Catalyst 6500 Series Switch Content Switching Module with SSL (CSM-S) Command Reference, 1.1

advertise (virtual server submode)

To allow the CSM to advertise the IP address of the virtual server as the host route, use the advertise command in the SLB virtual server configuration mode. To stop advertising the host route for this virtual server, use the no form of this command.

advertise [active]

no advertise

Syntax Description

Defaults

The default for network mask is 255.255.255.255 if the network mask is not specified.

Command Modes

SLB virtual server configuration submode

Command History

Usage Guidelines

Without the active option, the CSM always advertises the virtual server IP address whether or not there is any active real server attached to this virtual server.

Examples

This example shows how to restrict a client from using the virtual server:

Cat6k-2(config-slb-redirect-vs)# advertise 10.5.2.1 exclude

Related Commands

redirect-vserver
show module csm vserver redirect

client (virtual server submode)

To restrict which clients are allowed to use the virtual server, use the client command in the SLB virtual server configuration mode. To remove the client definition from the configuration, use the no form of this command.

client ip-address [network-mask] [exclude]

no client ip-address [network-mask]

Syntax Description

Defaults

The default for network mask is 255.255.255.255 if the network mask is not specified.

Command Modes

SLB virtual server configuration submode

Command History

Usage Guidelines

The network mask is applied to the source IP address of incoming connections and the result must match the IP address before the client is allowed to use the virtual server. If exclude is not specified, the IP address and network mask combination is allowed.

Examples

This example shows how to restrict a client from using the virtual server:

Cat6k-2(config-slb-vserver)# client 10.5.2.1 exclude

Related Commands

advertise (virtual server submode)
client-group (policy submode)
ip access-list standard
show module csm vserver redirect

(virtual server submode)idle (virtual server submode)

To control the amount of time the CSM maintains connection information in the absence of packet activity, use the idle command in the SLB virtual server configuration submode. To change the idle timer to its default value, use the no form of this command.

idle duration

no idle

Syntax Description

Defaults

The default is 3600.

Command Modes

SLB virtual server configuration submode

Command History

Usage Guidelines

If you do not specify a duration value, the default value is applied.

Examples

This example shows how to specify an idle timer duration of 4000:

Cat6k-2(config-slb-vserver)# idle 4000

Related Commands

advertise (virtual server submode)
show module csm vserver redirect

inservice (virtual server submode)

To enable the virtual server for load balancing, use the inservice command in the SLB virtual server configuration submode. To remove the virtual server from service, use the no form of this command.

inservice

no inservice

Syntax Description

This command has no keywords or arguments.

Defaults

The default is the virtual server is not in service.

Command Modes

SLB virtual server configuration submode

Command History

Examples

This example shows how to enable a virtual server for load balancing:

Cat6k-2(config-slb-vserver)# inservice

Related Commands

advertise (virtual server submode)
show module csm vserver redirect

owner (virtual server submode)

To define an owner that may access the virtual server, use the owner command in the SLB virtual server submode. To remove the owner, use the no form of this command.

owner owner-name maxconns number

no owner maxconns

Syntax Description

Defaults

This command has no default settings.

Command Modes

SLB virtual server configuration submode

Command History

Examples

This example shows how to specify an owner for virtual server access:

Cat6k-2(config-slb-vserver)# owner madrigal maxconns 1000

Related Commands

advertise (virtual server submode)

parse-length (virtual server submode)

To set the maximum number of bytes to parse for URLs and cookies, use the parse-length command in the SLB virtual server configuration submode. To restore the default, use the no form of this command.

parse-length bytes

no parse-length

Syntax Description

Defaults

The default is 600.

Command Modes

SLB virtual server configuration submode

Command History

Examples

This example shows how to set the number of bytes to parse for URLs and cookies:

Cat6k-2(config-slb-vserver)# parse-length 1000

Related Commands

advertise (virtual server submode)
show module csm vserver redirect

pending (virtual server submode)

To set the pending connection timeout, use the pending command in the SLB virtual server configuration submode. To restore the default, use the no form of this command.

pending timeout

no pending

Syntax Description

Defaults

The default pending timeout is 30 seconds.

Command Modes

SLB virtual server configuration submode

Command History

Usage Guidelines

This command is used to prevent denial-of-service (DOS) attacks. The pending connection timeout sets the response time for terminating connections if a switch becomes flooded with traffic. The pending connections are configurable on a per-virtual-server basis.

Examples

This example shows how to set the number to wait for a connection to be made to the server:

Cat6k-2(config-slb-vserver)# pending 300

Related Commands

advertise (virtual server submode)
show module csm vserver redirect

persistent rebalance (virtual server submode)

To enable or disable HTTP 1.1 persistence for connections in the virtual server, use the persistent rebalance command in the SLB virtual server configuration submode. To disable persistence, use the no form of this command.

persistent rebalance

no persistent rebalance

Syntax Description

This command has no keywords or arguments.

Defaults

Persistence is disabled.

Command Modes

SLB virtual server configuration submode

Command History

Examples

This example shows how to enable the HTTP 1.1 persistence:

Cat6k-2(config-slb-vserver)# persistent rebalance

Related Commands

advertise (virtual server submode)
show module csm vserver redirect

replicate csrp (virtual server submode)

To enable connection redundancy, use the replicate csrp command in the SLB virtual server configuration submode. To disable connection redundancy, use the no form of this command.

replicate csrp {sticky | connection}

no replicate csrp {sticky | connection}

Syntax Description

Defaults

Connection redundancy is disabled.

Command Modes

SLB virtual server configuration submode

Command History

Usage Guidelines

Sticky and connection replication can be enabled or disabled separately. For replication to occur, you must enable SLB fault tolerance with the ft group command.

Examples

This example shows how to enable connection redundancy:

Cat6k-2(config-slb-vserver)# replicate csrp connection

Related Commands

advertise (virtual server submode)
ft group
show module csm vserver redirect

reverse-sticky (virtual server submode)

To ensure that the CSM switches connections in the opposite direction back to the original source, use the reverse-sticky command in the virtual server submode. To remove the reverse-sticky option from the policy or the default policy of a virtual server, use the no form of this command.

reverse-sticky group-id

no reverse-sticky

Syntax Description

Defaults

Reverse sticky is not enabled.

Command Modes

SLB virtual server configuration submode

Command History

Usage Guidelines

Sticky connections are not tracked. The group ID default is 0. The sticky feature is not used for other virtual servers. The network default is 255.255.255.255.

Examples

This example shows how to set the IP reverse-sticky feature:

Cat6k-2(config-module-csm)# vserver PUBLIC_HTTP

Cat6k-2(config-slb-vserver)# reverse-sticky 60 

Related Commands

show module csm sticky
show module csm vserver redirect
sticky
sticky-group (policy submode)

serverfarm (virtual server submode)

To associate a server farm with a virtual server, use the serverfarm command in SLB virtual server configuration submode. To remove a server farm association from the virtual server, use the no form of this command.

serverfarm primary-serverfarm [backup sorry-serverfarm [sticky]]

no serverfarm

Syntax Description

Defaults

This command has no default settings.

Command Modes

SLB virtual server configuration submode

Command History

Usage Guidelines

The server farm name must match the server farm name specified in a previous module CSM submode serverfarm command.

The backup server farm can be associated with a policy. A primary server farm must be associated with that policy to allow the backup server farm to function properly. The backup server farm can have a different predictor option than the primary server. When the sticky option is used for a policy, then stickiness can apply to real servers in the backup server farm. Once a connection has been balanced to a server in the backup server farm, subsequent connections from the same client can be stuck to the same server even when the real servers in the primary server farm come back to the operational state. You may allow the sticky attribute when applying the backup server farm to a policy.

By default, the sticky option does not apply to the backup server farm. To remove the backup server farm, you can either use the serverfarm command without the backup option or use the no serverfarm command.

Examples

This example shows how to associate a server farm with a virtual server named PUBLIC_HTTP:

Cat6k-2(config-slb-vserver)# serverfarm PUBLIC_HTTP back-up seveneleven sticky

Related Commands

advertise (virtual server submode)
serverfarm (policy submode)
serverfarm (virtual server submode)
show module csm vserver redirect

slb-policy (virtual server submode)

To associate a load-balancing policy with a virtual server, use the slb-policy command in the SLB virtual server configuration submode. To remove a policy from a virtual server, use the no form of this command.

slb-policy policy-name

no slb-policy policy-name

Syntax Description

Defaults

This command has no default settings.

Command Modes

SLB virtual server configuration submode

Command History

Usage Guidelines

Multiple load-balancing policies can be associated with a virtual server. URLs in incoming requests are parsed and matched against policies defined in the same order in which they are defined with this command. The policy name must match the name specified in a previous policy command.

Note The order of the policy association is important; you should enter the highest priority policy first.

Examples

This example shows how to associate a policy with a virtual server.:

Cat6k-2(config-slb-vserver)# slb-policy COOKIE-POLICY1

Related Commands

advertise (virtual server submode)
policy
show module csm owner
show module csm vserver redirect

ssl-sticky (virtual server submode)

To allow SSL sticky operation, use the ssl-sticky command in the SLB virtual server configuration submode. To remove the SSL sticky feature, use the no form of this command.

ssl-sticky offset X length Y

no ssl-sticky

Syntax Description

Defaults

Offset is 0 and length is 32.

Command Modes

SLB virtual server configuration submode

Command History

Usage Guidelines

This feature allows you to stick an incoming SSL connection based only on this special section of the SSL ID specified by the offset and length values. The ssl-sticky command was added to ensure that the CSM always load balances an incoming SSL connection to the SSL termination engine that generated that SSL ID.

Examples

This example shows how to associate a policy with a virtual server:

Cat6k-2(config-slb-vserver)# ssl-sticky offset 0 length 32

Related Commands

advertise (virtual server submode)
policy
show module csm owner
show module csm vserver redirect

sticky (virtual server submode)

To ensure that connections from the client use the same real server, use the sticky command in the virtual server submode. To change the sticky timer to its default value and remove the sticky option from the virtual server, use the no form of this command.

sticky duration [group group-id] [netmask ip-netmask] [source | destination | both]

no sticky

Syntax Description

Defaults

The sticky option is not in the server.

Command Modes

SLB virtual server configuration submode

Command History

Usage Guidelines

Sticky connections are not tracked. The group ID default is 0. The sticky feature is not used for other virtual servers. The network default is 255.255.255.255.

The last real server that was used for a connection from a client is stored for the duration value after the end of the client's latest connection. If a new connection from the client to the virtual server is initiated during that time, the same real server that was used for the previous connection is chosen for the new connection.

A nonzero sticky group ID must correspond to a sticky group previously created using the sticky command. Virtual servers in the same sticky group share sticky state information.

Examples

This example shows how to set the sticky timer duration and places the virtual server in a sticky group for connection coupling:

Cat6k-2(config-module-csm)# vserver PUBLIC_HTTP

Cat6k-2(config-slb-vserver)# sticky 60 group 3

Related Commands

advertise (virtual server submode)
reverse-sticky (virtual server submode)
show module csm sticky
show module csm vserver redirect
sticky
sticky-group (policy submode)

unidirectional (virtual server submode)

To select the traffic type and appropriate timeout value, use the unidirectional command in the SLB virtual server submode.

[no | default] unidirectional

Syntax Description

Defaults

The default is default.

Command Modes

SLB virtual server configuration submode

Command History

Usage Guidelines

The CSM selects the traffic type and the correct timeout behavior for that traffic. The current timeout value can be displayed using the show module csm vserver detail commands.

Examples

This example shows how to select the traffic type and the timeout behavior:

Cat6k-2(config-slb-vserver)# default unidirectional

Related Commands

show module csm vserver redirect

url-hash (virtual server submode)

To set the beginning and ending pattern of a URL to parse URLs for the URL hash load-balancing algorithm, use the url-hash command in the SLB virtual server configuration submode. To remove the hashing from service, use the no form of this command.

url-hash {begin-pattern | end-pattern} pattern

no url-hash

Syntax Description

Defaults

URL hasing is off.

Command Modes

SLB virtual server configuration submode

Command History

Usage Guidelines

The beginning and ending patterns apply to the URL hashing algorithm that is set using the predictor command in the SLB server farm submode.

Examples

This example shows how to specify a URL pattern to parse:

Cat6k-2(config-slb-vserver)# url hash begin pattern lslkjfsj

Related Commands

predictor (serverfarm submode)
show module csm vserver redirect

virtual (virtual server submode)

To configure virtual server attributes, use the virtual command in the SLB virtual server configuration submode. To set the virtual server's IP address to 0.0.0.0 and its port number to zero, use the no form of this command.

virtual ip-address [ip-mask] tcp port [service {ftp | rtsp | termination}]

virtual ip-address [ip-mask] udp port [service {rtsp | per packet}]

virtual ip-address [ip-mask] {any | protocol-number} [service per-packet]

no virtual ip-address

Syntax Description

Defaults

The default IP mask is 255.255.255.255.

Command Modes

SLB virtual server configuration submode

Command History

Usage Guidelines

Clients connecting to the virtual server use this address to access the server farm. A port of 0 (or any) means that this virtual server handles all ports not specified for handling by another virtual server with the same IP address. The port is used only for TCP or UDP load balancing. No virtual servers can be configured with the same virtual settings and VLAN.

The following TCP port names can be used in place of a number:

XOT—X25 over TCP (1998)

dns—Domain Name Service (53)

ftp—File Transfer Protocol (21)

https—HTTP over Secure Sockets Layer (443)

matip-a—Mapping of Airline Traffic over IP, Type A (350)

nntp—Network News Transport Protocol (119)

pop2—Post Office Protocol v2 (109)

pop3—Post Office Protocol v3 (110)

smtp—Simple Mail Transport Protocol (25)

telnet—Telnet (23)

www—World Wide Web—Hypertext Transfer Protocol (80)

any—Traffic for any port (the same as specifying a 0).

The Cisco Content Switching Module allows virtual server configuration with the service RTSP service. The implementation supports 4 ports from streams data traffic, and the number of media streams in one RTSP presentation is limited to 2. It is possible to handle the TCP and UDP traffic separately, and link them using sticky. This example (replace IP-x with valid IP address) shows how to separate TCP and UDP traffic:

Cat6k-2(config-module-csm)# serverfarm TEST

Cat6k-2(config-slb-sfarm)# nat server

Cat6k-2(config-slb-sfarm)# no nat client

Cat6k-2(config-module-csm)# real IP-1

Cat6k-2(config-slb-real)# inservice

Cat6k-2(config-module-csm)# real IP-2

Cat6k-2(config-slb-real)# inservice

Cat6k-2(config-module-csm)# real IP-3

Cat6k-2(config-slb-real)# inservice

!

Cat6k-2(config-module-csm)# sticky 7 netmask 255.255.255.255 address source timeout 5

!

Cat6k-2(config-module-csm)# vserver RTSP

Cat6k-2(config-slb-vserver)# virtual IP-4 tcp any

Cat6k-2(config-slb-vserver)# serverfarm TEST

Cat6k-2(config-slb-vserver)# sticky 5 group 7

Cat6k-2(config-slb-vserver)# persistent rebalance

Cat6k-2(config-slb-vserver)# inservice

!

Cat6k-2(config-module-csm)# vserver RTSP2

Cat6k-2(config-slb-vserver)# virtual IP-4 udp any

Cat6k-2(config-slb-vserver)# serverfarm TEST

Cat6k-2(config-slb-vserver)# sticky 5 group 7

Cat6k-2(config-slb-vserver)# persistent rebalance

Cat6k-2(config-slb-vserver)# inservice

Examples

This example shows how to create a virtual server and assign it an IP address, protocol, and port:

Cat6k-2(config-slb-vserver)# virtual 102.35.44.79 tcp 1 

Related Commands

advertise (virtual server submode)
show module csm vserver

vlan (virtual server submode)

To define which source VLANs may access the virtual server, use the vlan command in the SLB virtual server submode. To remove the VLAN, use the no form of this command.

vlan vlan-number local

no vlan

Syntax Description

Defaults

The default is all VLANs.

Command Modes

SLB virtual server configuration submode

Command History

Usage Guidelines

The VLAN must correspond to an SLB VLAN previously created with the vlan command.

Examples

This example shows how to specify a VLAN for virtual server access:

Cat6k-2(config-slb-vserver)# vlan 5

Related Commands

show module csm vserver redirect
show module csm vlan
vlan (virtual server submode)

vlan

To define which source VLANs may access the virtual server, and then enter the VLAN submode, use the vlan command in the CSM submode. To remove the VLAN, use the no form of this command.

vlan vlan-number

no vlan

Syntax Description

Defaults

The default is all VLANs.

Command Modes

SLB configuration submode

Command History

Usage Guidelines

The VLAN must correspond to an SLB VLAN previously created with the vlan command.

Examples

This example shows how to specify a VLAN for virtual server access:

Cat6k-2(config-slb-csm)# vlan 5

Related Commands

alias (VLAN submode)
gateway (VLAN submode)
ip address (VLAN submode)
route (VLAN submode)
show module csm vlan

alias (VLAN submode)

To assign multiple IP addresses to the CSM, use the alias command in the SLB VLAN configuration submode. To remove an alias IP addresses from the configuration, use the no form of this command.

alias ip-address netmask

no alias ip-address netmask

Syntax Description

Defaults

This command has no default settings.

Command Modes

SLB VLAN configuration submode

Command History

Usage Guidelines

This command allows you to place the CSM on a different IP network than real servers without using a router.

If the ICMP protocol does not terminate, you may need to set the idle timeout of these connections. The alias IP address in the CSM serves three purposes:

•It is a shared next hop (gateway) for two CSMs in the redundant configuration. The servers should point to the alias as the default gateway. The Route Health Injection (RHI) service would be using the alias IP address as the next hop when inserting a route.

•If ping is destined to the alias IP address, the CSM sends the reply back to the source MAC. This reply is useful when performing an ICMP probe from one CSM, across a firewall farm, to the other CSM alias address.

•In the Global Server Load Balancing (GSLB) configuration, the alias IP address is the destination VIP for the DNS request.

Examples

This example shows how to assign multiple IP addresses to the CSM:

Cat6k-2(config-slb-vlan-server)# alias 130.21.34.56 255.255.255.0

Cat6k-2(config-slb-vlan-server)# alias 130.22.35.57 255.255.255.0

Cat6k-2(config-slb-vlan-server)# alias 130.23.36.58 255.255.255.0

Cat6k-2(config-slb-vlan-server)# alias 130.24.37.59 255.255.255.0

Cat6k-2(config-slb-vlan-server)# alias 130.25.38.60 255.255.255.0

Related Commands

show module csm vlan
vlan (XML submode)

gateway (VLAN submode)

To configure a gateway IP address, use the gateway command in the SLB VLAN configuration submode. To remove the gateway from the configuration, use the no form of this command.

gateway ip-address

no gateway ip-address

Syntax Description

Defaults

This command has no default settings.

Command Modes

SLB VLAN configuration submode

Command History

Usage Guidelines

You can configure up to 7 gateways per VLAN with a total of up to 255 gateways for the entire system. A gateway must be in the same network as specified in the ip address SLB VLAN command.

Examples

This example shows how to configure a client-side gateway IP address:

Cat6k-2(config-slb-vlan-client)# gateway 130.21.34.56 

Related Commands

ip address (VLAN submode) (SLB VLAN configuration submode)
show module csm vlan
vlan (virtual server submode)

ip address (VLAN submode)

To assign an IP address to the CSM that is used for probes and ARP requests on a VLAN, use the ip address command in the SLB VLAN configuration submode. To remove the CSM IP address and disable probes and ARP requests from the configuration, use the no form of this command.

ip address ip-address netmask

no ip address

Syntax Description

Defaults

This command has no default settings.

Command Modes

SLB VLAN configuration submode

Command History

Usage Guidelines

This command is applicable for both server and client VLANs. Up to 255 unique VLAN IP addresses are allowed per module.

Examples

This example shows how to assign an IP address to the CSM:

Cat6k-2(config-slb-vlan-client)# ip address 130.21.34.56 255.255.255.0

Related Commands

show module csm vlan
vlan (virtual server submode)

route (VLAN submode)

To configure networks that are one Layer 3 hop away from the CSM, use the route command in the SLB VLAN configuration submode. To remove the subnet or gateway IP address from the configuration, use the no form of this command.

route ip-address netmask gateway gw-ip-address

no route ip-address netmask gateway gw-ip-address

Syntax Description

Defaults

This command has no default settings.

Command Modes

SLB VLAN configuration submode

Command History

Usage Guidelines

You specify the Layer 3 networks subnet address and the gateway IP address to reach the next-hop router. The gateway address must be in the same network as specified in the ip address SLB VLAN command.

Examples

This example shows how to configure a network to the CSM:

Cat6k-2(config-slb-vlan-server)# route 130.21.34.56 255.255.255.0 gateway 120.22.36.40

Related Commands

ip address (VLAN submode)
show module csm vlan
vlan (virtual server submode)

xml-config

To enable XML for a CSM module, and then enter the XML configuration submode, use the xml-config command. To remove the XML configuration, use the no form of this command.

xml-config

no xml-config

Defaults

This command has no default settings.

Command Modes

Module CSM configuration submode

Command History

Examples

This example shows how to display the XML configuration:

Cat6k-2(config-module-csm)# xml-config

Cat6k-2(config-slb-xml)# 

Related Commands

client-group (XML submode)
credentials (XML submode)
vlan (XML submode)

client-group (XML submode)

To allow only connections sourced from an IP address matching the client group, use the client-group command in the SLB XML configuration submode. To remove the client group connections, use the no form of this command.

client-group [1-99 | name]

no client-group

Syntax Description

Defaults

Client group connections are removed.

Command Modes

SLB XML configuration submode

Command History

Usage Guidelines

When a client group is specified, only connections sourced from an IP address matching that client group are accepted by the CSM XML configuration interface. If no client group is specified, then no source IP address check is performed. Only one client group may be specified.

Examples

This example shows how to specify a client group:

Cat6k-2(config-slb-xml)# client-group domino

Related Commands

xml-config

credentials (XML submode)

To define one or more username and password combinations, use the credentials command in the SLB XML configuration submode. To remove the credentials, use the no form of this command.

credentials user-name password

no credentials user-name

Syntax Description

Defaults

This command has no default settings.

Command Modes

SLB XML configuration submode

Command History

Usage Guidelines

When one or more credentials commands are specified, the CSM HTTP server authenticates user access.

Examples

This example shows how to specify the user and password credentials for access:

Cat6k-2(config-slb-xml)# credentials savis XXXXX

Related Commands

client-group (XML submode)
xml-config

inservice (XML submode)

To enable XML for use by the CSM, use the inservice command in the SLB XML configuration submode. If this command is not specified, XML is not used. To disable XML, use the no form of this command.

inservice

no inservice

Defaults

This command has no default settings.

Command Modes

SLB XML configuration submode

Command History

Examples

This example shows how to enable XML:

Cat6k-2(config-slb-xml)# inservice

Related Commands

xml-config

port (XML submode)

To specify the TCP port on which the CSM HTTP server listens, use the port command in the SLB XML configuration submode. To remove the port, use the no form of this command.

port port-number

no port

Syntax Description

Defaults

The default is port 80.

Command Modes

SLB XML configuration submode

Command History

Examples

This example shows how to specify the TCP port for the server:

Cat6k-2(config-slb-xml)# port 80

Related Commands

client-group (XML submode)

vlan (XML submode)

To restrict the CSM HTTP server to accept connections only from the specified VLAN, use the vlan command in the SLB XML configuration submode. To specify that all VLANs are accepted, use the no form of this command.

vlan id

no vlan

Syntax Description

Defaults

All VLANs are accepted.

Command Modes

SLB XML configuration submode

Command History

Examples

This example shows how to specify an owner for virtual server access:

Cat6k-2(config-slb-xml)# vlan 9

Related Commands

client-group (XML submode)