carnet d'adresses personnel. Étape 2 Accédez au contact, puis sélectionnez le numéro. Le système compose le numéro spécifié. Réponse à un appel Pour répondre à un appel, décrochez le combiné ou utilisez les autres options éventuellement disponibles sur le téléphone. Pour plus d'informations, reportez-vous à... Pour... Procédez comme suit... Combiné, casque et haut-parleur, à la page 59 Appuyez sur la touche ( ) si elle éteinte. Ou,si la touche ( ) est allumée, appuyez sur Répondre ou sur la touche (clignotante). La ligne qui sonne est automatiquementsélectionnée. Contactez votre administrateur système concernant les options permettant de toujours sélectionner la ligne principale. Remarque Si vous utilisez un casque sans fil, reportez-vous à la documentation qui l'accompagne. Répondre avec un casque Combiné, casque et haut-parleur, à la page 59 Appuyez sur , sur Répondre ou sur le bouton (clignotant). La ligne qui sonne est automatiquementsélectionnée. Contactez votre administrateur système concernant les options permettant de toujours sélectionner la ligne principale. Remarque Répondre avec le haut-parleur Mise en attente et reprise des appels, à la page 25 Appuyez sur Répondre ou, si l'appel sonne sur une autre ligne, sur (clignotant). Répondre à un nouvel appel à partir d'un appel déjà connecté Mise en attente et reprise des appels, à la page 25 Répondre à l'aide de la Appuyez sur Répondre. fonction d'appel en attente Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 23 Fonctions d'appel Réponse à un appel Pour plus d'informations, reportez-vous à... Pour... Procédez comme suit... Transfert de l'appel vers le système de messagerie vocale, à la page 29 Transférer un appel vers un Appuyez sur Rvoi Im. système de messagerie vocale Réponse automatique avec casque ou haut-parleur, à la page 61 Se connecter Utilisez la fonction de réponse automatique. automatiquement à des appels Utilisez le Parcage d'appels, le Parcage Parcage d'appels, à la page 44 d'appels dirigé ou le Parcage d'appels dirigé assisté. Récupérer un appel parqué sur un autre téléphone Interception d'appels, à la page 42 Utiliser votre téléphone pour Utilisez la fonction d'interception d'appels. répondre à un appel qui sonne sur un autre téléphone Appels prioritaires, à la page 51 Raccrochez pour mettre fin à l'appel en cours, puis appuyez sur Répondre. Réponse à un appel prioritaire Appels professionnels à l'aide d'un seul numéro de téléphone, à la page 54 Activez Mobile Connect et répondez sur votre téléphone. Si vous avez configuré jusqu'à quatre téléphones IP ou un softphone en tant que lignes partagées, les téléphones supplémentaires s'arrêtent de clignoter lorsque vous activez Mobile Connect et prenez l'appel sur votre téléphone portable. Réponse à un appel depuis votre téléphone portable ou depuis une autre destination distante Astuces • Si les interlocuteurs d'un appel entendent un bip, l'appel est peut-être surveillé ou enregistré. Pour plus d'informations, contactez votre administrateur système. • Si voustravaillez dans un centre d'appel ou dans un environnement de ce type, vous pouvez créer, mettre à jour et supprimer votre propre message d'accueil pré-enregistré qui se lance automatiquement lorsqu'Agent Greeting est configuré sur votre téléphone. Pour plus d'informations, contactez votre administrateur système. • Un utilisateur Chaperon des appels ne peut pas répondre à un appel entrant lorsque les appels sont chaperonnés. Déconnexion de l'appel Pour mettre fin à un appel, raccrochez. Le tableau ci-dessous vous fournit de plus amples informations. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 24 Fonctions d'appel Déconnexion de l'appel Pour... Procédez comme suit... Raccrochez le combiné. Vous pouvez également appuyer sur FinApp. Raccrocher lorsque vous utilisez le combiné Appuyez sur ( ). Pour maintenir le mode casque actif, vous pouvez également appuyer sur FinApp. Raccrocher lorsque vous utilisez un casque Raccrocher Appuyez sur ou sur FinApp. lorsque vous utilisez le haut-parleur Mise en attente et reprise des appels Vous pouvez mettre des appels en attente et les reprendre. Lorsque vous mettez un appel en attente, l'icône d'attente apparaît à droite dansla zone desinformations d'appel et le bouton de ligne correspondant clignote en vert . Dans le cas d'une ligne partagée, le bouton de ligne clignote en vert et le téléphone affiche l'icône de mise en attente locale lorsque vous mettez un appel en attente. Lorsqu'un autre téléphone met un appel en attente, le bouton de ligne clignote en rouge et le téléphone affiche l'icône de mise en attente à distance . Si un autre utilisateur met en attente une ligne partagée, le bouton associé à celle-ci affiche (clignotant). Vous (et toute personne de cette ligne partagée) pouvez reprendre l'appel. Si la fonction Récupérer l'appel en attente est activée sur votre téléphone, un appel que vous avez mis en attente sonne à nouveau au bout d'un certain temps. L'appel “à reprendre” reste en attente jusqu'à ce que vous le repreniez ou que cette fonction expire. Votre téléphone peut vous indiquer la présence d'un appel à reprendre de diverses manières : • En vous avertissant à intervallesréguliers par une sonnerie (ou par un clignotement ou un bip, en fonction de la configuration de votre ligne téléphonique). • En affichant brièvement le message Récupérer l'appel en attente dans la barre d'état, en bas de l'écran du téléphone. • En affichant l'icône animée de récupération d'appel en attente en regard de l'ID de l'appelant mis en attente. • En affichant un bouton de ligne (voyant clignotant, en fonction de l'état de la ligne). Astuces • En règle générale, de la musique est diffusée (lorsque Musique d'attente est configurée) ou un bip retentit au démarrage de la fonction d'attente. • Si vous êtes informé au même moment de l'arrivée d'un appel entrant et d'un appel à reprendre, l'écran de votre téléphone affiche en priorité l'appel entrant (par défaut). Votre administrateur système peut modifier ce paramètre de priorité. • Si vous utilisez une ligne partagée, la fonction Récupérer l'appel en attente permet d'appliquer la sonnerie uniquement au téléphone qui a mis l'appel en attente et non aux autres téléphones qui partagent la ligne. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 25 Fonctions d'appel Mise en attente et reprise des appels • Votre administrateur système détermine le délai entre les alertes de la fonction Récupérer l'appel en attente. • La fonction Attente n'est pas disponible lorsque les appels sont chaperonnés. Mettre un appel en attente Procédure Étape 1 Vérifiez que l'appel concerné est en surbrillance. Étape 2 Appuyez sur . Reprendre un appel mis en attente sur la ligne active Procédure Étape 1 Pour l'appel en attente clignotant, appuyez sur l'un des boutons ci-dessous : , , ou . Étape 2 Si plusieurs appelssont en attente, mettez l'appelsouhaité en surbrillance, puis appuyez Reprendre ou appuyez sur . Plusieurs appels Vous pouvez passer d'un appel à l'autre sur des lignes différentes. Pour... Procédez comme suit... Appuyez sur le bouton (clignotant) de la ligne sur laquelle vous basculez. Passer à un appel en attente sur une autre ligne Appuyez sur (clignote). Les appels en cours sont mis en attente et l'appel sélectionné est repris. Passer d'un appel connecté à un appel qui sonne Mouvement des appels en cours Les procédures ci-dessous donnent des détailssur le transfert d'un appel en cours de votre téléphone de bureau vers votre portable ou vers une autre destination distante. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 26 Fonctions d'appel Mettre un appel en attente Transférer un appel en cours d'un téléphone portable vers un téléphone de bureau qui partage la même ligne (transfert de session) Procédure Étape 1 Sur votre téléphone portable, saisissez le code d'accès de la fonction de transfert de session (par exemple, *74). Contactez votre administrateur système pour obtenir la liste des codes d'accès. Étape 2 Raccrochez le téléphone portable pour le déconnecter sans interrompre l'appel. Étape 3 Appuyez sur la touche Réponse à un appel de votre téléphone de bureau dans un délai de 10 secondes et commencez à parler sur ce téléphone. Votre administrateur système détermine le délai maximum en secondes dont vous disposez pour prendre l'appel sur votre téléphone de bureau. Les autres périphériques Cisco Unified qui partagent la même ligne affichent le message Utilisé à distance. Transférer un appel en cours d'un téléphone portable vers un téléphone de bureau Procédure Étape 1 Raccrochez le téléphone portable pour le déconnecter sans interrompre l'appel. Étape 2 Appuyez sur la touche Réponse à un appel de votre téléphone de bureau dans un délai de 4 secondes et commencez à parler sur ce téléphone. Transférer un appel en cours d'un téléphone portable vers des périphériques Cisco Unified qui partagent la même ligne (transfert de session) Procédure Étape 1 Raccrochez le téléphone portable pour le déconnecter sans interrompre l'appel. Étape 2 Appuyez sur Répondre sur l'un de vos périphériques Cisco Unified dans un délai de 10 secondes et commencez à parler au téléphone. Les autres périphériques Cisco Unified qui partagent la même ligne affichent le message Utilisé à distance. Le délai (en secondes) pour reprendre l'appel dépend de la configuration définie par votre administrateur système. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 27 Fonctions d'appel Transférer un appel en cours d'un téléphone portable vers un téléphone de bureau qui partage la même ligne (transfert de session) Coupure micro Lorsque la coupure micro est activée, vous pouvez entendre vos interlocuteurs, mais ces derniers ne peuvent pas vous entendre. Vous pouvez utiliser cette fonction avec le combiné, le haut-parleur ou le casque. Désactiver ou rétablir le son de l'appel Procédure Étape 1 Pour désactiver le son d'un appel, appuyez sur . Étape 2 Pour rétablir le son d'un appel, appuyez sur . Transfert des appels Le transfert permet de renvoyer un appel connecté. La cible est le numéro vers lequel vous voulez transférer l'appel. Lorsque vous transférez un appel, votre téléphone utilise une nouvelle ligne pour initier le transfert. Astuces • Si le transfert en mode combiné raccroché est activé sur votre téléphone, raccrochez pour mettre fin à l'appel ou appuyez sur , puis raccrocher. • Si le transfert en mode combiné raccroché n'est pas activé sur votre téléphone et si vous raccrochez sans appuyer une nouvelle fois sur , l'appel est mis en attente. • Vous ne pouvez pas utiliser pour renvoyer un appel en attente. Appuyez sur Reprendre pour reprendre l'appel avant de le transférer. • La fonction Transfert n'est pas disponible lorsque les appels sont chaperonnés. • Pour renvoyer un appel sur un système de messagerie vocale, appuyez sur Rvoi Im. Pour plus d'informations, reportez-vous à Transfert de l'appel vers le système de messagerie vocale, à la page 29. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 28 Fonctions d'appel Coupure micro Transfert d'un appel sans parler au destinataire du transfert Procédure Étape 1 À partir d'un appel actif, appuyez sur . Étape 2 Saisissez le numéro cible. Étape 3 Appuyez de nouveau sur le bouton pour terminer l'opération ou sur FinApp pour l'annuler. Étape 4 Si la fonction de transfert en mode combiné raccroché est activée sur votre téléphone, raccrochez pour terminer le transfert. Comment informer le destinataire du transfert avant de lui transférer un appel (transfert par consultation) Procédure Étape 1 À partir d'un appel actif, appuyez sur . Étape 2 Saisissez le numéro cible. Étape 3 Patientez quelques instants pour laisser le temps au destinataire du transfert de répondre. Étape 4 Appuyez de nouveau sur le bouton pour terminer l'opération ou sur FinApp pour l'annuler. Étape 5 Si la fonction de transfert en mode combiné raccroché est activée sur votre téléphone, raccrochez pour terminer le transfert. Transfert de l'appel vers le système de messagerie vocale Vous pouvez utiliser Rvoi Im pour renvoyer un appel en cours, qui sonne ou en attente vers votre système de messagerie vocale. En fonction de la nature de l'appel et de la configuration du téléphone, vous pouvez également utiliser Rvoi Im pour faire basculer l'appel sur la messagerie vocale d'une tierce personne. • Si, initialement, l'appel a été transféré sur un autre téléphone, Rvoi Im permet de renvoyer l'appel vers votre propre système de messagerie vocale ou vers celui de la personne initialement appelée. Votre administrateur système doit au préalable avoir activé cette option pour vous. • Si l'appel vous était directement destiné (sans avoir été transféré ou redirigé vers votre poste) ou si votre téléphone ne prend pas en charge l'option décrite ci-dessus, l'utilisation de Rvoi Im redirige l'appel vers votre système de messagerie vocale. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 29 Fonctions d'appel Transfert d'un appel sans parler au destinataire du transfert Astuces • Si votre téléphone affiche un menu qui disparaît avant que vous n'ayez pu faire votre choix, vous pouvez appuyer à nouveau sur Rvoi Im afin que le menu s'affiche à nouveau. Vous pouvez également contacter votre administrateur système pour définir une valeur de temporisation plus longue. • Lorsque vous transférez un appel en cours de votre téléphone portable vers des périphériques Cisco Unified qui partagent la même ligne (transfert de session), la fonction Rvoi Im est désactivée sur ces derniers. Rvoi Im redevient disponible lorsque l'appel est terminé. • Si l'appel vous était directement destiné (sans avoir été transféré ou redirigé vers votre poste) ou si votre téléphone ne prend pas en charge l'option décrite ci-dessus, l'utilisation de Rvoi Im redirige l'appel vers votre système de messagerie vocale. • Lorsque vous transférez un appel en cours de votre téléphone portable vers des périphériques Cisco Unified qui partagent la même ligne (transfert de session), la fonction Rvoi Im est désactivée sur ces derniers. Rvoi Im redevient disponible lorsque l'appel est terminé. Transférer un appel actif, qui sonne ou en attente vers un système de messagerie vocale Procédure Étape 1 Appuyez sur Rvoi Im. Si aucune option de redirection n'est disponible, l'appel est transféré vers votre système de messagerie vocale. Étape 2 Si des options de redirection sont disponibles, votre téléphone affiche un nouveau menu. Sélectionnez une option pour renvoyer l'appel. Renvoi d'appels Les fonctions de renvoi d'appels permettent de renvoyer tous les appels entrants de votre téléphone vers un autre numéro. Votre administrateur système peut vous autoriser à choisir entre deux types de fonctions de renvoi d'appels : • Transfert des appels sans condition (Renvoi de tous les appels) : s'applique à tous les appels que vous recevez. • Transfert des appels conditionnel (Renvoisisansréponse, Renvoisi occupé, Renvoisi pas de couverture) : s'applique à certains appels que vous recevez, sous certaines conditions. Vous pouvez accéder à la fonction de renvoi de tous les appels sur votre téléphone ou à partir des pages Web Options utilisateur Cisco Unified Communications Manager. Les fonctions de renvoi d'appels conditionnel sont accessibles uniquement à partir des pages Web Options utilisateur. Votre administrateursystème détermine les fonctions de renvoi d'appels auxquelles vous avez accès. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 30 Fonctions d'appel Transférer un appel actif, qui sonne ou en attente vers un système de messagerie vocale Astuces • Saisissez le numéro cible du renvoi d'appels exactement comme si vous le composiez depuis votre téléphone. Par exemple, saisissez un code d'accès ou l'indicatif régional, si nécessaire. • Vous pouvez renvoyer vos appels vers un téléphone analogique traditionnel ou vers un autre téléphone IP, même si votre administrateur système peut limiter la fonction de renvoi d'appels aux numéros utilisés au sein de votre société. • Le renvoi d'appels dépend de la ligne téléphonique. Ainsi, si un appel arrive sur une ligne où la fonction de renvoi d'appels n'est pas activée, le téléphone sonne comme d'habitude et l'appel n'est pas renvoyé. • Votre administrateur système active une fonction d'annulation de renvoi permettant à la personne qui reçoit vos appels transférés de vous joindre. Lorsque l'annulation est activée, les appels passés à partir du téléphone cible vers votre téléphone ne sont pas transférés, mais ils déclenchent une sonnerie sur votre poste. • Il est possible que votre tentative de configuration du renvoi de tousles appels directementsur le téléphone soit refusée si le numéro cible saisi risque de créer une boucle de renvoi d'appel ou de dépasser le nombre maximum de liens autorisés dans une chaîne de renvoi d'appel. • Lorsque vous transférez un appel en cours de votre téléphone portable vers des périphériques Cisco Unified qui partagent la même ligne (transfert de session), la fonction de renvoi d'appels est désactivée sur ces derniers. Cette fonction redevient disponible lorsque l'appel est terminé. • Lorsque le renvoi d'appels est activé, observez : ◦ L'icône de renvoi d'appel en regard du numéro de téléphone principal : , qui se trouve toujours sur la touche de ligne 1. ◦ Le numéro cible du renvoi d'appels dans la ligne d'état. Rubriques connexes Opérations de la page Web Options utilisateur, à la page 80 Paramètres de ligne sur le Web, à la page 90 Configurer et annuler le renvoi de tous les appels à partir du téléphone Procédure Étape 1 Pour configurer le renvoi de tousles appels, appuyez sur RenvTt, puissaisissez un numéro de téléphone cible. Le téléphone affiche des informations visuelles pour indiquer qu'il renvoie tous les appels. Étape 2 Pour annuler le renvoi de tous les appels, appuyez sur RenvTt. L'écran du téléphone supprime les indications visuelles qui indiquent que le numéro de téléphone est renvoyé. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 31 Fonctions d'appel Configurer et annuler le renvoi de tous les appels à partir du téléphone Configuration ou annulation du renvoi d'appels Lorsque la fonction de renvoi d'appels est activée pour une autre ligne que la ligne principale, aucun signal sur le téléphone ne confirme que les appelssont renvoyés. Au lieu de cela, vous devez confirmer vos paramètres dans les pages Web Options utilisateur. Procédure Étape 1 Connectez-vous à vos pages Web Options utilisateur. Étape 2 Accédez à vos paramètres de renvoi d'appels. Ne pas déranger La fonction NPD (Ne pas déranger) désactive toutes les notifications sonores et visuelles des appels entrants. L'activation de cette fonction sur votre téléphone requiert l'intervention de votre administrateur système. Lorsque les fonctions NPD et Transfert des appels sont activées sur votre téléphone, les appels sont renvoyés immédiatement et l'appelant n'entend pas de tonalité d'occupation. Les interactions de la fonction NPD avec d'autres types des appels sont : • NPD n'affecte pas les appels intercom ni les appels prioritaires non-intercom. • Si les fonctions NPD et Réponse automatique sont activées, seuls les appels intercom font l'objet d'une réponse automatique. • Lorsque voustransférez un appel en cours de votre téléphone portable vers destéléphones Cisco Unified qui partagent la même ligne (transfert de session), le téléphone désactive la fonction NPD. Cette fonction redevient disponible lorsque l'appel est terminé. Activation et désactivation de la fonction NPD Procédure Étape 1 Pour activer la fonction NPD, appuyez sur NPD. “Ne pas déranger” s'affiche sur le téléphone, le témoin NPD s'éclaire (fixe) et la sonnerie est désactivée. Étape 2 Pour désactiver de nouveau la fonction NPD, appuyez sur NPD. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 32 Fonctions d'appel Configuration ou annulation du renvoi d'appels Configuration des paramètres NPD Si votre administrateur système a configuré les paramètres NPD de manière à ce qu'ils s'affichent dans la page Options utilisateur, procédez comme suit : Procédure Étape 1 Connectez-vous à vos pages Web Options utilisateur. Étape 2 Dans le menu déroulant, choisissez Options utilisateur > Périphérique. Étape 3 Vous pouvez définir les options ci-dessous : • Ne pas déranger : active ou désactive la fonction NPD. • Option NPD : choisissez Refus d'appel (pour désactiver toutes les notifications sonores et visuelles) ou Sonnerie désactivée (pour désactiver uniquement la sonnerie). • Alerte d'appel entrant avec la fonction NPD (s'applique aux deux configurations de l'option NPD) : configurez l'alerte sur Bip seulement ou sur Clignotement seulement, désactivez l'alerte ou choisissez “Aucun” (pour utiliser le mode “Alerte” configuré par votre administrateur système). Conférences Votre téléphone IP Cisco Unified permet de réunir trois personnes ou plus dans une même conversation téléphonique en établissant une conférence. Vous pouvez créer une conférence de différentes manières, en fonction de vos besoins et des fonctions disponibles sur votre téléphone. • Conférence : permet de créer une conférence standard (ad hoc) en appelant chaque participant. Utilisez la touche Conférence ou le bouton Conférence. La fonction Conférence est disponible sur la plupart des téléphones. • Joindre : permet de créer une conférence standard (ad hoc) en combinant des appels existants. Utilisez la touche Joindre. • Meet-Me : permet de créer ou de joindre une conférence en appelant un numéro de conférence. Utilisez la touche ou le bouton Meet-Me. Conférence ad hoc La fonction Conférence permet d'appeler chaque participant. La fonction Conférence est disponible sur la plupart des téléphones. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 33 Fonctions d'appel Configuration des paramètres NPD Astuces • S'il vous arrive souvent de joindre plus de deux interlocuteurs dans une seule conférence, vous rechercherez peut-être pratique de sélectionner tout d'abord les appels à joindre, puis d'appuyer sur Joindre pour terminer l'opération. • Une fois l'opération Joindre terminée, l'ID de l'appelant devient “Conférence.” • Un utilisateur Chaperon des appels peut mettre en conférence uniquement le premier appelant. Les autres appelants peuvent être ajoutés à la conférence par les autres participants. • Pour obtenir la liste des participants à la conférence, reportez-vous à Liste des participants à la conférence, à la page 37. Création d'une conférence en appelant chacun des participants Procédure Étape 1 À partir d'un appel connecté, appuyez sur Conf. ou sur Conférence. Il est possible que vous deviez au préalable appuyer sur la touche Autres pour afficher l'option Conf. Étape 2 Saisissez le numéro de téléphone du participant. Étape 3 Attendez que l'appel soit établi. Étape 4 Appuyez de nouveau sur Conf. ou sur Conférence pour ajouter le participant à votre conversation. Étape 5 Répétez cette procédure pour ajouter d'autres participants. Ajout de participants à la conférence Votre administrateur système détermine si vous pouvez ajouter ou supprimer des participants si vous n'êtes pas l'organisateur de la conférence. Procédure Étape 1 À partir d'un appel connecté, appuyez sur Conf. ou sur Conférence. Il est possible que vous deviez au préalable appuyer sur la touche Autres pour afficher l'option Conf. Étape 2 Saisissez le numéro de téléphone du participant. Étape 3 Attendez que l'appel soit établi. Étape 4 Appuyez de nouveau sur Conf. ou sur Conférence pour ajouter le participant à votre conversation. Étape 5 Répétez cette procédure pour ajouter d'autres participants. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 34 Fonctions d'appel Ajout de participants à la conférence Comment se joindre à la conférence La fonction Joindre permet de combiner plusieurs appels existants afin de créer une conférence à laquelle vous participez. Astuces • S'il vous arrive souvent de joindre plus de deux interlocuteurs dans une seule conférence, vous rechercherez peut-être pratique de sélectionner tout d'abord les appels à joindre, puis d'appuyer sur Joindre pour terminer l'opération. • Une fois l'opération Joindre terminée, l'ID de l'appelant devient Conférence. • Pour obtenir la liste des participants à la conférence, reportez-vous à Liste des participants à la conférence, à la page 37. Joindre des appels existants sur une même ligne téléphonique Procédure Étape 1 À partir d'un appel en cours, appuyez sur Joindre. Il est possible que vous deviez au préalable appuyer sur la touche Autres pour afficher l'option Joindre. Étape 2 Appuyez sur le bouton de ligne clignotant vert des appels que vous voulez ajouter à la conférence. L'un des événements ci-dessous se produit : a) Les appels sont joints. b) Une fenêtre s'ouvre sur l'écran du téléphone ; celle-ci permet de sélectionner les appels à joindre. Mettez les appels en surbrillance, puis appuyez sur Sélect., puis sur Joindre pour terminer l'opération. Comment joindre des appels existants sur plusieurs lignes téléphoniques Procédure Étape 1 À partir d'un appel en cours, appuyez sur Joindre. Il est possible que vous deviez au préalable appuyer sur la touche Autres pour afficher l'option Joindre. Étape 2 Appuyez sur le bouton de ligne clignotant vert des appels que vous voulez ajouter à la conférence. Si votre téléphone ne prend pas en charge la fonction Joindre dansle cas des appelssur plusieurs lignes, transférez les appels vers une ligne unique. Vous pourrez alors utiliser la fonction Joindre. Remarque Étape 3 Si une fenêtre s'ouvre sur l'écran de votre téléphone et vous invite à sélectionner les appels à joindre, mettez les appels en surbrillance, appuyez sur Sélectionner, puis appuyez sur Joindre pour terminer l'opération. Les appels sont joints. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 35 Fonctions d'appel Comment se joindre à la conférence Conférence Meet-Me La conférence Meet-Me permet de démarrer une conférence ou de s'y connecter en composant son numéro. Astuce • Si vous composez le numéro d'une conférence Meet-Me depuis un téléphone non sécurisé, celui-ci affiche Périphérique non autorisé.Pour plus d'informations, reportez-vous à Appelssécurisés, à la page 49. • Une conférence Meet-Me se termine une fois que tous les participants ont raccroché. • Si l'organisateur de la conférence se déconnecte, la conférence continue jusqu'à ce que tousles participants aient raccroché. Démarrage d'une conférence Meet-Me Les participants ne peuvent pas joindre la conférence tant que l'initiateur n'a pas démarré la conférence. Procédure Étape 1 Demandez un numéro de téléphone Meet-Me à votre administrateur système. Étape 2 Communiquez ce numéro à tous les participants. Étape 3 Lorsque vous êtes prêt à démarrer la réunion, décrochez le combiné pour obtenir une tonalité, puis appuyez sur Meet-Me. Étape 4 Composez le numéro de la conférence Meet-Me. Pour joindre la conférence, les utilisateurs peuvent maintenant composer le numéro Meet-Me. Comment se joindre à une conférence Meet-Me Procédure Étape 1 Composez le numéro de la conférence Meet-Me que vous a communiqué l'initiateur de la conférence. Étape 2 Si vous entendez une tonalité d'occupation, l'initiateur de la conférence n'a pas encore rejoint la conférence. Attendez une minute, puis essayez de rappeler. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 36 Fonctions d'appel Conférence Meet-Me Liste des participants à la conférence Lors d'une conférence standard (ad hoc), vous pouvez afficher la liste des participants et supprimer des participants. Les participants sont affichés dans l'ordre dans lequel ils rejoignent la conférence ; les derniers à la joindre apparaissent en tête de liste. La liste des participants à la conférence (ListConf), peut afficher jusqu'à 16 personnes. Bien qu'il soit possible d'ajouter autant de participants qu'un pont de conférence, puisse en prendre en charge, ListConf n'affichera jamais plus de 16 participants. Au fur et à mesure que les participants rejoignent la conférence, ListConf affiche le nom des 16 dernières personnes arrivées. Remarque Pour ajouter plus de participants, reportez-vous à Ajout de participants à la conférence, à la page 34 Contrôle de la conférence à l'aide de la liste des participants La liste des participants à la conférence ListConf peut afficher jusqu'à 16 personnes. Bien qu'il soit possible d'ajouter autant de participants qu'un pont de conférence peut en prendre en charge, ListConf n'affichera jamais plus de 16 participants. Au fur et à mesure que les participants rejoignent la conférence, ListConf affiche le nom des 16 dernières personnes arrivées. Procédure Étape 1 Appuyez sur ListConf ou sur Liste de conférence. Les participants sont affichés dans l'ordre dans lequel ils rejoignent la conférence ; les derniers à la joindre apparaissent en tête de liste. Étape 2 Pour obtenir une liste à jour des participants à la conférence, appuyez sur MàJ. Étape 3 Poursavoir qui a initié la conférence, recherchez le participant qui apparaît au bas de la liste, avec un astérisque (*) en regard de son nom. Étape 4 Pour supprimer un participant de la conférence, mettez le nom du participant en surbrillance, puis appuyez sur Supprimer. Étape 5 Pour déconnecter le dernier participant ajouté à la conférence, appuyez sur SupDerA. Vous ne pouvez exclure des participants que si vous êtes l'initiateur de la conférence. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 37 Fonctions d'appel Liste des participants à la conférence Vérification de la sécurité de la conférence Procédure Étape 1 Pour vérifier la sécurité de la conférence, appuyez sur ListCfn ou sur Liste de conférence Étape 2 Pour vérifier si une conférence est sécurisée, recherchez l'icône ou après “Conférence” sur l'écran du téléphone. Étape 3 Pour vérifier qu'un participant appelle depuis un téléphone sécurisé, recherchez l'icône ou en regard du nom du participant sur l'écran du téléphone. Appels intercom Vous pouvez passer un appel intercom à destination d'un téléphone qui répond automatiquement à l'appel en mode haut-parleur et coupe le micro. L'appel intercom unidirectionnel permet d'envoyer un message court au destinataire. Le son est lu dans le combiné ou dans le casque, si l'un d'entre eux est en cours d'utilisation. Si le destinataire a déjà un appel en cours, celui-ci continue simultanément. Lorsque vous entendez une tonalité d'alerte intercom, vous pouvez choisir une des options ci-dessous : • Écouter l'appelant, son microphone étant coupé (il peut écouter l'appelant, mais celui-ci ne peut pas l'entendre). • Comment mettre fin à l'appel intercom en appuyant sur la touche FinApp. Cette option permet de ne pas écouter le message. • Parler à l'appelant à l'aide du bouton intercom actif en mode combiné, casque ou haut-parleur. L'appel intercom devient une connexion bidirectionnelle permettant de communiquer avec l'appelant. Lorsque vous utilisez la fonction intercom, n'oubliez pas les points ci-dessous : • Depuis une ligne intercom, vous ne pouvez appeler qu'une autre ligne intercom. • Vous ne pouvez utiliser qu'une seule ligne intercom à la fois. • Vous pouvez recevoir et émettre des appels intercom lorsque votre appel actif est surveillé ou enregistré. • Vous ne pouvez pas mettre un appel intercom en attente. Si vous vous connectez quotidiennement au même téléphone à l'aide de votre profil Cisco Extension Mobility, assurez-vous que votre administrateur système affecte la grille des boutons du téléphone à ce profil et qu'il définisse le téléphone comme périphérique intercom par défaut pour la ligne intercom. Remarque Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 38 Fonctions d'appel Appels intercom Passage d'un appel intercom vers le numéro intercom préconfiguré Procédure Étape 1 Appuyez sur (ligne intercom cible). Étape 2 Lorsque vous entendez la tonalité d'alerte intercom, commencez à parler. Passage d'un appel intercom vers un numéro intercom Procédure Étape 1 Appuyez sur ( ). Étape 2 Saisissez le numéro intercom cible ou appuyez sur le numéro simplifié cible. Étape 3 Lorsque vous entendez la tonalité d'alerte intercom, commencez à parler. Réception d'un appel intercom Procédure Lorsque vous entendez la tonalité d'alerte intercom, vous pouvez traiter l'appel de l'une des manières ci-dessous: • Écouter le message par voie audio unidirectionnelle. • Parler à l'appelant en appuyant sur le bouton (ligne intercom active). • Mettre la ligne intercom en surbrillance et appuyer sur FinApp. Gestion avancée des appels Lestâches de gestion avancée des appels comprennent desfonctionsspéciales que votre administrateursystème peut configurer sur votre téléphone, en fonction de vos besoins en la matière et de votre environnement de travail. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 39 Fonctions d'appel Passage d'un appel intercom vers le numéro intercom préconfiguré Numérotation simplifiée La numérotation simplifiée permet de saisir un code, d'appuyer sur un bouton ou de sélectionner un élément de l'écran du téléphone pour passer un appel. En fonction de sa configuration, votre téléphone peut prendre en charge plusieurs fonctions de numérotation simplifiée : • Boutons de numérotation simplifiée • Numérotation abrégée • Numéros rapides Pour configurer des boutons de numérotation rapide et de numérotation rapide, vous devez accéder aux pages Web Options utilisateur. Pour configurer des numéros rapides, vous devez accéder à la fonction de répertoire personnel. Votre administrateur système peut également configurer des fonctions de numérotation simplifiée à votre attention. Rubriques connexes Opérations de la page Web Options utilisateur, à la page 80 Répertoire personnel, à la page 72 Fonctions de supervision de ligne occupée, à la page 48 Passage d'un appel à l'aide des boutons de numérotation simplifiée Si votre téléphone prend en charge la fonction de numérotation simplifiée d'affichage de ligne occupée (FLO), vous pouvez savoir si le numéro simplifié est occupé avant de le composer. Procédure Étape 1 Configurez les boutons de numérotation simplifiée. Étape 2 Pour passer un appel, appuyez sur ( ). Passage d'un appel à l'aide de la numérotation simplifiée avec le combiné raccroché Procédure Étape 1 Configurez des codes de numérotation simplifiée. Étape 2 Pour passer un appel, saisissez le code de numérotation simplifiée, puis appuyez sur NumAbr. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 40 Fonctions d'appel Numérotation simplifiée Passage d'un appel avec la numérotation simplifiée avec le combiné décroché Procédure Étape 1 Décrochez le combiné. Étape 2 Appuyez sur la touche NumAbr, puis saisissez le code de numérotation simplifiée à l'aide du clavier. Étape 3 Appuyez de nouveau sur la touche NumAbr. Établir une conférence avec la numérotation simplifiée avec le combiné décroché Procédure Étape 1 Appuyez sur la touche Conf. L'utilisateur entend une tonalité. Étape 2 Appuyez sur la touche NumAbr, puis saisissez le code de numérotation simplifiée à l'aide du clavier. Étape 3 Appuyez de nouveau sur la touche NumAbr. Étape 4 Appuyez de nouveau sur la touche Conf. Transférer un appel avec la numérotation simplifiée avec le combiné décroché Procédure Étape 1 Appuyez sur la touche Transfert. L'utilisateur entend une tonalité. Étape 2 Appuyez sur la touche NumAbr, puis saisissez le code de numérotation simplifiée à l'aide du clavier. Étape 3 Appuyez de nouveau sur la touche NumAbr. Étape 4 Appuyez de nouveau sur la touche Transfert. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 41 Fonctions d'appel Numérotation simplifiée Passage d'un appel avec la numérotation simplifiée avec le combiné décroché dans un appel en attente Procédure Étape 1 Appuyez sur la touche NvAppel. Étape 2 Appuyez sur la touche NumAbr, puis saisissez le code de numérotation simplifiée à l'aide du clavier. Étape 3 Appuyez de nouveau sur la touche NumAbr. Passage d'un appel à l'aide de la numérotation simplifiée Procédure Étape 1 Créez une entrée du carnet d'adresses personnel et affectez-lui un code de numérotation simplifiée. Étape 2 Pour passer un appel, accédez au service de numérotation simplifiée de votre téléphone. Interception d'appels Grâce à cette fonction, vous pouvez renvoyer un appel qui sonne sur le téléphone d'un collègue vers votre appareil pour y répondre. Vous pouvez utiliser la fonction Interception d'appels si vous êtes plusieurs à gérer les appels. Astuces • Si plusieurs appels peuvent être interceptés, votre téléphone intercepte d'abord l'appel le plus ancien (l'appel qui sonne depuis le plus longtemps). • Si vous appuyez sur GrpIntr ou Interception d'appels de groupe, puis saisissez un numéro de ligne, votre téléphone intercepte l'appel qui sonne sur cette ligne (le cas échéant). • Si vous avez plusieurs lignes et voulez prendre l'appel sur une ligne secondaire, appuyez sur le bouton de la ligne souhaitée, puis sur une touche ou un bouton d'interception d'appel. • En fonction de la configuration du téléphone, vous pouvez recevoir un signal sonore ou visuel à propos d'un appel vers votre groupe de prise d'appel. • Si vous utilisez la fonction d'interception d'appels FLO sur votre téléphone, reportez-vous à Fonctions de supervision de ligne occupée, à la page 48. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 42 Fonctions d'appel Interception d'appels Réponse à un appel entrant qui sonne sur un autre poste de votre groupe d'interception d'appels Procédure Étape 1 Appuyez sur la touche Intrcpt. Vous devrez peut-être décrocher pour afficher la touche. Si votre téléphone prend en charge l'interception automatique des appels, vous êtes maintenant connecté à l'appel. Étape 2 Si l'appel sonne, appuyez sur Répondre pour vous y connecter. Réponse à un appel qui sonne sur un autre poste en dehors de votre groupe de prise d'appel Procédure Étape 1 Appuyez sur la touche GrpIntr. Vous devrez peut-être décrocher pour afficher la touche. Étape 2 Saisissez le numéro d'interception d'appels de groupe. Si votre téléphone prend en charge l'interception automatique des appels, vous êtes maintenant connecté à l'appel. Étape 3 Si l'appel sonne, appuyez sur Répondre pour vous y connecter. Réponse à un appel qui sonne sur un autre poste dans le groupe ou dans le groupe associé Procédure Étape 1 Appuyez sur la touche AGrpIntr. Vous devrez peut-être décrocher pour afficher la touche. Si votre téléphone prend en charge l'interception automatique des appels, vous êtes maintenant connecté à l'appel. Étape 2 Si l'appel sonne, appuyez sur Répondre pour vous y connecter. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 43 Fonctions d'appel Interception d'appels Réponse à un appel qui sonne sur un poste donné (numéro de ligne) Procédure Étape 1 Appuyez sur la touche GrpIntr. Vous devrez peut-être décrocher pour afficher la touche. Étape 2 Saisissez le numéro de ligne qui correspond à l'appel que vous voulez intercepter. Par exemple, si l'appel à intercepter sonne sur la ligne 12345, saisissez 12345. Si votre téléphone prend en charge l'interception automatique des appels, vous êtes maintenant connecté à l'appel. Étape 3 Si l'appel sonne, appuyez sur Répondre pour vous y connecter. Parcage d'appels Si vous voulez stocker un appel, vous pouvez le parquer afin que les utilisateurs puissent le récupérer sur un autre poste de téléconférence du système Cisco Unified Communications Manager (par exemple, le poste de téléconférence d'un collègue ou celui d'une salle de conférence). Vous pouvez parquer un appel à l'aide des méthodes ci-dessous. • Parcage d'appels : utilisez la touche Parquer pour stocker l'appel. Le téléphone affiche le numéro de parcage où le système a stocké l'appel. Vous devez enregistrer ce numéro et l'utiliser pour récupérer l'appel. • Parcage d'appels dirigé : Appuyez sur la touche Transfert pendant un appel. Pour stocker un appel, composez le numéro de parcage d'appels dirigé, puis appuyez de nouveau sur Transfert. • Parcage d'appels dirigé assisté : Utilisez le bouton Parcaged'appelsdirigé assisté affichant un indicateur d'état de ligne inactif. Pour récupérer un appel à partir de l'un des téléphones IP Cisco Unified de votre réseau, appuyez sur le bouton Parcage d'appels dirigé assisté clignotant. Astuces • Vous disposez d'un délai limité pour récupérer l'appel parqué avant qu'il ne recommence à sonner sur le poste auquel il était destiné à l'origine. Pour plus d'informations, contactez votre administrateur système. • Votre administrateur système peut affecter des boutons de parcage d'appel dirigé à des boutons de ligne disponibles sur le téléphone. • Vous pouvez composer des numéros de parcage d'appels dirigé si vous n'avez pas de boutons de parcage d'appels dirigé sur le téléphone. Vous ne pourrez toutefois pas voir l'état du numéro de parcage d'appels dirigé. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 44 Fonctions d'appel Parcage d'appels Stocker et récupérer l'appel actif à l'aide du Parcage d'appels Procédure Étape 1 Au cours d'un appel, appuyez sur Parquer. Il est possible que vous deviez au préalable appuyer sur la touche Autres pour afficher l'option Parquer. Étape 2 Notez le numéro de parcage affiché sur l'écran du téléphone. Étape 3 Raccrochez. Étape 4 Pour intercepter l'appel parqué, saisissez le numéro de parcage d'appels à partir de n'importe quel téléphone IP Cisco Unified de votre réseau. Diriger et stocker un appel actif vers un numéro de parcage d'appels dirigé Procédure Étape 1 Au cours d'un appel, appuyez sur . Étape 2 Composez le numéro de parcage d'appels dirigé. Étape 3 Appuyez de nouveau sur Transfert pour mettre fin au stockage de l'appel. Récupérer un appel parqué depuis un numéro de parcage d'appels dirigé Procédure Étape 1 Depuis un téléphone IP Cisco Unified de votre réseau, saisissez le préfixe de récupération de parcage, puis Étape 2 Effectuez l'une des opérations ci-dessous : • Composez le numéro de parcage d'appels dirigé. • Appuyez sur le bouton (clignotant) ( ) pour vous connecter à l'appel. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 45 Fonctions d'appel Parcage d'appels Envoi, stockage et récupération un appel actif vers un numéro de parcage d'appels dirigé Procédure Étape 1 Lors d'un appel, appuyez sur le bouton Parcage d'appels dirigé assisté affichant un indicateur d'état de ligne inactif . Étape 2 Pour récupérer l'appel, appuyez sur le bouton Parcage d'appels dirigé assisté qui clignote. Si votre administrateur n'a pas configuré de numéro de répertoire de récupération, l'appel parqué est récupéré sur le téléphone de parcage de l'appel. Groupes de recherche Si votre organisation reçoit de nombreux appels entrants, il est possible que vous fassiez partie d'un groupe de recherche, lequel inclut une série de numéros d'annuaire qui se partagent la charge des appels entrants. Lorsque le premier numéro d'annuaire du groupe de recherche est occupé, le système recherche le prochain numéro d'annuaire disponible dans le groupe et dirige les appels vers ce téléphone. Lorsque vous êtes loin de votre téléphone, vous pouvez vous déconnecter des groupes de recherche afin que le téléphone ne sonne pas. Astuce • Vous déconnecter des groupes de recherche n'empêche pas les appels autres que ceux des groupes de recherche de sonner sur votre téléphone. • Une fois connecté, le bouton Groupe de recherche est allumé. Connexion et déconnexion des groupes de recherche Procédure Étape 1 Appuyez sur Groupmt. Vous êtes maintenant connecté au groupe de recherche. Étape 2 Appuyez sur Groupmt. L'écran du téléphone affiche Déconnecté du groupement. Lignes partagées Votre administrateur système peut vous demander d'utiliser une ligne partagée si : • Vous disposez de plusieurs téléphones et vous voulez avoir un seul numéro • Vous partagez des tâches de gestion des appels avec des collègues Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 46 Fonctions d'appel Groupes de recherche • Vous gérez des appels pour le compte d'un manager Icône Utilisé à distance L'icône Utilisé à distance s'affiche lorsqu'un appel est en cours sur un téléphone qui partage votre ligne. Vous pouvez émettre et recevoir des appels normalement sur la ligne partagée, même si l'icône Utilisé à distance s'affiche. Informations sur les appels et l'insertion Les téléphones qui partagent une ligne affichent des informations sur les appels émis et reçus sur la ligne partagée. Ces informations incluent notamment l'ID de l'appelant et la durée d'appel (pour les exceptions, reportez-vous à Confidentialité, à la page 47). Sur une ligne partagée, les utilisateurs d'autres modèles de téléphones IP Cisco Unified sont susceptibles de se joindre à votre appel actif. Par défaut, votre téléphone ne prend pas en charge cette fonction d'insertion. Si vous voulez l'utiliser, contactez votre administrateur système. Dans le cas contraire, vous pouvez activer la fonction de confidentialité pour empêcher vos collègues de se joindre à vos appels. Confidentialité Si vous ne voulez pas que les collègues qui partagent votre ligne puissent afficher les informations sur vos appels, activez la fonction de confidentialité. Vos collègues ne peuvent alors pas savoir qui vous appelez, ni se joindre à vos appels. Informations ligne partagée Sur une ligne partagée, vous pouvez afficher des informations sur les appels qui y ont lieu, récupérer un appel mis en attente par l'un de vos collègues et empêcher l'insertion. Pour... Procédez comme suit... Recherchez l'icône Utilisé à distance en regard d'un bouton de ligne rouge (fixe). Savoirsi la ligne partagée est en cours d'utilisation Appuyez sur le bouton de ligne rouge (fixe) correspondant à la ligne utilisée à distance. Tout appel non confidentiel est affiché dans la zone d'activité des appels de l'écran du téléphone. Afficher les détails concernant les appels en cours sur la ligne partagée Appuyez sur le bouton de ligne rouge (clignotant) correspondant à la ligne utilisée à distance. Récupérer un appel en attente sur une ligne partagée Astuces • Si vous partagez la ligne avec un téléphone dont la confidentialité est activée, vous pouvez passer et recevoir des appels normalement sur cette ligne. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 47 Fonctions d'appel Lignes partagées • La fonction de confidentialité s'applique à toutes les lignes partagées de votre téléphone. Si vous avez plusieurs lignes partagées et si la fonction de confidentialité est activée, vos collègues ne peuvent donc afficher les appels sur aucune de ces lignes et ne peuvent pas non plus s'y connecter. Empêcher ou autoriser les autres personnes à afficher ou vos appels sur une ligne partagée ou à s'y insérer Procédure Étape 1 Pour empêcher d'autres personnes d'afficher vos appels sur une ligne partagée ou de s'y insérer. a) Appuyez sur Confidentiel ( ). b) Pour vérifier que la confidentialité est activée, recherchez l'icône de fonction activée en regard d'un bouton de ligne orange . Étape 2 Pour autoriser les autres personnes à afficher vos appels sur une ligne partagée ou à s'y insérer. a) Appuyez sur Confidentiel ( ). b) Pour vérifier que la confidentialité est désactivée, recherchez l'icône de fonction désactivée en regard d'un bouton de ligne éteint . Fonctions de supervision de ligne occupée La Fonction de ligne occupée (FLO) permet d'afficher l'état d'une ligne téléphonique associée à un bouton de numérotation simplifiée, un journal des appels ou une entrée de répertoire sur votre téléphone.Si vous utilisez la fonction d'interception d'appels FLO, vous pouvez répondre à un appel qui sonne sur la ligne que vous surveillez. Votre administrateur système détermine les fonctions FLO configurées sur votre téléphone. Pour... Procédez comme suit... Recherchez les indicateurs FLO en regard du numéro de la ligne : • La ligne est en cours d'utilisation. • La ligne est inactive. Consulter l'état d'une ligne figurant dans un journal des appels ou un répertoire Recherchez les indicateurs FLO en regard du numéro de la ligne : • La ligne est en cours d'utilisation. • La ligne est inactive. • Une ligne surveillée par FLO sonne ( Interception d'appels FLO) Afficher l'état d'une ligne de numérotation simplifiée Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 48 Fonctions d'appel Lignes partagées Astuces • Il est possible qu'un indicateur sonore retentisse sur votre téléphone lorsqu'un appel sonne sur la ligne surveillée (Interception d'appels FLO uniquement). • La fonction d'interception d'appels FLO répond d'abord à l'appel le plus ancien (si plusieurs appels sonnent sur la ligne surveillée). • Si vous appuyez sur le bouton d'interception d'appels FLO alors que la ligne surveillée ne sonne pas, votre téléphone compose le numéro simplifié de la ligne. Utiliser l'interception d'appels FLO pour répondre à un appel qui sonne Procédure Étape 1 Si la ligne actuelle sonne, appuyez sur le bouton Interception d'appels FLO. . L'appel est redirigé vers la ligne suivante disponible sur votre téléphone. Étape 2 Pour indiquer une ligne particulière, appuyez d'abord sur un bouton de ligne, puis sur le bouton FLO. Si votre téléphone prend en charge l'interception automatique des appels, l'appel est connecté automatiquement. Étape 3 Si l'appel sonne sur votre téléphone, répondez-y. Appels sécurisés En fonction de la façon dont l'administrateur a configuré votre système téléphonique, votre téléphone peut prendre en charge l'émission et la réception des appels sécurisés. Pour déterminer si vous pouvez passer des appels sécurisés, contactez votre administrateur. Votre téléphone peut prendre en charge les types d'appels ci-dessous. • Appel authentifié : les identités des téléphones qui participent à l'appel ont été vérifiées. • Appel chiffré : le téléphone reçoit et transmet des signaux audio chiffrés (votre conversation) sur le réseau Cisco Unified Communications Manager. Les appels chiffrés sont authentifiés. • Appel protégé : le téléphone est un appareil sécurisé (chiffré et approuvé) sur le serveur Cisco Unified Communications Manager ; il est configuré comme “Périphérique protégé” dans Cisco Unified Communications Manager Administration. Lorsque la fonction “Jouer tonalité de sécurisation” est activée (vraie) dans Cisco Unified Communications Manager Administration, le téléphone protégé émet une tonalité de sécurisation ou non-sécurisation au début de l'appel : ◦ Lorsque lessupportssécurisés de bout en boutsont établis via le protocoleSRTP(Secure Real-Time TransferProtocol) et que l'état de l'appel est sécurisé, le téléphone émet une tonalité de sécurisation (trois longs bips entrecoupés de courtes pauses). ◦ Lorsque les supports non sécurisés de bout en bout sont établis via le protocole RTP (Real-Time Protocol) et que l'état de l'appel est non sécurisé, le téléphone émet une tonalité de non-sécurisation (six bips courts entrecoupés de courtes pauses). Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 49 Fonctions d'appel Appels sécurisés Lorsque la fonction Jouer tonalité de sécurisation est désactivée (fausse), vous n'entendez aucune tonalité. • Appel non protégé : le téléphone n'est pas configuré comme “Périphérique protégé” dans Cisco Unified Communications Manager. Le téléphone émet une tonalité de non-sécurisation. • Appel non sécurisé : le téléphone n'est pas protégé sur le serveur Cisco Unified Communications Manager et l'état de l'appel n'est pas sécurisé. Pour plus d'informations, contactez votre administrateur système. Le tableau ci-dessous décrit les moyens de vérifier les informations d'appel. Pour... Procédez comme suit... Regardez si l'une des icônes de sécurité ci-dessous apparaît en haut à droite de la zone d'activité des appels, en regard de l'indicateur de durée d'appel : Conférence ou appel authentifié Conférence ou appel chiffré Conférence ou appel non sécurisé Contrôler le niveau d'un appel ou d'une conférence Vérifiez que vous entendez bien la tonalité de sécurisation au début de l'appel. • État de l'appel sécurisé : lorsque le téléphone est protégé, que la fonction “Jouer tonalité de sécurisation” est activée et que l'état de l'appel est sécurisé, le téléphone protégé joue une tonalité de sécurisation en début d'appel (trois bips longs entrecoupés de pauses). L'icône en forme de verrou indique également que l'appel est sécurisé. • État de l'appel non sécurisé : lorsque le téléphone est protégé, que la fonction “Jouer tonalité de sécurisation” est activée et que l'état de l'appel est non sécurisé, le téléphone protégé joue une tonalité de non-sécurisation en début d'appel (six bips courts entrecoupés de courtes pauses). L'icône de lecture en forme de flèche indique également que l'appel n'est pas sécurisé. Pour plus d'informations, contactez votre administrateur système. Vérifier que la connexion du téléphone (état de l'appel) est sécurisée Des interactions, des restrictions et des limites peuvent affecter l'exécution des fonctions de sécurité de votre téléphone. Pour plus d'informations, contactez votre administrateur système. Remarque Un périphérique en cours d'appel est sécurisé ou n'est pas sécurisé. Les icônes en forme de bouclier ou de verrou ne s'affichent pas sur l'écran des téléphones IP Cisco Unified lorsqu'un appel est passé vers ou depuis un périphérique non approuvé, même si l'appel est sans danger. Remarque Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 50 Fonctions d'appel Appels sécurisés Suivi des appels douteux Si vous faites l'objet d'appels douteux ou malveillants, votre administrateur système peut ajouter la fonction d'identification des appels malveillants (IDAM) à votre téléphone. Cette fonction permet d'identifier un appel actif douteux, ce qui lance une série de messages automatisés de suivi et de notification. Informer l'administrateur système d'un appel douteux ou malveillant Procédure Appuyez sur IDAM. Vous entendez une tonalité et le message IDAM réussi s'affiche sur votre téléphone. Votre administrateur reçoit la notification sur l'appel avec desinformations complémentaires pour prendre les mesures appropriées. Appels prioritaires Dans certains environnements spécialisés, tels que les bureaux de l'Armée ou de l'État, il est possible que vous ayez besoin de passer et de recevoir des appels urgents ou critiques. Si vous avez besoin de ce traitement spécialisé des appels, votre administrateur système peut ajouter une fonction de préséance et de préemption à plusieurs niveaux (Multilevel Precedence and Preemption, MLPP) sur votre téléphone. Gardez ces définitions à l'esprit : • La préséance indique la priorité associée à un appel. • La préemption est le processus qui permet de mettre fin à un appel existant dont la priorité est inférieure, tout en acceptant un appel de priorité supérieure envoyé vers votre téléphone. Si vous... Procédez comme suit... Contactez votre administrateur système pour obtenir la liste des numéros de préséance correspondant aux appels. Voulez pouvoir choisir le niveau de priorité (préséance) d'un appel sortant Saisissez le numéro d'accès MLPP (fourni par votre administrateur système), puis le numéro de téléphone. Voulez passer un appel prioritaire (qui a la préséance) Vous recevez un appel prioritaire (qui a la préséance). Une icône MLPPs'affiche sur l'écran de votre téléphone pour indiquer le niveau de priorité de l'appel. Entendez une sonnerie différente (plus simplifié que d'habitude) ou une tonalité d'attente spéciale Voulez afficher le niveau de priorité Recherchez l'icône MLPP sur l'écran de votre téléphone : d'un appel Appel prioritaire Appel d'importance moyenne (immédiat) Appel très important (simplifié) Appel de la plus haute importance (suppression simplifiée) ou appel prioritaire Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 51 Fonctions d'appel Suivi des appels douteux Les appels les plus importants s'affichent en haut de la liste des appels.Si aucune icône MLPPn'apparaît, il s'agit d'un appel normal (routine). Cela signifie que vous ou votre interlocuteur recevez un appel qui est prioritaire sur l'appel en cours. Raccrochez immédiatement pour permettre à l'appel plus important de sonner sur votre téléphone. Entendez une tonalité continue qui interrompt votre appel Astuces • Lorsque vous passez ou que vous recevez un appel compatible MLPP, vous entendez une sonnerie et une tonalité d'attente spéciales, différentes des sonnerie et tonalité standard. • La fonction MLPP est prioritaire sur le mode NPD (Ne pas déranger). • Si vous saisissez un numéro d'accès MLPP incorrect, un message vocal vous en avertit. • Un appel MLPP reste prioritaire lorsque vous : ◦ Mettez l'appel en attente ◦ Transférez l'appel ◦ Ajoutez l'appel à une conférence à trois ◦ Répondez à l'appel par interception Cisco Extension Mobility Cisco Extension Mobility (EM) permet de configurer temporairement un téléphone IP Cisco Unified comme étant le vôtre. Lorsque vous vous connectez à EM, le téléphone adopte votre profil utilisateur, y compris vos lignes téléphoniques, fonctions, services établis et paramètres Web. Seul l'administrateur système peut configurer Extension Mobility. La fonction de modification du PIN de Cisco Extension Mobility permet de modifier votre PIN depuis votre téléphone IP Cisco Unified. Astuces • Vous êtes automatiquement déconnecté du service EM au bout d'un certain temps. Ce délai est déterminé par l'administrateur système. • Les modifications que vous apportez à votre profil EM dans les pages Web Options utilisateur Cisco Unified Communications Manager sont prises en compte immédiatement si vous êtes connecté à la fonction Extension Mobility sur votre téléphone. Sinon, elles ne seront prises en compte qu'à votre prochaine connexion. • Les modifications que vous apportez à votre téléphone dans les pages Web Options utilisateur sont prises en compte immédiatement si vous vous êtes déconnecté du service EM. Sinon, elles ne seront prises en compte qu'à votre prochaine déconnexion. • Les paramètres locaux réglables sur le téléphone ne sont pas enregistrés dans votre profil EM. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 52 Fonctions d'appel Cisco Extension Mobility Connexion au service EM Procédure Étape 1 Sélectionnez ( ) > Services > Service EM (le nom de cette fonction peut varier). Étape 2 Saisissez votre ID utilisateur et votre PIN (fournis par votre administrateur système). Étape 3 Si vous y êtes invité, sélectionnez un profil de périphérique. Déconnexion du service EM Procédure Étape 1 Sélectionnez ( ) > Services > Service EM (le nom de cette fonction peut varier). Étape 2 Lorsque vous êtes invité à vous déconnecter, appuyez sur Oui. Modifier PIN à l'aide du service Modifier les informations d'identification Procédure Étape 1 Sélectionnez ( ) > Services > Modifier les informations d'identification. Étape 2 Saisissez votre ID utilisateur dans le champ ID utilisateur. Étape 3 Saisissez votre PIN dans le champ PIN actuel. Étape 4 Dans le champ Nouveau PIN, spécifiez votre nouveau PIN. Étape 5 Dans le champ Confirmer le PIN, spécifiez à nouveau votre nouveau PIN. Étape 6 Appuyez sur Modifier. Un message indique que le PIN a été modifié. Étape 7 Appuyez sur Quitter. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 53 Fonctions d'appel Cisco Extension Mobility Modifier le PIN à l'aide de la touche Modifier le PIN Procédure Étape 1 Sélectionnez ( ) > Services > Service EM (le nom de cette fonction peut varier). Étape 2 Appuyez sur Modifier le PIN. Étape 3 Saisissez votre PIN dans le champ PIN actuel. Étape 4 Dans le champ Nouveau PIN, spécifiez votre nouveau PIN. Étape 5 Dans le champ Confirmer le PIN, spécifiez à nouveau votre nouveau PIN. Étape 6 Appuyez sur Modifier. Un message indique que le PIN a bien été modifié. Étape 7 Appuyez sur Quitter. Appels professionnels à l'aide d'un seul numéro de téléphone Intelligent Session Control associe le numéro de votre téléphone portable à celui de votre téléphone IP professionnel. Lorsque vousrecevez un appelsur votre destination distante (téléphone portable), votre téléphone de bureau ne sonne pas et seule votre destination distante sonne. Lorsque vous répondez à un appel entrant sur votre téléphone portable, votre téléphone de bureau affiche le message Utilisé à distance. Au cours d'un appel, vous pouvez également utiliser lesfonctions de votre téléphone portable.Si, par exemple, vous recevez un appel sur votre numéro mobile, vous pouvez le prendre depuis votre téléphone de bureau ou le transférer sur ce dernier depuis votre téléphone portable. Le tableau qui suit décrit le mode de transfert des appels. Pour... Procédez comme suit... Utilisez les différentes fonctions de votre téléphone portable (par exemple, *74). Contactez votre administrateur système pour obtenir la liste des codes d'accès. Transférer un appel entrant en cours sur votre téléphone portable vers un téléphone de bureau Mobile Connect et Accès vocal mobile Lorsque lesfonctions de connexion et d'accès vocal mobilessont installées, vous pouvez utiliser votre téléphone portable pour gérer les appels associés au numéro de votre téléphone de bureau. • Votre bureau et vos destinations distantes reçoivent les appels simultanément. • Lorsque vous prenez l'appel sur votre téléphone de bureau, les destinations distantes cessent de sonner, sont déconnectées et affichent un message d'appel en absence. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 54 Fonctions d'appel Appels professionnels à l'aide d'un seul numéro de téléphone • Lorsque vous prenez l'appel sur une destination distante, les autres destinations distantes cessent de sonner, sont déconnectées et affichent un message d'appel en absence. Pour... Procédez comme suit... Les pages Web Options utilisateur permettent de configurer des destinations distantes et de créer des listes d'accès destinées à autoriser ou à bloquer les appels passés vers ces destinations depuis des numéros spécifiques. Reportez-vous à Téléphone et liste d'accès pour Mobile Connect, à la page 91. Configurer Mobile Connect Réponse à un appel sur votre Reportez-vous à Réponse à un appel, à la page 23. téléphone portable Faire basculer un appel en Reportez-vous à Mouvement des appels en cours, à la page 26. cours entre votre téléphone de bureau et un téléphone portable Passage d'un appel depuis Reportez-vous à Options des appels supplémentaires, à la page 19. votre téléphone portable Astuces • En cas d'utilisation de l'accès vocal mobile, vous devez saisir le numéro depuis lequel vous appelez et votre PIN si l'une des conditions ci-dessous s'applique : ◦ Le numéro depuis lequel vous appelez n'est pas l'une de vos destinations distantes. ◦ Le numéro est bloqué par votre opérateur ou vous-même (affiché comme “Numéro inconnu”). ◦ Le numéro ne se présente pas exactement de la même manière dans la base de données Cisco Unified Communications Manager. Par exemple, votre numéro est le 510-666-9999 (ou le 408-999-6666) maisil estspécifié dansla base de données comme 666-9999 (ou 1-408-999-6666). • Si vous vous trompez trois fois de suite dans la saisie des informations demandées telles que le numéro de téléphone portable ou le PIN, vous ne disposez plus de la fonction d'accès vocal mobile et l'accès vous est refusé pendant une certaine durée.Pour obtenir de l'aide, contactez votre administrateursystème. Rubriques connexes Mouvement des appels en cours, à la page 26 Mettre en attente l'appel intercepté sur un téléphone portable Procédure Étape 1 Appuyez sur Attente d'entreprise (ce nom peut varier). Votre interlocuteur est mis en attente. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 55 Fonctions d'appel Appels professionnels à l'aide d'un seul numéro de téléphone Étape 2 Sur votre téléphone portable, appuyez sur Reprendre (ce nom peut varier). Vous connecter à la fonction d'accès vocal mobile Procédure Étape 1 Composez le numéro d'accès vocal mobile qui vous a été attribué depuis n'importe quel téléphone. Étape 2 Saisissez le numéro depuis lequel vous appelez, si vous y êtes invité, ainsi que votre PIN. Activation de Mobile Connect depuis un téléphone portable Procédure Étape 1 Composez le numéro d'accès vocal mobile qui vous a été attribué. Étape 2 Saisissez le numéro de votre téléphone portable, si vous y êtes invité, ainsi que votre PIN. Étape 3 Appuyez sur 2 pour activer Mobile Connect. Étape 4 Vous pouvez activer Mobile Connect pour tous les téléphones configurés ou pour un seul : • Tous les téléphones : saisissez 2. • Un téléphone : saisissez 1, puis le numéro à ajouter comme destination distante, suivi de dièse (#). Désactiver Mobile Connect depuis un téléphone portable Procédure Étape 1 Composez le numéro d'accès vocal mobile qui vous a été attribué. Étape 2 Saisissez le numéro de votre téléphone portable, si vous y êtes invité, ainsi que votre PIN. Étape 3 Appuyez sur 3 pour désactiver Mobile Connect. Étape 4 Vous pouvez désactiver Mobile Connect pour tous les téléphones configurés ou pour un seul : • Tous les téléphones : saisissez 2. • Un téléphone : saisissez 1, puis saisissez le numéro que vous voulez supprimer comme destination distante, suivi de dièse (#). Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 56 Fonctions d'appel Appels professionnels à l'aide d'un seul numéro de téléphone Activer ou désactiver l'accès de connexion mobile à toutes les destinations distantes à partir de votre téléphone de bureau Procédure Étape 1 Appuyez sur le bouton Mobilité pour afficher l'état actuel de la destination distante (activée ou désactivée). Étape 2 Appuyez sur Sélect pour modifier l'état. Étape 3 Appuyez sur Quitter. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 57 Fonctions d'appel Appels professionnels à l'aide d'un seul numéro de téléphone Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 58 Fonctions d'appel Appels professionnels à l'aide d'un seul numéro de téléphone CHAPITRE 4 Combiné, casque et haut-parleur Vous pouvez utiliser votre téléphone avec ces périphériques audio : un combiné, un casque ou un haut-parleur. Le téléphone est décroché lorsque le combiné est soulevé ou lorsqu'un autre périphérique audio est en cours d'utilisation. Le téléphone est raccroché lorsque le combiné est sur son support et qu'aucun autre périphérique audio n'est utilisé. Ce chapitre contient les sections ci-dessous : • Combiné, page 59 • Casque, page 60 • Haut-parleur, page 60 • Réponse automatique avec casque ou haut-parleur, page 61 Combiné Le tableau qui suit décrit l'utilisation du combiné. Pour... Procédez comme suit... Levez-le pour décrocher ; remettez-le en place pour raccrocher. La ligne qui sonne est automatiquement sélectionnée. Contactez votre administrateur système concernant les options permettant de toujours sélectionner la ligne principale. Utiliser le combiné Appuyez sur ou ( ), puis raccrochez le combiné. Passer en mode haut-parleur ou casque en cours d'appel Appuyez sur le bouton Volume pendant l'appel ou après obtention de la tonalité. Appuyez sur Enregistrer pour conserver le niveau de volume pour les appels ultérieurs. Régler le volume d'un appel Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 59 Casque Pour les casques à fil, votre téléphone prend en charge les prises casque à quatre ou six fils. Pour plus d'informations sur l'achat de casques, reportez-vous à Prise en charge de casques, à la page 16. Vous pouvez utiliser un casque avec toutes les commandes de votre téléphone, notamment le bouton Volume et . Pour... Procédez comme suit... Appuyez sur ( ) pour activer/désactiver le mode casque. (En général, le bouton 23 est affecté au casque.) Activer ou désactiver le mode casque Passer en mode combiné Décrochez le combiné (n'appuyez sur aucun bouton). Appuyez sur le bouton Volume pendant l'appel ou après obtention de la tonalité. Appuyez sur Enregistrer pour conserver le niveau de volume pour les appels ultérieurs. Régler le volume d'un appel Si vous utilisez la fonction de réponse automatique, reportez-vous à Réponse automatique avec casque ou haut-parleur, à la page 61. Casque large bande Si vous utilisez un casque large bande, vous devriez bénéficier d'une meilleure sensibilité audio en activant le paramètre large bande de votre téléphone (ce paramètre est désactivé par défaut).Pour accéder au paramètre, sélectionnez ( ) > Paramètres > Préférences utilisateur > Préférences audio > Casque large bande. Si le paramètre Casque large bande apparaît en grisé, vous ne pouvez pas le modifier. Assurez-vous auprès de l'administrateur que votre système téléphonique est bien configuré pour le mode large bande. Si ce n'est pas le cas, vous risquez de ne pas pouvoir détecter de sensibilité audio supplémentaire, même en utilisant un casque large bande. Pour connaître les caractéristiques de votre casque, reportez-vous à la documentation qui l'accompagne ou contactez votre administrateur système. Haut-parleur La plupart des opérations que vous pouvez effectuer pour composer un numéro ou répondre à un appel déclenche automatiquement le mode haut-parleur, à condition que le combiné soit raccroché et que le témoin (casque) ne soit pas allumé. Pour... Procédez comme suit... Activer Appuyez sur . ou désactiver le mode haut-parleur Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 60 Combiné, casque et haut-parleur Casque Pour... Procédez comme suit... Passer en mode combiné Décrochez le combiné (n'appuyez sur aucun bouton). Appuyez sur le bouton Volume pendant l'appel ou après obtention de la tonalité. Appuyez sur Enregistrer pour conserver le niveau de volume pour les appels ultérieurs. Régler le volume d'un appel Réponse automatique avec casque ou haut-parleur Lorsque la fonction de réponse automatique est activée, votre téléphone répond automatiquement aux appels entrants après quelques sonneries. Votre administrateur système doit configurer la fonction de réponse automatique pour qu'elle fonctionne soit avec votre haut-parleursoit avec votre casque. La fonction de réponse automatique est particulièrement utile si vous recevez un grand nombre des appels entrants. Si vous... Procédez comme suit... Restez en mode casque (le témoin ( ) doit rester allumé) même lorsque vous n'êtes pas en ligne. Pour que le mode casque reste activé, procédez comme suit : • Appuyez sur FinApp pour raccrocher. • Appuyez sur NvAppel ou Composer pour effectuer de nouveaux appels. Si votre téléphone est configuré pour utiliser la fonction de réponse automatique en mode casque, il ne prend les appels automatiquement que si le témoin ( ) est allumé. Dans le cas contraire, les appels sonnent normalement et vous devez y répondre manuellement. Utilisez la fonction de réponse automatique avec un casque Laissez le combiné raccroché et gardez le mode casque inactif ( ( ) éteint). Dansle cas contraire, les appelssonnent normalement et vous devez y répondre manuellement. Utilisez la fonction de réponse automatique avec le haut-parleur Astuce En mode Ne pas déranger, la fonction Réponse automatique est désactivée. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 61 Combiné, casque et haut-parleur Réponse automatique avec casque ou haut-parleur Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 62 Combiné, casque et haut-parleur Réponse automatique avec casque ou haut-parleur CHAPITRE 5 Personnalisation du téléphone Pour personnaliser votre téléphone IP Cisco Unified, définissez la sonnerie, le volume et d'autres paramètres. Ce chapitre contient les sections ci-dessous : • Personnalisation des sonneries et de l'indicateur de messages, page 63 • Personnalisation de l'écran du téléphone, page 64 Personnalisation des sonneries et de l'indicateur de messages Vous pouvez personnaliser la manière dont votre téléphone signale les appels entrants et les nouveaux messages vocaux. Vous pouvez également régler le volume de la sonnerie de votre téléphone Rubriques connexes Opérations de la page Web Options utilisateur, à la page 80 Paramètres de ligne sur le Web, à la page 90 Modifier la sonnerie Procédure Étape 1 Sélectionnez ( ) > Répertoires > Préférences utilisateur > Sonneries. Étape 2 Choisissez une ligne téléphonique ou la sonnerie par défaut. Étape 3 Sélectionnez une sonnerie pour en entendre un extrait. Étape 4 Pour définir la sonnerie, appuyez sur Sélectionner et sur Enregistrer. Sinon, appuyez sur Annuler. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 63 Régler le niveau de la sonnerie du téléphone Contactez votre administrateur système à propos des paramètres du volume minimum de sonnerie. Procédure Appuyez sur Volume lorsque le combiné est raccroché. Le nouveau volume de la sonnerie est enregistré automatiquement. Modifier le mode de fonctionnement du témoin de message vocal sur le combiné Procédure Étape 1 Connectez-vous à vos pages Web Options utilisateur. Étape 2 Choisissez Modifier la politique d'indicateur de messages en attente. Étape 3 Accédez à vos paramètres d'indicateur de message. La politique par défaut du système consiste généralement à indiquer les nouveaux messages vocaux via un témoin fixe sur la bande lumineuse du combiné. Modification de l'indicateur sonore du message vocal Procédure Étape 1 Connectez-vous à vos pages Web Options utilisateur. Étape 2 Accédez à vos paramètres d'indicateur de message. Personnalisation de l'écran du téléphone Vous pouvez modifier les paramètres de l'écran du téléphone. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 64 Personnalisation du téléphone Régler le niveau de la sonnerie du téléphone Modifier la luminosité de l'écran du téléphone Procédure Étape 1 Sélectionnez ( ) > Paramètres > Préférences utilisateur > Luminosité. Étape 2 Pour modifier les réglages, appuyez sur Volume. Étape 3 Appuyez sur Enregistrer ou sur Annuler. Si vous modifiez le réglage de luminosité de votre téléphone, ne débranchez pas le téléphone de l'alimentation électrique pendant au moins une minute, faute de quoi le nouveau réglage ne sera pas enregistré. Remarque Modifier la langue de l'écran du téléphone Procédure Étape 1 Connectez-vous à vos pages Web Options utilisateur. Étape 2 Accédez à vos paramètres des utilisateurs. Étape 3 Sélectionnez une langue. Changer le libellé de ligne Procédure Étape 1 Connectez-vous à vos pages Web Options utilisateur. Étape 2 Accédez à vos paramètres de libellé de ligne. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 65 Personnalisation du téléphone Modifier la luminosité de l'écran du téléphone Régler le contraste Procédure Étape 1 Sélectionnez ( ) > Paramètres > Préférences utilisateur > Contraste. Étape 2 Pour modifier les réglages, appuyez sur le bouton Volume. Étape 3 Appuyez sur Enregistrer ou sur Annuler. Paramètre du rétroéclairage Contactez votre administrateursystème pour la disponibilité de cette option. Cette fonction permet de désactiver le rétroéclairage pendant une durée prédéterminée (par votre administrateur système). Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 66 Personnalisation du téléphone Régler le contraste CHAPITRE 6 Journaux des appels et répertoires Cette section explique comment utiliser les journaux des appels et les répertoires. Pour accéder aux deux fonctions, utilisez le bouton Répertoires ( )Répertoires. • Journaux des appels, page 67 • Fonctions du répertoire, page 70 Journaux des appels Votre téléphone tient à jour des journaux des appels. Les journaux des appels contiennent des enregistrements des appels émis, reçus et en absence. L'administrateur de votre téléphone détermine si les appels en absence sont consignés dans votre répertoire Appels en absence pour une apparence de ligne donnée sur votre téléphone. Astuces • (Téléphones SCCP et SIP) Votre téléphone peut être configuré pour la consignation des appels internationaux, qui est indiquée par un symbole “+” danslesjournaux des appels, le rappel ou les entrées du répertoire des appels. Pour plus d'informations, contactez votre administrateur système. • (Téléphones SCCP uniquement) Pour afficher l'enregistrement d'appel complet d'un appel à plusieurs interlocuteurs (par exemple, d'un appel qui a été redirigé ou transféré sur votre poste), mettez en surbrillance l'enregistrement d'appel, puis appuyez sur Détails. L'enregistrement Détails affiche deux entrées pour chaque appel avec plusieurs interlocuteurs en absence ou reçu. Les entrées apparaissent dans l'ordre chronologique inverse : ◦ La première entrée enregistrée contient le nom ou le numéro du dernier appel avec plusieurs interlocuteurs terminé, reçu sur votre téléphone. ◦ La deuxième entrée enregistrée contient le nom ou le numéro du premier appel avec plusieurs interlocuteurs terminé, reçu sur votre téléphone. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 67 Affichage des journaux d'appels Procédure Sélectionnez ( ) > Répertoires > Appels en absence, Appels composés, ou Appels reçus. Chacun peut contenir jusqu'à 100 enregistrements. Affichage des détails d'un enregistrement d'appel donné Procédure Étape 1 Sélectionnez ( ) > Répertoires > Appels en absence, Appels composés ou Appels reçus. Étape 2 Mettez en surbrillance un enregistrement d'appel. Étape 3 Appuyez sur Détails. Les informations, telles que le numéro appelé, celui de l'appelant, l'heure de l'appel et sa durée (uniquement pour les appels émis et reçus) s'affichent. Effacer l'ensemble des enregistrements des appels de tous les journaux des appels Procédure Étape 1 Sélectionnez ( ) > Répertoires. Étape 2 Appuyez sur Effacer. Effacer tous les enregistrements des appels d'un journal spécifique Procédure Étape 1 Sélectionnez ( ) > Répertoires > Appels en absence, Appels composés, ou Appels reçus. Étape 2 Mettez en surbrillance un enregistrement d'appel. Étape 3 Appuyez sur Effacer. Il est possible que vous deviez au préalable appuyer sur la touche Autres pour afficher l'option Effacer. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 68 Journaux des appels et répertoires Affichage des journaux d'appels Effacer un seul enregistrement d'appel Procédure Étape 1 Sélectionnez ( ) > Répertoires > Appels en absence, Appels composés, ou Appels reçus. Étape 2 Mettez en surbrillance un enregistrement d'appel. Étape 3 Appuyez sur Supprimer. Composition d'un numéro à partir d'un journal des appels lorsqu'aucun autre appel n'est en cours Procédure Étape 1 Sélectionnez ( ) > Répertoires > Appels en absence, Appels composés ou Appels reçus. Étape 2 Mettez en surbrillance un enregistrement d'appel. Si la touche Détails s'affiche, l'appel représente l'entrée principale d'un appel à plusieurs interlocuteurs. Étape 3 Si vous devez modifier le numéro affiché, appuyez sur ModNum,, puis sur << ou sur >>. Étape 4 Pour supprimer le numéro, appuyez sur ModNum, puis sur Supprimer. Il est possible que vous deviez au préalable appuyer sur la touche Autres pour afficher l'option Supprimer. Étape 5 Pour passer l'appel, décrochez le combiné. Composition d'un numéro à partir d'un journal des appels avec un autre appel en cours Procédure Étape 1 Sélectionnez ( ) > Répertoires > Appels en absence, Appels composés ou Appels reçus. Étape 2 Mettez en surbrillance un enregistrement d'appel. Si la touche Détails s'affiche, l'appel représente l'entrée principale d'un appel à plusieurs interlocuteurs. Remarque Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 69 Journaux des appels et répertoires Effacer un seul enregistrement d'appel Étape 3 Si vous devez modifier le numéro affiché, appuyez sur ModNum,, puis sur << ou sur >>. Étape 4 Pour supprimer le numéro, appuyez sur ModNum, puis sur Supprimer. Il est possible que vous deviez au préalable appuyer sur la touche Autres pour afficher l'option Supprimer. Étape 5 Appuyez sur Composer. Étape 6 Choisissez une option de menu pour traiter l'appel initial. a) Attente : met le premier appel en attente et compose le second. b) Transfert : transfère le premier interlocuteur vers le second et vous déconnecte de l'appel. Appuyez de nouveau sur après avoir composé le numéro pour terminer l'opération. c) Conférence : établit une conférence entre tous les interlocuteurs, vous compris. Appuyez de nouveau sur ( ) après avoir composé le numéro pour terminer l'opération. d) FinApp : déconnecte le premier appel et compose le second. Recomposer un numéro international à partir des journaux des appels reçus et en absence. Procédure Étape 1 Sélectionnez ( ) > Répertoires > Appels en absence ou Appels reçus. Étape 2 Mettez en surbrillance l'enregistrement de l'appel que vous voulez recomposer. Si la touche Détails s'affiche, l'appel représente l'entrée principale d'un appel à plusieurs interlocuteurs. Étape 3 Appuyez sur ModNum. Étape 4 Maintenez la touche “*” enfoncée pendant au moins 1 seconde pour ajouter le signe “+” devant un numéro de téléphone. Le signe + ne peut être placé qu'au début du numéro. Étape 5 Appuyez sur Composer. Fonctions du répertoire En fonction de la configuration de votre téléphone, celui-ci dispose peut-être de fonctions de répertoire d'entreprise et personnel. • Répertoire d'entreprise : contacts d'entreprise auxquels vous pouvez accéder depuis votre téléphone. Il est configuré et géré par votre administrateur système. • Répertoire personnel : il s'agit, le cas échéant, de contacts personnels et de codes de numérotation simplifiée associés que vous pouvez configurer et auxquels vous pouvez accéder à partir de votre téléphone et de vos pages Web Options utilisateur Cisco Unified Communications Manager. Le répertoire personnel comprend le carnet d'adresses personnel et les numéros simplifiés : Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 70 Journaux des appels et répertoires Recomposer un numéro international à partir des journaux des appels reçus et en absence. ◦ Le carnet d'adresses personnel est un répertoire qui contient vos contacts personnels. ◦ Les numéros simplifiés sont des codes affectés aux entrées du carnet d'adresses personnel et permettent de composer les numéros rapidement. Répertoire d'entreprise Le répertoire d'entreprise permet d'émettre des appels à destination de vos collègues. Astuce Utilisez le clavier pour saisir des caractères sur l'écran du téléphone. Utilisez le bouton denavigationde votre téléphone pour passer d'un champ de saisie à un autre. Composition d'un numéro à partir d'un répertoire d'entreprise lorsqu'aucun autre appel n'est en cours Procédure Étape 1 Sélectionnez ( ) > Répertoires > Répertoire d'entreprise (le nom exact de ce service peut varier). Étape 2 Utilisez votre clavier pour saisir un nom entier ou partiel, puis appuyez sur Rechercher. Étape 3 Pour composer un numéro, sélectionnez ou recherchez une entrée dans la liste, puis décrochez le téléphone. Composition un numéro à partir d'un répertoire d'entreprise avec un appel en cours Procédure Étape 1 Sélectionnez ( ) > Répertoires > Répertoire d'entreprise (le nom exact de ce service peut varier). Étape 2 Utilisez votre clavier pour saisir un nom entier ou partiel, puis appuyez sur Rechercher. Étape 3 Accédez à une entrée, puis appuyez sur Composer. Étape 4 Choisissez une option de menu pour traiter l'appel initial. a) Attente : met le premier appel en attente et compose le second. b) Transfert : transfère le premier interlocuteur vers le second et vous déconnecte de l'appel. Appuyez de nouveau sur après avoir composé le numéro pour terminer l'opération. c) Conférence : établit une conférence entre tous les interlocuteurs, vous compris. Appuyez de nouveau sur ( ) après avoir composé le numéro pour terminer l'opération. d) FinApp : déconnecte le premier appel et compose le second. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 71 Journaux des appels et répertoires Répertoire d'entreprise Répertoire personnel Le répertoire personnel comprend le carnet d'adresses personnel et les numéros rapides. Cette section explique comment configurer et utiliser le répertoire personnel sur votre téléphone. Vous pouvez également vous reporter à la section Répertoire personnel sur le Web, à la page 81. Astuces • L'administrateur système peut vous fournir l'ID utilisateur et le PIN nécessaires pour vous connecter au répertoire personnel. • Le répertoire personnel vous déconnecte automatiquement au bout d'un certain temps. Ce délai est variable. Pour plus d'informations, contactez votre administrateur système. • Utilisez le pavé numérique pour saisir des caractères sur l'écran du téléphone. Utilisez le bouton de navigation de votre téléphone pour passer d'un champ de saisie à un autre. • Votre téléphone peut être configuré pour la journalisation des appels internationaux, ce qui est indiqué par un symbole “+” dans les journaux des appels, les rappels ou les entrées du répertoire des appels. Pour plus d'informations, contactez votre administrateur système. Accéder au répertoire personnel pour le carnet d'adresses personnel et les codes de numérotation rapide Procédure Étape 1 Sélectionnez ( ) > Répertoires > Pépertoire personnel (le nom exact de ce service peut varier). Étape 2 Saisissez votre ID utilisateur Cisco Unified Communications Manager et votre PIN, puis appuyez sur Soum. Recherche d'une entrée du carnet d'adresses personnel Procédure Étape 1 Accédez à Répertoire personnel. Étape 2 sélectionnez carnet d'adresses personnel. Étape 3 Saisissez les critères de recherche, puis appuyez sur Soumettre. Étape 4 Parcourez les entrées à l'aide de Précédent et de Suivant. Étape 5 Mettez en surbrillance l'entrée du carnet d'adresses personnel souhaitée, puis appuyez sur Sélectionner. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 72 Journaux des appels et répertoires Répertoire personnel Composition d'un numéro à partir d'une entrée du carnet d'adresses personnel Procédure Étape 1 Recherchez une entrée. Étape 2 Mettez l'entrée en surbrillance, puis appuyez sur Sélectionner. Étape 3 Appuyez sur Composer. Il est possible que vous deviez au préalable appuyer sur la touche Autres pour afficher l'option Composer. Supprimer une entrée du carnet d'adresses personnel Procédure Étape 1 Recherchez une entrée. Étape 2 Mettez l'entrée en surbrillance, puis appuyez sur Supprimer. Étape 3 Appuyez sur Modifier. Étape 4 Appuyez sur Supprimer. Étape 5 Choisissez OK pour confirmer la suppression. Modifier une entrée du carnet d'adresses personnel Procédure Étape 1 Recherchez une entrée. Étape 2 Mettez l'entrée en surbrillance, puis appuyez sur Sélectionner. Étape 3 Pour modifier un nom ou une adresse e-mail, appuyez sur Modifier. Étape 4 Le cas échéant, sélectionnez Téléphone pour modifier un numéro de téléphone. Étape 5 Appuyez sur MàJ. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 73 Journaux des appels et répertoires Répertoire personnel Ajout d'une entrée au carnet d'adresses personnel Procédure Étape 1 Accédez à Répertoire personnel. Étape 2 Sélectionnez Carnet d'adresses personnel. Étape 3 Appuyez sur Soumettre pour accéder à la page Rechercher. Il n'est pas nécessaire de commencer par saisir les informations de recherche. Étape 4 Appuyez sur Nouveau. Étape 5 Utilisez le clavier de votre téléphone pour saisir un nom et un e-mail. Étape 6 Sélectionnez Téléphones et utilisez le clavier pour saisir des numéros de téléphone. N'oubliez pas d'inclure les codes d'accès nécessaires, tels que 9 ou 1. Étape 7 Sélectionnez Soumettre pour ajouter l'entrée à la base de données. Ajouter un nouveau code de numérotation simplifiée sans utiliser d'entrée du carnet d'adresses personnel Procédure Étape 1 Appuyez sur , puis sélectionnez Répertoires > Répertoire personnel > Numéros simplifiés personnels. Étape 2 Mettez en surbrillance un code de numérotation simplifiée non affecté, puis appuyez sur Affecter. Étape 3 Saisissez un numéro de téléphone. Étape 4 Appuyez sur MàJ. Rechercher des codes de numérotation simplifiée Procédure Étape 1 Sélectionnez ( ) > Répertoires > Répertoire personnel > Numéros simplifiés personnels. Étape 2 Sélectionnez Suivant pour parcourir les entrées. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 74 Journaux des appels et répertoires Répertoire personnel Passage d'un appel à l'aide de la numérotation rapide Procédure Étape 1 Recherchez le code de numérotation rapide. Étape 2 Appuyez sur Composer. Supprimer un code de numérotation rapide Procédure Étape 1 Recherchez le code de numérotation rapide. Étape 2 Mettez en surbrillance l'entrée souhaitée, puis appuyez sur Supprimer. Étape 3 Appuyez de nouveau sur Supprimer. Se déconnecter du répertoire personnel Procédure Étape 1 Sélectionnez ( ) > Répertoires > Répertoire personnel (le nom exact de l'option peut varier). Étape 2 Sélectionnez Déconn. Étape 3 Appuyez sur OK. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 75 Journaux des appels et répertoires Répertoire personnel Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 76 Journaux des appels et répertoires Répertoire personnel CHAPITRE 7 Messages vocaux Pour accéder aux messages vocaux, utilisez le bouton Messages ( ) > Messages. Votre société détermine le service de messagerie vocale utilisé par votre système téléphonique. Pour plus d'informations précises et détaillées sur ce service, reportez-vous à la documentation correspondante. Ce chapitre contient les sections ci-dessous : • Identification du message vocal, page 77 • Configurer le service de messagerie vocale, page 78 • Écouter des messages vocaux ou accéder au système de messagerie vocale, page 78 Identification du message vocal Lorsque vous avez un message vocal, recherchez : • Un témoin lumineux rouge fixe sur votre combiné. Cet indicateur peut varier. Reportez-vous à Personnalisation des sonneries et de l'indicateur de messages, à la page 63. • Une icône de message en attente et un message sur l'écran du téléphone. Le témoin lumineux rouge et l'icône de message en attente ne s'affichent que lorsque vous avez un message sur votre ligne principale, même si vous recevez des messages vocaux sur d'autres lignes. Lorsque vous avez un message vocal, attendez : • Une tonalité accélérée dans le combiné, dans le casque ou dans le haut-parleur lorsque vous émettez un appel. La tonalité accélérée est propre à la ligne. Vous ne l'entendez que si vous utilisez la ligne associée au message en attente. Pour diriger un appel directement sur la messagerie vocale, appuyez sur Rvoi Im. Pour plus d'informations, reportez-vous à Transfert de l'appel vers le système de messagerie vocale, à la page 29. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 77 Configurer le service de messagerie vocale Procédure Étape 1 Appuyez sur ( ) > Messages, puis suivez les instructions vocales. Étape 2 Si un menu apparaît sur l'écran du téléphone, sélectionnez une option de menu appropriée. Écouter des messages vocaux ou accéder au système de messagerie vocale Lorsque vous vous connectez à un service de messagerie vocale, la ligne associée à un message vocal est sélectionnée par défaut.Si plusieurslignes comportent un message vocal, la première disponible estsélectionnée. Contactez votre administrateur concernant les options afin que le système se connecte toujours au service de messagerie vocale sur la ligne principale. Procédure Étape 1 Appuyez sur . En fonction de votre service de messagerie vocale, cette opération permet de composer automatiquement le numéro du service de messagerie ou d'afficher un menu sur l'écran tactile. Étape 2 Si un menu s'affiche, sélectionnez l'option de menu. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 78 Messages vocaux Configurer le service de messagerie vocale CHAPITRE 8 Pages Web Options utilisateur Votre téléphone IP Cisco Unified est un périphérique réseau qui peut partager des informations avec les autres périphériques du réseau de votre entreprise, notamment votre ordinateur. Vous pouvez utiliser votre ordinateur pour vous connecter à vos pages Web Options utilisateur Cisco Unified Communications Manager, depuis lesquelles vous pouvez contrôler les fonctions, les paramètres et les services de votre téléphone IP Cisco Unified. Par exemple, vous pouvez configurer les boutons de numérotation rapide depuis les pages Web Options utilisateur. Ce chapitre contient les sections ci-dessous : • Connexion et déconnexion des pages Web Options utilisateur, page 79 • Sélection d'un périphérique depuis la page Web Options utilisateur, page 80 • Opérations de la page Web Options utilisateur, page 80 • Configuration des fonctions et des systèmes sur le Web, page 80 Connexion et déconnexion des pages Web Options utilisateur Pour pouvoir accéder à vos options utilisateur, par exemple à la numérotation simplifiée ou au carnet d'adresses personnel, vous devez vous connecter. Une fois que vous avez terminé d'utiliser les pages Web Options utilisateur, vous devez vous déconnecter. Dans certains cas, vous pouvez accéder à vos pages Web Options utilisateur sans devoir vous connecter. Pour plus d'informations, contactez votre administrateur système. Procédure Étape 1 Demandez à votre administrateur système de vous fournir l'URL, un ID utilisateur et un mot de passe par défaut pour vos Options utilisateur. Étape 2 Ouvrez un navigateur Web sur votre ordinateur, puis saisissez l'URL. Étape 3 Si vous êtes invité à accepter les paramètres de sécurité, sélectionnez Oui ou Installer le certificat. Étape 4 Dans le champ Nom d'utilisateur, saisissez votre ID utilisateur. Étape 5 Dans le champ Mot de passe, saisissez votre mot de passe. Étape 6 Sélectionnez Connexion. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 79 La page d'accueil Options utilisateur Cisco Unified CM s'affiche. Dans cette page, vous pouvez sélectionner Options utilisateur pour choisir un périphérique, mais aussi accéder aux paramètres des utilisateurs, aux fonctions de répertoire, à votre carnet d'adresses personnel et aux numéros simplifiés. Étape 7 Pour vous déconnecter des pages Web Options utilisateur, sélectionnez Déconnexion. Sélection d'un périphérique depuis la page Web Options utilisateur Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Périphérique. La fenêtre Configuration du périphérique s'affiche. Les boutonssituéssur la barre d'outils en haut de la fenêtre Configuration du périphérique sont propres au type de périphérique sélectionné. Étape 2 (facultatif) Si plusieurs périphériques vous sont affectés, sélectionnez le périphérique approprié (modèle de téléphone, profil Extension Mobility ou profil de destination distante) dans le menu déroulant Nom. Opérations de la page Web Options utilisateur Cette section explique comment vous connecter et sélectionner un périphérique de téléphonie. Sélectionner une option de configuration Procédure Étape 1 Après vous être connecté à vos pages Web Options utilisateur, sélectionnez Options utilisateur pour accéder aux paramètres des utilisateurs, au répertoire, au carnet d'adresses personnel, aux numéros simplifiés et aux paramètres de mobilité. Étape 2 Pour revenir à la page Configuration du périphérique depuis une autre page, sélectionnez Optionsutilisateur > Périphérique. Configuration des fonctions et des systèmes sur le Web Les rubriques de cette section vous expliquent comment configurer les fonctions et les services depuis de vos pages Web Options utilisateur après vous y être connecté. Reportez-vous à Opérations de la page Web Options utilisateur, à la page 80. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 80 Pages Web Options utilisateur Sélection d'un périphérique depuis la page Web Options utilisateur Répertoire personnel sur le Web Le répertoire personnel sur le Web est composé de : • Carnet d'adresses personnel (PAB, Personal Address Book) • Numéros rapides • Outil de synchronisation du carnet d'adresses Cisco Unified Communications Manager. Vous pouvez également accéder au carnet d'adresses personnel et aux numérosrapides depuis votre téléphone. Reportez-vous à Répertoire personnel, à la page 72. Cette section explique comment utiliser le carnet d'adresses personnel depuisles pages Web Options utilisateur. Ajout d'une nouvelle entrée au carnet d'adresses personnel Procédure Étape 1 Depuis votre page Web Options utilisateur,sélectionnez Optionsutilisateur > Carnetd'adressespersonnel. Étape 2 Sélectionnez Ajouter un nouveau. Étape 3 Saisissez les informations de l'entrée. Étape 4 Sélectionnez Enregistrer. Recherche d'une entrée du carnet d'adresses personnel Procédure Étape 1 Depuis votre page Web Options utilisateur,sélectionnez Optionsutilisateur > Carnetd'adressespersonnel. Étape 2 Spécifiez les informations de recherche, puis sélectionnez Rechercher. Modification d'une entrée du carnet d'adresses personnel Procédure Étape 1 Connectez-vous à la page Web Options utilisateur. Étape 2 Recherchez une entrée dans le carnet d'adresses personnel. Étape 3 Sélectionnez un pseudonyme. Étape 4 Modifiez l'entrée si nécessaire, puis sélectionnez Enregistrer. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 81 Pages Web Options utilisateur Répertoire personnel sur le Web Suppression d'une entrée du carnet d'adresses personnel Procédure Étape 1 Connectez-vous à la page Web Options utilisateur. Étape 2 Recherchez une entrée dans le carnet d'adresses personnel. Étape 3 Sélectionnez une ou plusieurs entrées. Étape 4 Sélectionnez Supprimer la sélection. Affecter un bouton de ligne à votre carnet d'adresses personnel Pour que vous puissiez affecter un bouton de ligne à votre carnet d'adresses personnel, votre administrateur système doit configurer le téléphone pour l'affichage des services. Pour plus d'informations, contactez votre administrateur système. Remarque Procédure Étape 1 Sélectionnez Options utilisateur > Périphérique. Étape 2 Cliquez sur URL de service. Étape 3 Sélectionnez le service Carnet d'adresses personnel dans la liste déroulante des boutons. Étape 4 Saisissez une étiquette de téléphone pour le bouton. Étape 5 Cliquez sur Enregistrer. Étape 6 Cliquez sur Réinitialiser, puis sur Redémarrer pour actualiser la configuration du téléphone. Vous pouvez maintenant appuyersur le bouton de ligne pour accéder aux codes du carnet d'adresses personnel. Outil de synchronisation du carnet d'adresses Vous pouvez utiliser l'outil de synchronisation du carnet d'adresses (SynchCA) pour synchroniser votre carnet d'adresses Microsoft Windows existant (le cas échéant) avec votre carnet d'adresses personnel. À partir d'une application Microsoft Windows application : Utilisez l'outil de synchronisation du carnet d'adresses(SynchCA) poursynchroniser votre carnet d'adresses personnel avec votre carnet d'adresse Microsoft Windows (WAB). Si vous voulez utiliser le carnet d'adresses Microsoft Outlook (OAB), vous devez d'abord importer les données de ce carnet d'adresses vers le carnet d'adresses Windows (WAB). La fonctionSynchCA peut alors être utilisée pour synchroniser le carnet d'adresses Windows avec votre carnet d'adresses personnel. Votre administrateur système peut vous donner accès à l'outil SynchCA et vous fournir des instructions détaillées. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 82 Pages Web Options utilisateur Répertoire personnel sur le Web Paramétrage de la numérotation rapide Dans la page Web Options utilisateur, vous pouvez ajouter, supprimer ou mettre à jour des entrées de numéros rapides. Vous pouvez créer jusqu'à 500 entrées de numéros rapides et de carnet d'adresses personnel. Vous pouvez créer une nouvelle entrée de numérotation rapide sans utiliser d'entrée du carnet d'adresses personnel. Ces entrées de numéros rapides sont répertoriées comme “brutes” dans les pages Web Options utilisateur et n'affichent pas d'étiquette de texte configurable. Affectation d'un code de numérotation rapide à une entrée du carnet d'adresses personnel Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Numéros rapides. Étape 2 Sélectionnez Ajouter un nouveau. Étape 3 Utilisez la zone Options de recherche pour rechercher l'entrée souhaitée dans le carnet d'adresses personnel. Étape 4 Dans la zone Résultats de la recherche, sélectionnez un numéro de téléphone. Étape 5 (facultatif) Changez le code de numérotation rapide. Étape 6 Sélectionnez Enregistrer. Affectation d'un code de numérotation rapide au numéro de téléphone sans entrée du carnet d'adresses personnel Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Numéros rapides. Étape 2 Sélectionnez Ajouter un nouveau. Étape 3 (facultatif) Changez le code de numérotation rapide. Étape 4 Saisissez un numéro de téléphone. Étape 5 Sélectionnez Enregistrer. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 83 Pages Web Options utilisateur Paramétrage de la numérotation rapide Recherche d'une entrée de numérotation rapide Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Numéros rapides. Étape 2 Spécifiez les informations de recherche, puis sélectionnez Rechercher. Modifier un numéro de téléphone correspondant à un numéro rapide Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Numéros rapides. Étape 2 Recherchez l'entrée de numérotation rapide à modifier. Étape 3 Sélectionnez un composant de l'entrée. Étape 4 Modifiez le numéro de téléphone. Étape 5 Sélectionnez Enregistrer. Supprimer un numéro rapide du carnet d'adresses personnel Procédure Étape 1 Depuis votre page Web Options utilisateur, recherchez une entrée de numérotation rapide. Étape 2 Sélectionnez une ou plusieurs entrées. Étape 3 Sélectionnez Supprimer la sélection. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 84 Pages Web Options utilisateur Paramétrage de la numérotation rapide Affectation d'une touche de fonction pour la numérotation rapide Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Périphérique. Étape 2 Sélectionnez l'URL de service fournie par votre administrateur système. Étape 3 Sélectionnez le service Numérotation rapide dans la liste déroulante des boutons. Étape 4 Saisissez une étiquette de téléphone pour le bouton. Étape 5 Sélectionnez Enregistrer. Étape 6 Sélectionnez Réinitialiser, puis sélectionnez Redémarrer pour actualiser la configuration du téléphone. Configuration de la numérotation simplifiée sur le Web En fonction de sa configuration, votre téléphone peut prendre en charge plusieurs fonctions de numérotation simplifiée : • Boutons de numérotation simplifiée • Numérotation abrégée • Numéros rapides Pour obtenir de l'aide sur l'utilisation des fonctions de numérotation simplifiée, reportez-vous à Numérotation simplifiée, à la page 40. Configuration des boutons de numérotation simplifiée Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Périphérique. Étape 2 Sélectionnez un téléphone dans le menu déroulant Nom. Étape 3 Sélectionnez Numérotations simplifiées. Étape 4 Dans la zone Paramètres de numérotation simplifiée, saisissez un numéro et un libellé pour un bouton de numérotation simplifiée sur votre téléphone. Étape 5 Sélectionnez Enregistrer. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 85 Pages Web Options utilisateur Configuration de la numérotation simplifiée sur le Web Configurer des codes de numérotation abrégée Procédure Étape 1 Sélectionnez Options utilisateur > Périphérique. Étape 2 Sélectionnez un téléphone dans le menu déroulant Nom. Étape 3 Cliquez sur Numérotations simplifiées. Étape 4 Saisissez le numéro et le libellé d'un code de numérotation abrégée. Étape 5 Cliquez sur Enregistrer. Configuration du service téléphonique sur le Web Les services téléphoniques peuvent inclure des fonctions spéciales, des données du réseau et des informations basées sur le Web (par exemple, les cours de la bourse ou les programmes de cinéma). Vous devez vous abonner à un service téléphonique pour y accéder depuis votre téléphone. Utilisez les boutons de ligne pour sélectionner les menus Services, Messages et Répertoires. • ( ) > Services • ( ) > Messages • ( ) > Répertoires Si un seul service est configuré, ce service s'ouvre par défaut. Si plusieurs services sont configurés, sélectionnez une option du menu à l'écran. Les services disponibles sur votre téléphone dépendent de la configuration du système téléphonique et des services auxquels vous êtes abonné.Pour plus d'informations, contactez votre administrateur système. Remarque Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 86 Pages Web Options utilisateur Configuration du service téléphonique sur le Web S'abonner à un service Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Périphérique. Étape 2 Sélectionnez un téléphone dans le menu déroulant Nom. Étape 3 Sélectionnez Services téléphoniques. Étape 4 Sélectionnez Ajouter un nouveau. Étape 5 Sélectionnez un service dans la liste déroulante, puis sélectionnez Suivant. Étape 6 (facultatif) Changez l'intitulé du service ou saisissez des informations supplémentaires sur le service, le cas échéant. Étape 7 Sélectionnez Enregistrer. Recherche de services Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez un périphérique. Étape 2 Sélectionnez Services téléphoniques. Étape 3 Sélectionnez Rechercher. Modification ou résiliation de services Procédure Étape 1 Depuis votre page Web Options utilisateur, recherchez les services. Étape 2 Sélectionnez une ou plusieurs entrées. Étape 3 Sélectionnez Supprimer la sélection. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 87 Pages Web Options utilisateur Configuration du service téléphonique sur le Web Modification du nom de service Procédure Étape 1 Depuis votre page Web Options utilisateur, recherchez les services. Étape 2 Sélectionnez un nom de service. Étape 3 Modifiez les informations, puis sélectionnez Enregistrer. Ajout de service au bouton de fonction programmable Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Périphérique. Étape 2 Sélectionnez un téléphone dans le menu déroulant Nom. Étape 3 Sélectionnez URL de service. Votre administrateur système configure un bouton d'URL de service pour votre téléphone. Étape 4 Sélectionnez un service dans la liste déroulante Bouton Service. Étape 5 (facultatif) Si vous voulez renommer le service, modifiez les champs d'étiquette. Si votre téléphone ne prend pas en charge les jeux de caractères à deux octets, il utilise des champs Étiquette ASCII. Étape 6 Sélectionnez Enregistrer. Étape 7 Sélectionnez Réinitialiser pour réinitialiser votre téléphone afin que la nouvelle étiquette du bouton s'affiche sur votre téléphone. Paramètres des utilisateurs Les paramètres des utilisateurs incluent votre mot de passe, votrePIN et votre langue (paramètres régionaux). Astuce Votre PIN et votre mot de passe permettent d'accéder à plusieurs fonctions et services. Par exemple, utilisez votre PIN pour vous connecter au service Cisco Extension Mobility ou au répertoire personnel de votre téléphone. Utilisez votre mot de passe pour vous connecter à vos pages Web Options utilisateur et à Cisco WebDialer depuis votre ordinateur. Pour plus d'informations, contactez votre administrateur système. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 88 Pages Web Options utilisateur Paramètres des utilisateurs Modification du mot de passe du navigateur Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Paramètres des utilisateurs. Étape 2 Saisissez votre mot de passe actuel. Étape 3 Saisissez votre nouveau mot de passe. Étape 4 Dans le champ Confirmer le mot de passe, saisissez une nouvelle fois votre nouveau mot de passe. Étape 5 Sélectionnez Enregistrer. Changer le PIN Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Paramètres des utilisateurs. Étape 2 Saisissez votre PIN actuel. Étape 3 Saisissez votre nouveau PIN. Étape 4 Dans le champ Confirmer le PIN, saisissez une nouvelle fois votre nouveau PIN. Étape 5 Sélectionnez Enregistrer. Modification de la langue des options utilisateur Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Paramètres des utilisateurs. Étape 2 Dans la zone Langue utilisateur, choisissez une option dans la liste déroulante Langue. Étape 3 Sélectionnez Enregistrer. Modification de la langue de l'écran du téléphone Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Périphérique. Étape 2 Sélectionnez une option dans la liste déroulante Langue utilisateur. Étape 3 Sélectionnez Enregistrer. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 89 Pages Web Options utilisateur Paramètres des utilisateurs Paramètres de ligne sur le Web Les paramètres de ligne ont une incidence sur une ligne (numéro d'annuaire) spécifique de votre téléphone. Les paramètres de ligne peuvent inclure le renvoi d'appels, les indicateurs de message vocal, les modèles de sonneries et les libellés de ligne. Vous pouvez configurer d'autres paramètres de ligne directement sur votre téléphone : • Configurer le renvoi d'appels sur votre ligne téléphonique principale : voir Renvoi d'appels, à la page 30. • Modifier les sonneries, l'affichage et d'autres paramètres spécifiques au modèle de téléphone : voir Personnalisation du téléphone, à la page 63. Configurer le renvoi d'appels par ligne Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Périphérique. Étape 2 Sélectionnez un téléphone dans le menu déroulant Nom. Étape 3 Sélectionnez Paramètres de ligne. Étape 4 Si plusieurs numéros d'annuaire (lignes) sont affectés à votre téléphone, sélectionnez une ligne dans le menu déroulant Ligne. Étape 5 Dans la zone Transfert des appels entrants, sélectionnez les paramètres de renvoi d'appels correspondant aux différentes situations. Étape 6 Sélectionnez Enregistrer. Modification du paramètre d'indicateur de message vocal par ligne Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Périphérique. Étape 2 Sélectionnez un téléphone dans le menu déroulant Nom. Étape 3 Sélectionnez Paramètres de ligne. Étape 4 (facultatif) Si plusieurs numéros d'annuaire (lignes) sont affectés à votre téléphone, sélectionnez une ligne dans le menu déroulant Ligne. Étape 5 Dans la zone Indicateur de messages en attente, choisissez parmi les différents paramètres. Généralement, le paramètre par défaut de messages en attente invite votre téléphone à afficher un témoin lumineux rouge fixe sur la bande lumineuse du combiné pour signaler la présence d'un nouveau message vocal. Étape 6 Sélectionnez Enregistrer. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 90 Pages Web Options utilisateur Paramètres de ligne sur le Web Modification du paramètre d'indicateur de message vocal audible par ligne Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Périphérique. Étape 2 Sélectionnez un téléphone dans le menu déroulant Nom. Étape 3 Sélectionnez Paramètres de ligne. Étape 4 Si plusieurs numéros d'annuaire (lignes) sont affectés à votre téléphone, sélectionnez une ligne dans le menu déroulant Ligne. Étape 5 Dans la zone Indicateur de message vocal en attente, choisissez le paramètre souhaité. Étape 6 Sélectionnez Enregistrer. Modification du libellé de ligne pour l'écran du téléphone Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Périphérique. Étape 2 Sélectionnez un téléphone dans le menu déroulant Nom. Étape 3 Sélectionnez Paramètres de ligne. Étape 4 Si plusieurs numéros d'annuaire (lignes) sont affectés à votre téléphone, sélectionnez une ligne dans le menu déroulant Ligne. Étape 5 Dans la zone Libellé de ligne, saisissez un libellé. Étape 6 Sélectionnez Enregistrer. Téléphone et liste d'accès pour Mobile Connect Vous devez ajouter votre téléphone portable (et tous les autres téléphones que vous utilisez) à Cisco Mobile Connect avant de pouvoir passer et recevoir des appels avec les mêmes numéros de répertoire que votre téléphone de bureau. Ces téléphones sont appelés destinations distantes. Vous pouvez également définir des listes d'accès pour interdire ou pour autoriser l'envoi sur votre téléphone portable des appels de certains numéros. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 91 Pages Web Options utilisateur Téléphone et liste d'accès pour Mobile Connect Création d'une liste d'accès Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Paramètres de mobilité > Listes d'accès. Étape 2 Sélectionnez Ajouter un nouveau. Étape 3 (facultatif) Saisissez un nom pour identifier la liste d'accès et donnez une description. Étape 4 Indiquez si la liste d'accès autorise ou bloque les appels indiqués. Étape 5 Sélectionnez Enregistrer. Étape 6 Sélectionnez Ajouter un membre pour ajouter des numéros de téléphone ou des filtres à la liste. Étape 7 Sélectionnez une option dans la liste déroulante Masque de filtre. Vous pouvez filtrer un numéro d'annuaire ou les appels dont l'ID de l'appelant est restreint (Non disponible) ou anonyme (Confidentiel). Étape 8 Si vous sélectionnez un numéro d'annuaire dans la liste déroulante Masque de filtre, saisissez un numéro de téléphone ou un filtre dans le champ Masque NR. Pour définir un filtre, vous pouvez utiliser les caractères génériques ci-dessous : X (majuscule ou minuscule) Remplace un seul chiffre.Par exemple, 408555123X correspond aux numéros compris entre 4085551230 et 4085551239. ! Remplace un nombre indéfini de chiffres. Par exemple, 408! correspond à n'importe quel numéro qui commence par 408. # Remplace un chiffre pour créer une correspondance exacte. Étape 9 Pour ajouter ce membre à la liste d'accès, sélectionnez Enregistrer. Étape 10 Pour enregistrer la liste d'accès, sélectionnez Enregistrer. Ajout d'une nouvelle destination distante Procédure Étape 1 Depuis votre page Web Options utilisateur, sélectionnez Options utilisateur > Paramètres de mobilité > Destinations distantes. Étape 2 Sélectionnez Ajouter un nouveau. Étape 3 Saisissez les informations ci-dessous : Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 92 Pages Web Options utilisateur Téléphone et liste d'accès pour Mobile Connect • Nom : donnez un nom au téléphone portable (ou autre). • Numéro de destination : saisissez votre numéro de téléphone portable. Étape 4 Sélectionnez votre profil de destination distante dans la liste déroulante. Votre profil de destination distante contient les paramètres qui s'appliquent aux destinations distantes que vous créez. Étape 5 Cochez la case Téléphone portable pour autoriser votre destination distante à accepter un appel envoyé depuis votre téléphone de bureau. Étape 6 Cochez la case Activer Mobile Connect pour autoriser votre destination distante à sonner en même temps que votre téléphone de bureau. Étape 7 Sélectionnez l'une des options ci-dessous dans la zone Calendrier des appels : • En permanence : sélectionnez cette option si vous ne voulez pas appliquer de restriction de jour et d'heure pour faire sonner la destination distante. • Comme spécifié ci-dessous: choisissez cette option, puissélectionnez l'une des options ci-dessous pour définir un calendrier des appels en fonction du jour et de l'heure. ◦ Cochez les cases correspondant aux jours de la semaine au cours desquels les appels peuvent faire sonner la destination distante. ◦ Pour chaque jour, sélectionnez Toute la journée ou sélectionnez les heures de début et de fin dans les listes déroulantes. ◦ Sélectionnez le fuseau horaire dans la liste déroulante. Les listes déroulantes du calendrier des appels ne contiennent que les listes d'accès que vous avez créées. Étape 8 Sélectionnez l'une de ces options de sonnerie : • Toujours faire sonner cette destination. • Faire sonner cette destination seulement si l'appelant fait partie de la liste d'accès autorisée sélectionnée. • Ne pas faire sonner cette destination si l'appelant fait partie de la liste d'accès bloquée sélectionnée. Étape 9 Sélectionnez Enregistrer. Cisco WebDialer Cisco WebDialer permet de passer des appels depuis votre téléphone IP Cisco Unified vers des contacts du répertoire via un clic sur des éléments dans un navigateur Web. Votre administrateur système configure cette fonction à votre place. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 93 Pages Web Options utilisateur Cisco WebDialer Utiliser WebDialer avec le répertoire Options utilisateur Procédure Étape 1 Connectez-vous à vos pages Web Options utilisateur. Étape 2 Sélectionnez Options utilisateur > Répertoire, puis recherchez un collègue. Étape 3 Cliquez sur le numéro à composer. Étape 4 Si vous utilisez WebDialer pour la première fois, configurez les préférences dans la page Passage d'un appel. Étape 5 Cliquez sur Composer. Votre téléphone émet l'appel. Étape 6 Pour mettre fin à un appel, cliquez sur Raccrocher ou raccrochez votre téléphone. Utiliser WebDialer avec un autre répertoire d'entreprise en ligne (au lieu du répertoire Options utilisateur) Procédure Étape 1 Connectez-vous à un répertoire d'entreprise compatible WebDialer, puis recherchez des collègues. Étape 2 Cliquez sur le numéro à composer. Étape 3 Lorsque vous y êtes invité, saisissez votre ID utilisateur et votre mot de passe. Étape 4 Si vous utilisez WebDialer pour la première fois, configurez les préférences dans la page Passage d'un appel. Étape 5 Cliquez sur Composer. Votre téléphone émet l'appel. Étape 6 Pour mettre fin à un appel, cliquez sur Raccrocher ou raccrochez votre téléphone. Vous déconnecter de WebDialer Procédure Cliquez sur l'icône Déconnexion dans la page Passage d'un appel ou dans la page Raccrocher. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 94 Pages Web Options utilisateur Cisco WebDialer Configuration, affichage ou modification des préférences de WebDialer Procédure Étape 1 Accédez à la page Passage d'un appel. La page Passage d'un appel s'affiche lorsque vous utilisez WebDialer pour la première fois (après la sélection du numéro à composer). Étape 2 (facultatif) Modifiez vos paramètres. La page Passage d'un appel contient les options ci-dessous : • Langue souhaitée : détermine la langue utilisée pour les paramètres et les invites de WebDialer. • Utilisez le périphérique de votre choix : identifie le téléphone IP Cisco Unified (périphérique qui appelle) et le numéro d'annuaire (ligne qui appelle) que vous allez utiliser pour passer des appels WebDialer. Si votre téléphone dispose d'une seule ligne, ce téléphone et cette ligne sontsélectionnés automatiquement. Sinon, choisissez un téléphone ou une ligne. Si vous avez plusieurs téléphones, l'appareil sera spécifié par type de périphérique et adresse MAC. (Pour afficher l'adresse MAC de votre téléphone, sélectionnez > Paramètres > Configuration réseau > Adresse MAC.) Si vous disposez d'un profil Extension Mobility, vous pouvez sélectionner le périphérique connecté à ce service dans le menu Périphérique appelant. Remarque • Ne pas afficher la confirmation d'appel :si cette option estsélectionnée, elle invite WebDialer à supprimer la page Passage d'un appel. Cette page s'affiche par défaut lorsque vous cliquez sur un numéro de téléphone dans un répertoire en ligne compatible WebDialer. • Désactiver la fermeture automatique : si cette option est sélectionnée, la fenêtre d'appel ne se ferme pas automatiquement au bout de quinze secondes. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 95 Pages Web Options utilisateur Cisco WebDialer Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 96 Pages Web Options utilisateur Cisco WebDialer CHAPITRE 9 Options supplémentaires Votre administrateur système peut configurer votre téléphone de manière à ce que vous puissiez utiliser des modèles spécifiques de boutons et de touches, associés à des fonctions et à des services particuliers. Le tableau ci-dessous présente les options de configuration que vous pouvez demander à votre administrateur système, en fonction de vos besoins en matière des appels ou de votre environnement de travail. Les guides destéléphones et autres documents auxquelsil est fait référence dans ce tableau sont disponibles à l'adresse : http://www.cisco.com/en/US/products/hw/phones/ps379/tsd_products_support_series_ home.html Remarque Si vous... Procédez comme suit... Pour plus d'informations... Contactez votre administrateur système ou l'équipe d'assistance téléphonique. Contactez votre administrateur système pour qu'il configure un ou plusieurs numéros d'annuaire supplémentaires. Avez besoin de plusieurs lignes téléphoniques Reportez-vous à Numérotation simplifiée, à la page 40. Vérifiez d'abord que vous utilisez déjà la totalité des boutons de numérotation simplifiée disponibles. Si vous avez effectivement besoin de boutons de numérotation simplifiée supplémentaires, utilisez la fonction de numérotation simplifiée ou abonnez-vous au service de numérotation simplifiée. Avez besoin de plus de boutons de numérotation simplifiée Reportez-vous à Lignes partagées, à la page 46. Demandez une ligne partagée. Par exemple, cela permet d'utiliser un numéro de poste unique pour les téléphones de votre bureau et de votre laboratoire. Voulez utiliser un même numéro de poste pour plusieurs téléphones Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 97 Si vous... Procédez comme suit... Pour plus d'informations... Contactez votre administrateur système à propos de ces fonctions et reportez-vous aux sections ci-dessous : • Gestion avancée des appels, à la page 39. • Lignes partagées, à la page 46. • Cisco Extension Mobility, à la page 52. Pensez à utiliser : • La fonction de parcage d'appels pourstocker et récupérer des appels sans utiliser la fonction de transfert. • La fonction d'interception d'appels pour répondre à des appels qui sonnent sur un autre téléphone. • Une ligne partagée pour afficher les appels de vos collègues. • La fonction Cisco Extension Mobility pour affecter votre numéro de téléphone et votre profil utilisateur à un téléphone IP Cisco Unified partagé. Partagez vos téléphones ou votre bureau avec des collègues Reportez-vous à Réponse automatique avec casque ou haut-parleur, à la page 61. Contactez votre administrateur système pour configurer la réponse automatique de votre téléphone. Répondez à de nombreux appels ou gérez des appels pour une autre personne Si vous avez besoin d'aide, contactez votre administrateur système et reportez-vous aux documents Guide de l'utilisateur et Guide de démarrage simplifié de Cisco Unified VT Advantage. Pensez à utiliser Cisco Unified Video Advantage pour réaliser des appels vidéo en utilisant votre téléphone IP Cisco Unified, votre PC et une caméra vidéo externe. Devez effectuer des appels vidéo Reportez-vous à Fonctions de supervision de ligne occupée, à la page 48. Contactez votre administrateur pour configurer la Fonction ligne occupée (BLF) sur votre téléphone. Déterminez l'état d'une ligne téléphonique associée à une touche de numérotation simplifiée sur votre téléphone Reportez-vous à Cisco Extension Mobility, à la page 52. Contactez votre administrateur système à propos de Cisco Extension Mobility Service. Voulez affecter temporairement vos numéro de téléphone et paramètres à un téléphone IP Cisco Unified partagé Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 98 Options supplémentaires CHAPITRE 10 Dépannage Cette section fournit des informations de dépannage concernant le téléphone IP Cisco Unified. • Problèmes, page 99 • Données de dépannage du téléphone, page 102 • Outil de génération de rapports qualité, page 102 Problèmes La présente section donne des indications destinées à vous aider à résoudre les problèmes classiques que vous êtes susceptible de rencontrer avec votre téléphone. Pour plus d'informations, contactez votre administrateur système. Pas de tonalité ou impossible de passer un appel Problème Vous n'entendez pas de tonalité ou vous ne parvenez pas à passer un appel. Cause Cela peut être dû à une ou à plusieurs des raisons ci-dessous : • Vous n'êtes pas connecté au service Extension Mobility. • Le système exige un code d'affaire client (CMC) ou un code d'autorisation forcée (FAC) après la composition d'un numéro. (Uniquement sur les téléphones SCCP) • Votre téléphone est soumis à des restrictions horaires qui vous empêchent d'utiliser certaines fonctions à certaines heures de la journée. Solution Essayez la méthode suivante : Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 99 • Connectez-vous au service Extension Mobility. • Saisissez un CMC ou un FAC après avoir composé un numéro. (Uniquement sur les téléphones SCCP) • Modifiez les restrictions horaires qui vous empêchent d'utiliser certaines fonctions à certaines heures de la journée. Pour plus d'informations, contactez votre administrateur système. Touche manquante Problème La touche que vous voulez utiliser ne s'affiche pas. Cause Cela peut être dû à une ou à plusieurs des raisons ci-dessous : • D'autres touches peuvent être affichées. • L'état de la ligne détermine les touches du téléphone. • Votre téléphone n'est pas configuré pour prendre en charge la fonction associée à cette touche. Solution Utilisez l'une des options ci-dessous : • Appuyez sur Autres pour afficher les touches supplémentaires. • Modifiez l'état de la ligne (par exemple, décrocher ou avoir un appel connecté). • Pour pouvoir accéder à cette fonction, contactez votre administrateur système. Impossible d'utiliser la fonction Rappel Problème Le rappel échoue. Cause Votre interlocuteur a peut-être activé la fonction de renvoi d'appels. Message d'erreur de renvoi de tous les appels Problème Le téléphone affiche un message d'erreur lorsque vous tentez de configurer le renvoi de tous les appels. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 100 Dépannage Touche manquante Cause Il est possible que votre tentative de configuration du renvoi de tous les appels directement sur le téléphone soit refusée parce que le numéro cible saisi a pour effet de créer une boucle de renvoi de tous les appels ou de dépasser le nombre maximum de liens autorisés dans une chaîne de renvoi de tous les appels (également appelé nombre maximum de sauts). Solution Pour plus d'informations, contactez votre administrateur système. Le téléphone ne répond pas Problème L'écran du téléphone n'affiche rien et le bouton Affichage est éteint. Cause Le téléphone est arrêté (mode veille) afin d'économiser de l'énergie. Solution Le téléphone se met en marche (réveil) lorsque le système envoie un message de réveil. Vous ne pouvez pas réveiller le téléphone avant l'heure prévue de mise en marche. Message d'erreur de sécurité Problème Votre téléphone affiche Erreur de sécurité. Cause Le micrologiciel de votre téléphone a rencontré une erreur interne. Solution Si le message persiste, contactez votre administrateur système. Impossible d'accéder au menu Paramètres Problème Le menu Paramètre n'est pas disponible dans le menu Application. Cause Votre administrateur système a peut-être désactivé l'option Paramètres sur votre téléphone. Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 101 Dépannage Le téléphone ne répond pas Solution Contactez votre administrateur système. Données de dépannage du téléphone Votre administrateursystème peut vous demander d'accéder à des données d'administration sur votre téléphone en vue du dépannage. Si vous devez... Procédez comme suit... Sélectionnez ( ) > Paramètres > Configuration réseau, puis l'élément de configuration réseau que vous voulez afficher. Accéder aux données de configuration du réseau Sélectionnez ( ) > Paramètres > État,, puis l'élément d'état que vous voulez afficher. Accéder aux données d'état Accéder Sélectionnez ( ) > Paramètres > Caractéristiques. aux caractéristiques du téléphone Accéder Sélectionnez ( ) > Paramètres > État > Statistiques d'appel. aux informations relatives aux appels et à la qualité vocale du téléphone Outil de génération de rapports qualité L'administrateur système peut configurer temporairement votre téléphone avec la fonction Outil de génération de rapports qualité (QRT, Quality Reporting Tool) afin de résoudre les problèmes de performances. Appuyez sur QRT pour soumettre des informations à votre administrateur système. En fonction de la configuration de votre téléphone, l'outil QRT permet : • De signaler immédiatement un problème audio sur un appel en cours • De sélectionner un problème général dans une liste de catégories et de choisir des codes motifs Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 102 Dépannage Données de dépannage du téléphone CHAPITRE 11 Garantie • Conditions générales de la garantie matérielle limitée à un an de Cisco, page 103 Conditions générales de la garantie matérielle limitée à un an de Cisco Des conditions spéciales s'appliquent à votre garantie matérielle et aux services qui sont à votre disposition au cours de la période couverte par la présente garantie. Votre déclaration de garantie formelle, les garanties et les accords de licence applicables aux logiciels Cisco sont disponibles sur Cisco.com à l'adresse : http://www.cisco.com/en/US/docs/general/warranty/English/1Y1DEN__.html Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 103 Guide de l'utilisateur du téléphone IP Cisco Unified 7931G pour Cisco Unified Communications Manager 9.0 (SCCP et SIP) 104 Garantie Conditions générales de la garantie matérielle limitée à un an de Cisco 4-1 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 CHAPITRE 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Table des matières • Garantie limitée Cisco d'un an sur le matériel, page 4-2 • Localisation de la référence du produit, page 4-4 • Vérification des éléments livrés avec le routeur, page 4-5 • Routeurs câblés, page 4-7 • Lecture des mises en garde et recommandations relatives à la sécurité, page 4-7 • Connexion de l'antenne au routeur sans fil (opération facultative), page 4-8 • Connexion du module PoE (Power-over-Ethernet) au routeur (opération facultative), page 4-10 • Installations types des gammes de routeurs Cisco 850 et Cisco 870, page 4-12 • Connexion du routeur, page 4-17 • Installation du logiciel SDM et configuration du routeur, page 4-19 • Documentation associée, page 4-20 • Obtention de documentation, page 4-21 Français Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Garantie limitée Cisco d'un an sur le matériel 4-2 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 • Vos commentaires sur la documentation, page 4-22 • Assistance technique, page 4-22 • Obtention de publications et d'informations complémentaires, page 4-25 Garantie limitée Cisco d'un an sur le matériel Des conditions spécifiques s'appliquent à la garantie de votre matériel et aux prestations de services dont vous pouvez bénéficier pendant la période de validité de cette garantie. Votre déclaration formelle de garantie, qui inclut la garantie et les accords de licence applicables aux logiciels Cisco, est disponible sur le site Cisco.com. Pour accéder aux informations Cisco (Cisco Information Packet), à la garantie et aux accords de licence et les télécharger à partir du site Cisco.com, procédez comme suit : 1. Démarrez votre navigateur et accédez à l'URL suivante : http://www.cisco.com/univercd/cc/td/doc/es_inpck/cetrans.htm La page relative aux accords de licence et aux garanties s'affiche. 2. Pour consulter le Cisco Information Packet, procédez comme suit : a. Dans le champ Information Packet Number (Référence des informations), sélectionnez la référence 78-5235-03A0. b. Sélectionnez la langue souhaitée pour le document. c. Cliquez sur Go (Aller à). La page relative à la garantie limitée Cisco et à la licence d'utilisation du logiciel pour la référence sélectionnée s'affiche. d. Vous pouvez alors consulter le document en ligne ou cliquer sur l'icône PDF pour télécharger et imprimer le document au format PDF (Adobe Portable Document Format). Remarque Vous devez disposer d'Adobe Acrobat Reader pour pouvoir afficher et imprimer les fichiers PDF. Ce programme peut être téléchargé à partir du site Web d'Adobe à l'adresse : http://www.adobe.com 4-3 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Garantie limitée Cisco d'un an sur le matériel 3. Pour obtenir une traduction des informations relatives à la garantie s'appliquant à votre produit, procédez comme suit : a. Dans le champ correspondant au numéro du document de la garantie, indiquez la référence suivante : 78-10747-01C0 b. Sélectionnez la langue désirée pour le document. c. Cliquez sur Go (Aller à). La page relative à la garantie Cisco s'affiche. d. Vous pouvez alors consulter le document en ligne ou cliquer sur l'icône PDF pour télécharger et imprimer le document au format PDF (Adobe Portable Document Format). Vous pouvez également vous rendre sur le site Web de l'assistance technique et des services Cisco pour obtenir une aide : http://www.cisco.com/public/Support_root.shtml. Durée de la garantie sur le matériel Un (1) an Procédure de remplacement, réparation ou remboursement du matériel Cisco ou son centre de service sera en mesure d'expédier une pièce de rechange dans un délai de dix (10) jours suivant la réception de la demande d'autorisation de retour de matériel (ARM). Le délai effectif de livraison pourra varier en fonction de la destination. Cisco se réserve le droit de rembourser le prix d'achat comme seule garantie. Pour recevoir un numéro d'autorisation de retour de matériel (ARM) Contactez la société auprès de laquelle vous avez acheté le produit. Si vous avez acheté le produit directement auprès de Cisco, contactez votre responsable des ventes Cisco. Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Localisation de la référence du produit 4-4 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Complétez les informations ci-dessous et conservez-les comme référence. Localisation de la référence du produit L'étiquette mentionnant la référence du routeur se trouve à l'arrière du châssis, au-dessus des ports réseau Ethernet. (Reportez-vous à la Figure 4-1.) Figure 4-1 Emplacement de la référence du produit Vendeur du produit Numéro de téléphone du vendeur Modèle du produit Référence du produit Numéro du contrat de maintenance 120729, 78-16262-01 Rev A0 G.SHDSL ISDN S/T LAN FE0 FE1 FE2 FE3 Cisco 878 CONSOLE AUX RESET +5,+9 VDC SN: AAANNNNXXXX SN: AAANNNNXXXX 4-5 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Vérification des éléments livrés avec le routeur Vérification des éléments livrés avec le routeur Le Tableau 4-1 répertorie le nombre d'éléments fournis avec chaque modèle de routeur des gammes Cisco 850 et Cisco 870. La Figure 4-2 représente les différents éléments. Assurez-vous que les éléments indiqués dans le Tableau 4-1 ont bien été livrés avec le routeur. Si l'un des éléments manque ou est endommagé, contactez votre service clientèle. Tableau 4-1 Éléments fournis avec les gammes de routeurs Cisco 850 et Cisco 870 Élément Cisco 851 et Cisco 871 Cisco 857 et Cisco 877 Cisco 876 Cisco 878 Câble Ethernet (direct) 1 1 1 1 Câble DSL1 (pour ADSL et G.SHDSL) 1. DSL = ligne d'abonné numérique. Utilisé pour une ligne d'abonné numérique asynchrone (ADSL) ou une ligne d'abonné numérique symétrique haut débit (G.SHDSL). Un câble RJ-11 à RJ-11 est fourni, à moins que le câble RJ-11 à RJ-45 ne soit spécifié. Non applicable Facultatif Facultatif Facultatif Câble de console 1 1 1 1 Adaptateur secteur 1 1 1 1 Cordon d'alimentation2 2. Les cordons d'alimentation sont commandés en fonction du pays ou de la zone géographique. 1 1 1 1 Documentation Cisco3 3. Inclut le document Regulatory Compliance and Safety Information for Cisco 800 Series Routers (Gamme de routeurs Cisco 800 – Informations relatives au respect des réglementations et à la sécurité) ainsi que le présent document Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide. 1 1 1 1 CD Cisco Router and Security Device Manager (SDM) 1111 Antenne doublet pivotante (pour routeurs sans fil uniquement) Cisco 851 : 1 antenne Cisco 871 : 2 antennes Cisco 857 : 1 antenne Cisco 877 : 2 antennes 2 2 Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Vérification des éléments livrés avec le routeur 4-6 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Figure 4-2 Éléments fournis avec les gammes de routeurs Cisco 850 et Cisco 870 Les câbles ci-après ne sont pas fournis avec le routeur. Vous devez les commander séparément. • Câble modem : permet de connecter le port console du routeur à un modem asynchrone pour doter le routeur de fonctionnalités de sauvegarde et de gestion à distance. • Câble S/T RNIS orange : permet de connecter des périphériques au port S/T RNIS. 1 Câble Ethernet jaune 5 Cordon d'alimentation noir pour adaptateur 2 Câble DSL bleu lavande (facultatif) 6 Documentation produit 3 Câble de console bleu clair 7 CD Cisco SDM 4 Adaptateur secteur du routeur 8 Antenne doublet pivotante (pour routeurs sans fil uniquement) 4-7 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Routeurs câblés Routeurs câblés Le présent document contient des sections non applicables aux modèles câblés des gammes de routeurs Cisco 850 et Cisco 870. Certaines illustrations présentent le routeur doté d'antennes, alors que les routeurs câblés ne sont pas équipés d'antennes ni de connecteurs d'antenne sur le panneau arrière. Toutefois, à l'exception de la section « Connexion de l'antenne au routeur sans fil (opération facultative) », la procédure de connexion des routeurs sans fil est identique à celle des routeurs câblés. Lecture des mises en garde et recommandations relatives à la sécurité Avant d'entreprendre de connecter votre routeur, lisez le document Regulatory Compliance and Safety Information for Cisco 800 Series Routers (Gamme de routeurs Cisco 800 – Informations relatives au respect des réglementations et à la sécurité) fourni avec le routeur. Ce document contient d'importantes mises en garde et recommandations en matière de sécurité. Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Connexion de l'antenne au routeur sans fil (opération facultative) 4-8 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Connexion de l'antenne au routeur sans fil (opération facultative) Les routeurs sans fil de la gamme Cisco 850 doivent être utilisés avec une seule antenne de 2,4 GHz. (Reportez-vous à la Figure 4-3.) Les routeurs sans fil de la gamme Cisco 870 sont utilisables avec deux antennes de 2,4 GHz. (Reportez-vous à la Figure 4-4.) Figure 4-3 Routeur sans fil Cisco 857 doté d'une seule antenne LAN ADSLoPOTS FE0 FE1 FE2 FE3 Cisco 857W CONSOLE AUX RESET +5,+12 VDC 122242 SN: XXXNNNNXXXX 4-9 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Connexion de l'antenne au routeur sans fil (opération facultative) Figure 4-4 Routeur sans fil Cisco 871 doté de deux antennes Pour connecter une ou plusieurs antennes à un routeur sans fil, procédez comme suit : Étape 1 Fixez chaque antenne à un connecteur Neill-Concelman vissé de polarité inversée (RP-TNC) situé à l'arrière du routeur, puis verrouillez le connecteur manuellement. Étape 2 Après avoir fixé l'antenne à l'arrière du routeur, positionnez-la à la verticale. LAN FE0 FE1 FE2 FE3 Cisco 871W CONSOLE AUX RESET +5,+12 VDC LEFT RIGHT / PRIMARY 1 0 WAN FE4 122241 SN: XXXNNNNXXXX Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Connexion du module PoE (Power-over-Ethernet) au routeur (opération facultative) 4-10 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Connexion du module PoE (Power-over-Ethernet) au routeur (opération facultative) Si vous avez acheté un module d'alimentation par câble Ethernet (PoE), connectez les quatre câbles Ethernet jaunes du module aux quatre ports Ethernet LAN du routeur. (Reportez-vous à la Figure 4-5.) Assurez-vous de bien connecter les quatre câbles Ethernet. Si les câbles sont trop rapprochés les uns des autres pour cette opération, éloignez le protège-câble en plastique de l'extrémité des câbles équipée des connecteurs. Prudence Pour assurer le bon fonctionnement du module d'alimentation par câble Ethernet (PoE), ne le reliez pas à l'adaptateur secteur avant de l'avoir connecté au routeur. La Figure 4-5 présente le routeur Cisco 871 relié à un module PoE. Notez toutefois que cette connexion fonctionne pour tous les modèles de routeur des gammes Cisco 870. Remarque Lorsque vous connectez un appareil (tel qu'un PC ou un téléphone IP) au module d'alimentation par câble Ethernet (PoE), vous pouvez attendre une à deux secondes avant que le voyant lumineux indique que le port est activé. 4-11 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Connexion du module PoE (Power-over-Ethernet) au routeur (opération facultative) Figure 4-5 Connexion du module PoE au routeur 1 Routeur de la gamme Cisco 870 5 Adaptateur secteur du routeur 2 Câbles Ethernet du module PoE 6 Fiche secteur PoE 3 Module PoE 7 Fiche secteur du routeur 4 Adaptateur secteur PoE 122351 +5,+12 VDC LEFT RIGHT / PRIMARY LAN FE0 FE1 FE2 FE3 Cisco 871W CONSOLE AUX RESET 1 0 WAN FE4 1 2 4 6 To LAN 0 1 2 3 PWR 3 5 7 SN: XXXNNNNXXXX Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Installations types des gammes de routeurs Cisco 850 et Cisco 870 4-12 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Installations types des gammes de routeurs Cisco 850 et Cisco 870 Les installations types des gammes de routeurs Cisco 850 et Cisco 870 sont illustrées de la Figure 4-6 à la Figure 4-9, dans l'ordre suivant : • routeurs Cisco 851 et Cisco 871 : voir la Figure 4-6 ; • routeurs Cisco 857 et Cisco 87 : voir la Figure 4-7 ; • routeur Cisco 876 : voir la Figure 4-8 ; • routeur Cisco 878 : voir la Figure 4-9. La Figure 4-6 présente l'installation type d'un routeur Cisco 851 ou Cisco 871. Cette figure illustre le panneau arrière d'un routeur Cisco 871, équipé de deux ports USB (Universal Serial Bus). Le routeur Cisco 851 ne comporte aucun port USB ; toutefois, les connexions des autres ports du routeur Cisco 851 sont identiques à celles du routeur Cisco 871. 4-13 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Installations types des gammes de routeurs Cisco 850 et Cisco 870 Figure 4-6 Installation type d'un routeur Cisco 851 ou Cisco 871 1 Connexion Ethernet à un commutateur externe 4 Port console 2 Connexion Ethernet à un PC 5 Adaptateur secteur 3 Connexion WAN (réseau étendu) à Internet à l'aide d'un modem à large bande LAN 4 3 2 1 Cisco 871W CONSOLE AUX RESET +5,+12 VDC LEFT RIGHT / PRIMARY 1 0 WAN FE0 FE1 FE2 FE3 FE4 1X 2X 1X 2X 1 Internet 1 2 3 4 5 122237 SN: XXXNNNNXXXX Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Installations types des gammes de routeurs Cisco 850 et Cisco 870 4-14 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 La Figure 4-7 présente l'installation type d'un routeur Cisco 857 ou Cisco 877. Figure 4-7 Installation type d'un routeur Cisco 857 ou Cisco 877 1 Connexion Ethernet à un commutateur externe 4 Port console 2 Connexion Ethernet à un PC 5 Adaptateur secteur 3 Connexion ADSL sur POTS (service téléphonique traditionnel) RIGHT / PRIMARY ETHERNET LAN ADSLoPOTS 3 2 1 0 Cisco 877W CONSOLE AUX RESET +5,+12 VDC LEFT FE4 FE3 FE2 FE1 1X 2X 1X 2X 1 1 2 3 5 122238 4 SN: XXXNNNNXXXX 4-15 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Installations types des gammes de routeurs Cisco 850 et Cisco 870 La Figure 4-8 présente l'installation type d'un routeur Cisco 876. Figure 4-8 Installation type d'un routeur Cisco 876 1 Connexion Ethernet à un commutateur externe 4 Connexion ADSL sur RNIS 2 Connexion Ethernet à un PC 5 Port console 3 Connexion S/T RNIS 6 Adaptateur secteur LAN ISDN S/T ADSL o ISDN FE0 FE1 FE2 FE3 Cisco 876W CONSOLE AUX RESET +5,+12 VDC LEFT RIGHT / PRIMARY 1X 2X 1X 2X 1 1 2 6 122239 3 4 5 SN: XXXNNNNXXXX Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Installations types des gammes de routeurs Cisco 850 et Cisco 870 4-16 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 La Figure 4-9 présente l'installation type d'un routeur Cisco 878. Figure 4-9 Installation type d'un routeur Cisco 878 1 Connexion Ethernet à un commutateur externe 4 Connexion G.SHDSL 2 Connexion Ethernet à un PC 5 Port console 3 Connexion S/T RNIS 6 Adaptateur secteur LAN ISDN S/T G.SHDSL FE0 FE1 FE2 FE3 Cisco 878W CONSOLE AUX RESET +5,+12 VDC LEFT RIGHT / PRIMARY 1X 2X 1X 2X 1 1 2 3 4 6 122240 5 SN: XXXNNNNXXXX 4-17 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Connexion du routeur Connexion du routeur Connectez le routeur en vous reportant à l'installation type de votre modèle de routeur illustrée à la section « Installations types des gammes de routeurs Cisco 850 et Cisco 870 » la section sur la page 4-12. Procédez comme suit pour connecter le routeur à l'adaptateur secteur, à votre réseau local et au réseau de votre fournisseur d'accès : Étape 1 Modèles sans fil uniquement : vérifiez que les antennes ont été fixées au routeur conformément aux instructions de la section « Connexion de l'antenne au routeur sans fil (opération facultative) » la section sur la page 4-8. Étape 2 Si vous utilisez un module PoE, assurez-vous qu'il est connecté au routeur (reportez-vous à la section « Connexion du module PoE (Power-over-Ethernet) au routeur (opération facultative) » la section sur la page 4-10). Connectez les périphériques Ethernet au module PoE, mais non au routeur. Étape 3 Si vous connectez plus de quatre PC au routeur, raccordez ce dernier à un commutateur ou à un concentrateur à l'aide d'un câble Ethernet jaune, comme illustré de la Figure 4-6 à la Figure 4-9. Étape 4 Connectez un PC directement au routeur, comme illustré de la Figure 4-6 à la Figure 4-9. Mettez le PC hors tension afin qu'il obtienne une adresse IP du routeur lorsqu'il sera remis sous tension. Vous pouvez connecter d'autres PC aux ports Ethernet numérotés restants. Étape 5 Le port console est un port de service auquel vous pouvez connecter un terminal ou un PC pour configurer le logiciel à l'aide de l'interface CLI (interface de ligne de commande) ou pour résoudre les problèmes rencontrés avec le routeur. Si vous avez besoin d'accéder à la console du routeur, connectez un PC ou un terminal au port console. Remarque En connectant le port console à un modem asynchrone à l'aide du câble modem pour routeur disponible en option, vous pouvez doter le routeur de fonctionnalités de sauvegarde et de gestion à distance. Étape 6 Routeurs Cisco 851 et Cisco 871 uniquement : connectez le second câble Ethernet jaune entre le port WAN Ethernet du routeur et un port disponible sur un modem DSL, câblé ou Ethernet LRE (longue portée) déjà installé, comme illustré à la Figure 4-6. Pour choisir le port de connexion sur le modem, suivez les instructions livrées avec votre modem à large bande. Si ce dernier est éteint, mettez-le sous tension. Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Connexion du routeur 4-18 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Étape 7 Routeur Cisco 871 uniquement : Connectez les périphériques USB pris en charge, tels que des modules de mémoire Flash ou des eTokens, aux deux ports USB. Pour plus d'informations, reportez-vous au document Cisco Access Router USB Flash Module and USB eToken Hardware Installation Guide (Modules Flash USB et eTokens USB pour routeurs d'accès Cisco – Guide d'installation matérielle), puis passez à l'Étape 12. Étape 8 Routeurs Cisco 857 et Cisco 877 uniquement : connectez le port ADSLoPOTS du routeur à la prise téléphonique murale à l'aide du câble DSL bleu lavande. Si la ligne ADSL sert aussi à la communication vocale, vous pouvez empêcher toute interruption de la transmission de données en connectant le routeur à un filtre ADSL ou en installant des microfiltres entre les téléphones ou les télécopieurs et la prise murale. Passez à l'Étape 12. Étape 9 Routeurs Cisco 876 et Cisco 878 uniquement : pour disposer de fonctions de sauvegarde et de gestion à distance, vous pouvez connecter le port S/T RNIS à une terminaison réseau (NT1) ou à un filtre ADSL à l'aide du câble S/T RNIS orange (disponible en option). Passez à l'Étape 10 ou à l'Étape 11, selon le modèle de routeur dont vous disposez. Étape 10 Routeurs Cisco 876 uniquement : branchez le câble DSL sur le port ADSLoRNIS du routeur et sur le filtre ADSL ou sur la prise murale. Si vous utilisez un filtre ADSL, connectez-le à la prise murale à l'aide d'un câble à paire torsadée non blindée de catégorie 5. Passez à l'Étape 12. Étape 11 Routeurs Cisco 878 uniquement : branchez le câble DSL sur le port G.SHDSL du routeur et sur la prise murale. Étape 12 Tous les modèles de routeurs : raccordez le cordon d'alimentation au routeur, puis mettez le routeur sous tension. Assurez-vous d'utiliser l'adaptateur secteur livré avec le routeur. Le routeur n'accepte pas d'autres adaptateurs secteur. Lorsque vous connectez le routeur à une source d'alimentation, le témoin vert OK du panneau avant du routeur doit s'allumer. Le routeur est alors prêt à l'emploi. Si le témoin vert OK ne s'allume pas, reportez-vous au chapitre « Troubleshooting » (« Dépannage ») du document Cisco 850 Series and Cisco 870 Series Routers Hardware Installation Guide (Gammes de routeurs Cisco 850 et Cisco 870 – Guide d'installation matérielle). 4-19 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Installation du logiciel SDM et configuration du routeur Remarque Dans le cas des routeurs Cisco 857, Cisco 876, Cisco 877 et Cisco 878, la ligne DSL doit avoir été fournie par votre fournisseur d'accès et être correctement configurée. Vérifiez l'état de détection de porteuse (CD) indiqué par le témoin CD ADSL ou G.SHDSL du routeur. Si le témoin CD ADSL ou G.SHDSL ne s'allume pas, contactez votre fournisseur d'accès. Étape 13 Si vous avez connecté un module PoE au routeur, branchez l'adaptateur secteur du module PoE sur la prise d'entrée située sur le panneau arrière du module. Le témoin vert situé sur le panneau avant du module PoE s'allume et les périphériques connectés au module sont alimentés. Pour obtenir des instructions de connexion détaillées, reportez-vous au document Cisco 850 Series and Cisco 870 Series Routers Hardware Installation Guide (Gammes de routeurs Cisco 850 et Cisco 870 – Guide d'installation matérielle). Installation du logiciel SDM et configuration du routeur Pour installer le logiciel Cisco SDM permettant de configurer le routeur, procédez comme suit : Étape 1 Connectez un PC à n'importe quel port LAN du routeur, comme illustré de la Figure 4-7, Figure 4-8 et Figure 4-9. Étape 2 Insérez le CD du logiciel Cisco SDM dans le lecteur de CD du PC. Un assistant d'installation s'exécute à partir du CD. Installez le logiciel Cisco SDM en suivant les instructions de l'interface utilisateur de l'assistant d'installation. Étape 3 Utilisez le logiciel Cisco SDM pour configurer le routeur conformément aux instructions du document Cisco Router and Security Device Manager (SDM) Quick Start Guide (Guide de démarrage rapide de SDM). Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Documentation associée 4-20 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Documentation associée Le présent document décrit les procédures élémentaires de câblage et de configuration des gammes de routeurs Cisco 850 et Cisco 870. Pour plus d'informations, reportez-vous aux documents suivants : • Cisco 850 Series and Cisco 870 Series Access Routers Hardware Installation Guide (Gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide d'installation matérielle) : fournit des informations détaillées concernant le câblage et le matériel des routeurs Cisco 850 et Cisco 870. • Cisco Router and Security Device Manager (SDM) Quick Start Guide (Guide de démarrage rapide de SDM) : fournit des instructions détaillées concernant la configuration du routeur et des fonctionnalités sans fil de ce dernier à l'aide de l'interface utilisateur graphique Cisco SDM. • Cisco 850 Series and Cisco 870 Series Access Routers Software Configuration Guide (Gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de configuration logicielle) : fournit des informations et des exemples de configuration logicielle des routeurs Cisco 850 et Cisco 870. • Cisco Access Router Wireless Configuration Guide (Routeurs d'accès Cisco – Guide de configuration sans fil) : fournit des informations concernant la configuration logicielle sans fil des routeurs d'accès Cisco, englobant les gammes de routeurs Cisco 850 et Cisco 870. • Upgrading Memory in Cisco 800 Series Routers (Routeurs Cisco 800 – Mise à niveau de la mémoire) : fournit des informations sur la mise à niveau de la mémoire des routeurs Cisco 800. • Regulatory Compliance and Safety Information for Cisco 800 Series and SOHO Series Routers (Routeurs des gammes Cisco 800 et SOHO – Informations relatives au respect des réglementations et à la sécurité) : fournit des informations sur les normes de sécurité et les réglementations internationales pour les routeurs des gammes Cisco 800 et SOHO. • Cisco Access Router USB Flash Module and USB eToken Hardware Installation Guide (Modules Flash USB et eTokens USB pour routeurs d'accès Cisco – Guide d'installation matérielle) fournit des informations concernant l'installation de modules de mémoire Flash et d'eTokens USB. 4-21 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Obtention de documentation Ces documents sont tous disponibles sur Internet. La documentation Cisco la plus récente est disponible sur Internet à partir des sites suivants : • http://www.cisco.com • http://www-china.cisco.com • http://www-europe.cisco.com Obtention de documentation La documentation Cisco est disponible sur le site Cisco.com. Cisco propose également divers moyens pour obtenir une assistance technique et d'autres ressources techniques. Les sections qui suivent expliquent comment obtenir des informations techniques de Cisco Systems. Cisco.com Vous pouvez accéder à la documentation Cisco la plus récente à l'adresse suivante : http://www.cisco.com/cisco/web/psa/default.html?mode=prod Vous pouvez accéder au site Web de Cisco à l'adresse suivante : http://www.cisco.com Vous pouvez accéder aux sites Web internationaux de Cisco à l'adresse suivante : http://www.cisco.com/public/countries_languages.shtml Commande de documentation Vous trouverez les instructions de commande de documentation à l'adresse suivante : http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Vos commentaires sur la documentation 4-22 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Vous pouvez commander de la documentation Cisco en procédant comme suit : • Les utilisateurs inscrits sur Cisco.com (clients directs de Cisco) peuvent commander de la documentation à l'adresse suivante : http://www.cisco.com/en/US/partner/ordering/index.shtml • Les utilisateurs non inscrits sur Cisco.com peuvent se procurer de la documentation par l'intermédiaire d'un représentant de compte local en appelant le siège social de Cisco Systems (Californie, États-Unis) au numéro 408 526-7208 ou, en dehors des États-Unis, en composant le 1 800 553-NETS (6387). Vos commentaires sur la documentation Vous pouvez envoyer vos commentaires sur la documentation technique à l'adresse bug-doc@cisco.com. Pour envoyer vos commentaires par courrier ordinaire, utilisez le coupon-réponse situé au verso de la couverture de votre document ou, à défaut, écrivez à l'adresse suivante : Cisco Systems Attn : Customer Document Ordering 170 West Tasman Drive San Jose, CA 95134-9883 Vos commentaires sont les bienvenus. Assistance technique Pour tous les clients, partenaires, revendeurs et distributeurs en possession de contrats de service Cisco valides, le centre d'assistance technique Cisco propose une assistance hors pair disponible 24 heures sur 24. Le site Web d'assistance technique Cisco sur Cisco.com offre des ressources en ligne très complètes. En outre, le centre d'assistance technique (TAC) Cisco fournit une assistance téléphonique. Si vous ne disposez pas d'un contrat de service Cisco valide, contactez votre revendeur. 4-23 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Assistance technique Site Web d'assistance technique Cisco Ce site propose des documents et outils en ligne pour dépanner et résoudre les problèmes techniques liés aux technologies et produits Cisco. Il est disponible 24 heures sur 24, 365 jours par an, à l'adresse suivante : http://www.cisco.com/techsupport Pour accéder aux outils du site, vous devez être inscrit à Cisco.com et posséder un ID utilisateur ainsi qu'un mot de passe. Si vous êtes en possession d'un contrat de service valide, mais que vous n'avez ni ID utilisateur ni mot de passe, connectez-vous à l'adresse suivante pour vous inscrire : http://tools.cisco.com/RPF/register/register.do Remarque Avant de demander une assistance par Internet ou par téléphone, utilisez l'outil d'identification produit Cisco (CPI) pour déterminer votre référence produit. Pour accéder à l'outil CPI à partir du site Web d'assistance technique Cisco, cliquez sur le lien Tools & Resources (Outils et ressources) sous Documentation & Tools (Documentation et outils). Sélectionnez l'option Cisco Product Identification Tool (Outil d'identification produit Cisco) dans la liste déroulante Alphabetical Index (Index alphabétique), ou cliquez sur le lien Cisco Product Identification Tool sous Alerts & RMAs (Alertes et RMA). L'outil CPI vous propose trois options de recherche : par ID produit ou nom de modèle, par arborescence, ou, dans le cas de certains produits, par copier-coller du résultat de la commande show (afficher). Les résultats de la recherche vous présentent votre produit en mettant en surbrillance l'étiquette mentionnant sa référence. Localisez cette étiquette sur votre produit, puis notez cette information avant d'effectuer votre demande d'assistance. Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Assistance technique 4-24 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Soumission d'une demande de service L'outil de demande de service en ligne sur le TAC constitue le moyen le plus rapide de soumettre des demandes de service S3 et S4. (Ces demandes correspondent à une dégradation minimale du fonctionnement de votre réseau ou à une demande d'information produit.) Lorsque vous avez décrit la situation, l'outil de demande de service du TAC vous propose les solutions recommandées. Si ces solutions ne permettent pas de résoudre le problème, votre demande de service est affectée à un ingénieur du TAC Cisco. Vous trouverez l'outil de demande de service du TAC à l'adresse suivante : http://www.cisco.com/techsupport/servicerequest Pour les demandes de service S1 ou S2 ou dans le cas où vous n'avez pas d'accès à Internet, contactez le TAC Cisco par téléphone. (Vous soumettez ce type de demandes lorsque votre réseau d'exploitation est très dégradé ou paralysé.) Ces demandes sont immédiatement affectées aux ingénieurs du TAC Cisco pour préserver le bon fonctionnement de vos activités. Pour soumettre une demande de service par téléphone, composez l'un des numéros suivants : Asie-Pacifique : +61 2 8446 7411 (Australie : 1 800 805 227) Zone EMEA : +32 2 704 55 55 États-Unis : 1 800 553-2447 Pour consulter la liste complète des contacts du TAC Cisco, rendez-vous à l'adresse : http://www.cisco.com/techsupport/contacts Définition de la gravité des demandes de service Cisco a défini des niveaux de gravité afin que toutes les demandes de service soient soumises dans un format standard. Gravité 1 (S1) : votre réseau est « paralysé » ou la situation a un impact très négatif sur vos activités professionnelles. Vous et Cisco engagerez 24 heures sur 24 toutes les ressources nécessaires pour résoudre le problème. 4-25 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Obtention de publications et d'informations complémentaires Gravité 2 (S2) : le fonctionnement d'un réseau existant est très dégradé ou des aspects importants de vos activités professionnelles sont affectés par les performances inadéquates des produits Cisco. Vous et Cisco engagerez des ressources à temps plein pendant les heures de bureau normales pour résoudre le problème. Gravité 3 (S3) : les performances de votre réseau sont affectées mais la plupart de vos activités professionnelles restent fonctionnelles. Vous et Cisco engagerez des ressources pendant les heures de bureau normales pour rétablir des niveaux de service satisfaisants. Gravité 4 (S4) : vous avez besoin d'informations ou d'assistance concernant des fonctionnalités, l'installation ou la configuration de produits Cisco. L'impact sur vos activités professionnelles est faible, voire nul. Obtention de publications et d'informations complémentaires Des informations sur les produits, les technologies et les solutions réseau Cisco sont disponibles en ligne et sous forme imprimée. • La boutique Cisco Marketplace offre un grand choix d'ouvrages, de guides de référence et de produits Cisco. Pour la découvrir, rendez-vous à l'adresse suivante : http://www.cisco.com/go/marketplace/ • Le Catalogue des produits Cisco détaille les produits réseau proposés par Cisco Systems, ainsi que les services clients gérant les commandes et les demandes d'assistance. Vous pouvez accéder au Catalogue des produits Cisco à l'adresse suivante : http://cisco.com/univercd/cc/td/doc/pcat/ • Cisco Press publie une large gamme d'ouvrages traitant de l'administration réseau, des formations et des certifications. Les utilisateurs débutants comme les plus expérimentés y trouveront des informations utiles. Pour connaître les dernières publications de Cisco Press et consulter d'autres informations, visitez le site de Cisco Press à l'adresse suivante : http://www.ciscopress.com Chapitre 4 Configuration et câblage des gammes de routeurs d'accès Cisco 850 et Cisco 870 – Guide de démarrage rapide Obtention de publications et d'informations complémentaires 4-26 Cisco 850 Series and Cisco 870 Series Access Routers Cabling and Setup Quick Start Guide 78-16262-04 • Le magazine Packet destiné aux utilisateurs techniques de Cisco Systems détaille comment optimiser les investissements Internet et réseau. Chaque trimestre, il présente les dernières tendances en matière de réseaux, les innovations technologiques ainsi que les produits et solutions Cisco. Il donne des conseils pour le déploiement et le dépannage des réseaux et propose des exemples de configuration, des études de cas relatives à la clientèle, des informations sur les certifications et les formations, ainsi que des liens vers des ressources plus détaillées accessibles en ligne. Vous pouvez accéder au magazine Packet à l'adresse suivante : http://www.cisco.com/packet • Le journal trimestriel Internet Protocol Journal publié par Cisco Systems s'adresse aux ingénieurs concernés par la conception, le développement et l'exploitation de réseaux Internet et intranet publics et privés. Vous pouvez y accéder à l'adresse suivante : http://www.cisco.com/ipj • Cisco propose des formations de niveau international sur les réseaux. Les programmes en vigueur sont présentés à l'adresse suivante : http://www.cisco.com/en/US/learning/index.html