Cisco 4700M Mode d’emploi

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

Cisco 4700 Series Application Control

Engine Appliance Administration Guide

Software Version A3(2.x)

October 2009

Text Part Number: OL-20823-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL

STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT

WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT

SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE

OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH

ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT

LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF

DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,

WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO

OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

CCDE, CCENT, CCSI, Cisco Eos, Cisco Explorer, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase,

Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco TrustSec, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip

Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work,

Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and

Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the

Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity,

Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the

IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY,

PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are

registered trademarks of Cisco and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respect

ive owners. The use of the word partner does not imply a partnership relationship

between Cisco and any other company. (1002R)

Cisco 4700 Series Application Control Engine Appliance Administration Guide

iii

Cisco 4700 Series Application Control Engine Appliance Administration Guide

OL-20823-01

CONTENTS

Preface xi

Audience xi

How to Use This Guide xii

Related Documentation xiii

Symbols and Conventions xv

Obtaining Documentation, Obtaining Support, and Security Guidelines xvi

CHAPTER

1Setting Up the ACE 1-1

Prerequisites for Setting Up the ACE 1-2

Default Settings 1-2

Setting Up the ACE 1-4

Establishing a Console Connection on the ACE 1-4

Using the Setup Script to Enable Connectivity to the Device Manager 1-5

Connecting and Logging In to the ACE 1-8

Changing or Resetting the Administrative Password 1-9

Changing the Administrative Password 1-10

Resetting the Administrator Account Password 1-11

Assigning a Name to the ACE 1-12

Configuring an ACE Inactivity Timeout 1-13

Configuring a Message-of-the-Day Banner 1-14

Configuring the Date and Time 1-16

Setting the System Time and Date 1-16

Configuring the Time Zone 1-17

Adjusting for Daylight Saving Time 1-20

Synchronizing the ACE with an NTP Server 1-22

Configuring Terminal Settings 1-24

Configuring Terminal Display Attributes 1-24

Configuring Virtual Terminal Line Settings 1-26

Modifying the Boot Configuration 1-27

Setting the Boot Method from the Configuration Register 1-27

Setting the BOOT Environment Variable 1-28

Configuring the ACE to Bypass the Startup Configuration File During the Boot Process 1-29

Restarting the ACE 1-31

Restarting the ACE From the CLI 1-31

Contents

Cisco 4700 Series Application Control Engine Appliance Administration Guide OL-20823-01

Using the GRUB Boot Loader to Specify the System Boot Image During a Reload 1-32

Shutting Down the ACE 1-33

Displaying or Clearing the ACE Setup Configuration and Statistics 1-33

Displaying ACE Setup Configuration and Statistics 1-33

Displaying NTP Statistics and Information 1-33

Displaying Other ACE Setup Configuration Information 1-36

Clearing NTP Statistics 1-37

CHAPTER

2Enabling Remote Access to the ACE 2-1

Guidelines and Limitations 2-2

Default Settings 2-2

Enabling Remote Access to the ACE 2-3

Task Flow for Enabling Remote Access to the ACE 2-3

Configuring Remote Network Management Traffic Services 2-4

Creating and Configuring a Remote Management Class Map 2-5

Creating a Layer 3 and Layer 4 Remote Access Policy Map 2-9

Applying a Service Policy Globally to All VLAN Interfaces in the Same Context 2-11

Applying a Service Policy to a Specific VLAN Interface 2-13

Configuring the Maximum Number of Telnet Management Sessions 2-15

Configuring SSH Management Session Parameters 2-16

Configuring Maximum Number of SSH Sessions 2-16

Generating SSH Host Key Pairs 2-17

Terminating an Active User Session 2-19

Enabling ICMP Messages to the ACE 2-20

Directly Accessing a User Context Through SSH 2-21

Displaying Remote Access Session Information 2-22

Displaying Telnet Session Information 2-23

Displaying SSH Session Information 2-23

Displaying Other Remote Access Session Information 2-24

Configuration Example for Enabling Remote Access to the ACE 2-25

CHAPTER

3Managing ACE Software Licenses 3-1

Information about ACE Licenses 3-1

Guidelines and Limitations 3-5

Prerequisites 3-5

Default License Feature Capabilities 3-5

Managing ACE Appliance Software Licenses 3-6

Tasks for Ordering an Upgrade License and Generating a Key 3-6

Contents

Cisco 4700 Series Application Control Engine Appliance Administration Guide

OL-20823-01

Copying a License File to the ACE 3-6

Installing a New or Upgrade License File 3-7

Replacing a Demo License with a Permanent License 3-8

Removing a License 3-9

Removing a Performance Throughput, HTTP Compression, Application Acceleration License, or

SSL License 3-9

Removing a Virtual Context License 3-11

Backing Up an ACE License File 3-13

Retrieving an ACE License File 3-13

Displaying ACE License Configurations and Statistics 3-14

CHAPTER

4Managing the ACE Software 4-1

Saving Configuration Files 4-1

Saving the Configuration File in Flash Memory 4-2

Saving Configuration Files to a Remote Server 4-2

Copying the Configuration File to the disk0: File System 4-3

Merging the Startup-Configuration File with the Running-Configuration File 4-4

Displaying Configuration File Content 4-4

Clearing the Startup-Configuration File 4-6

Copying Configuration Files from a Remote Server 4-7

Using the File System on the ACE 4-8

Copying Files 4-8

Copying Files to Another Directory on the ACE 4-9

Copying Licenses 4-9

Copying a Packet Capture Buffer 4-10

Copying Files to a Remote Server 4-10

Copying Files from a Remote Server 4-12

Copying an ACE Software System Image to a Remote Server 4-12

Uncompressing Files in the disk0: File System 4-13

Untarring Files in the disk0: File System 4-14

Creating a New Directory 4-15

Deleting an Existing Directory 4-15

Moving Files 4-15

Deleting Files 4-16

Displaying Files Residing On the ACE 4-18

Saving show Command Output to a File 4-19

Managing Core Dump Files 4-21

Copying Core Dumps 4-21

Clearing the Core Directory 4-22

Contents

Cisco 4700 Series Application Control Engine Appliance Administration Guide OL-20823-01

Deleting a Core Dump File 4-23

Capturing Packet Information 4-23

Enabling the Packet Capture Function 4-24

Copying Packet Capture Buffer Information 4-25

Displaying or Clearing Packet Information 4-26

Displaying Packet Information 4-26

Clearing Capture Buffer Information 4-27

Using the Configuration Checkpoint and Rollback Service 4-27

Creating a Configuration Checkpoint 4-27

Deleting a Configuration Checkpoint 4-28

Rolling Back a Running Configuration 4-29

Displaying Checkpoint Information 4-29

Reformatting the Flash Memory 4-30

CHAPTER

5Displaying ACE Hardware and Software System Information 5-1

Information About Displaying ACE Hardware and Software Information 5-1

Displaying Hardware Information 5-2

Displaying Installed Software Information 5-3

Displaying System Processes and Memory Resources Limits 5-4

Displaying General System Process Information 5-4

Displaying Detailed Process Status Information and Memory Resource Limits 5-7

Displaying System Information 5-9

Displaying or Clearing ICMP Statistics 5-11

Displaying or Collecting Technical Information for Reporting Problems 5-13

CHAPTER

6Configuring Redundant ACEs 6-1

Information About Redundancy 6-1

Redundancy Protocol 6-2

Stateful Failover 6-3

FT VLAN 6-4

Configuration Synchronization 6-4

Redundancy State for Software Upgrade or Downgrade 6-5

Guidelines and Limitations 6-5

Default Settings 6-6

Configuring Redundant ACEs 6-7

Task Flow for Configuring Redundancy 6-7

Configuring Redundancy 6-9

Configuring an FT VLAN 6-9

Contents

vii

Cisco 4700 Series Application Control Engine Appliance Administration Guide

OL-20823-01

Configuring an Alias IP Address 6-11

Configuring an FT Peer 6-12

Configuring an FT Group 6-14

Modifying an FT Group 6-16

Specifying the Peer Hostname 6-16

Specifying the MAC Address Banks for a Shared VLAN 6-17

Forcing a Failover 6-18

Synchronizing Redundant Configurations 6-19

Configuring Tracking and Failure Detection 6-21

Configuring Tracking and Failure Detection for a Host or Gateway 6-22

Configuring Tracking and Failure Detection for an Interface 6-25

Displaying or Clearing Redundancy Information 6-27

Displaying Redundancy Information 6-28

Displaying Redundancy Configuration Information 6-28

Displaying Bulk Synchronization Command Failures on the Standby ACE 6-28

Displaying FT Group Information 6-29

Displaying the Redundancy Internal Software History 6-32

Displaying the IDMAP Table 6-32

Displaying Memory Statistics 6-32

Displaying Peer Information 6-33

Displaying FT Statistics 6-35

Displaying FT Tracking Information 6-36

Clearing Redundancy Statistics 6-39

Clearing Transport-Layer Statistics 6-39

Clearing Heartbeat Statistics 6-40

Clearing Tracking-Related Statistics 6-40

Clearing All Redundancy Statistics 6-40

Clearing the Redundancy History 6-40

Configuration Example of Redundancy 6-41

CHAPTER

7Configuring SNMP 7-1

Information About SNMP 7-1

Managers and Agents 7-2

SNMP Manager and Agent Communication 7-2

SNMP Traps and Informs 7-3

SNMPv3 CLI User Management and AAA Integration 7-3

CLI and SNMP User Synchronization 7-4

Multiple String Index Guidelines 7-4

Supported MIBs and Notifications 7-5

Contents

viii

Cisco 4700 Series Application Control Engine Appliance Administration Guide OL-20823-01

Default Settings for SNMP 7-30

Configuring SNMP 7-31

Task Flow for Configuring SNMP 7-31

Configuring SNMP Users 7-32

Defining SNMP Communities 7-35

Configuring an SNMP Contact 7-36

Configuring an SNMP Location 7-37

Configuring SNMP Notifications 7-38

Configuring SNMP Notification Hosts 7-38

Enabling SNMP Notifications 7-40

Enabling the IETF Standard for SNMP linkUp and linkDown Traps 7-42

Unmasking the SNMP Community Name and Community Security Name OIDs 7-43

Assigning a Trap-Source Interface for SNMP Traps 7-44

Accessing ACE User Context Data Through the Admin Context IP Address 7-45

Accessing User Context Data When Using SNMPv1/v2 7-45

Accessing User Context Data When Using SNMPv3 7-46

Configuring an SNMPv3 Engine ID for an ACE Context 7-46

Configuring SNMP Management Traffic Services 7-47

Creating and Configuring a Layer 3 and Layer 4 Class Map 7-48

Creating a Layer 3 and Layer 4 Policy Map 7-50

Applying a Service Policy Globally to All VLAN Interfaces in the Same Context 7-52

Applying a Service Policy to a Specific VLAN Interface 7-53

Displaying or Clearing SNMP and Service Policy Statistics 7-55

Displaying SNMP and Service Policy Statics 7-55

Displaying SNMP Statistical Information 7-55

Displaying SNMP Service Policy Statistics 7-58

Clearing SNMP Service Policy Statistics 7-59

Example of an SNMP Configuration 7-59

CHAPTER

8Configuring the XML Interface 8-1

Information About XML 8-1

HTTP and HTTPS Support with the ACE 8-2

HTTP Return Codes 8-3

Document Type Definition 8-4

Guidelines and Limitations 8-6

Default Settings 8-6

Configuring the XML Interface 8-7

Task Flow for Configuring XML 8-7

Configuring HTTP and HTTPS Management Traffic Services 8-8

Contents

Cisco 4700 Series Application Control Engine Appliance Administration Guide

OL-20823-01

Creating and Configuring a Class Map 8-8

Creating a Layer 3 and Layer 4 Policy Map 8-11

Applying a Service Policy Globally to All VLAN Interfaces in the Same Context 8-13

Applying a Service Policy to a Specific VLAN Interface 8-14

Enabling the Display of Raw XML Request show Command Output in XML Format 8-15

Accessing the ACE DTD File 8-18

Displaying or Clearing XML Service Policy Statistics 8-19

Displaying XML Service Policy Statistics 8-19

Clearing XML Service Policy Statistics 8-19

Example of ACE CLI Command and the XML Equivalent 8-20

APPENDIX

AUpgrading or Downgrading Your ACE Software A-1

Overview of Upgrading ACE Software A-1

Prerequisites for Upgrading Your ACE A-2

Changing the Admin Password A-2

Changing the www User Password A-2

Checking Your Configuration for FT Priority and Preempt A-2

Creating a Checkpoint A-2

Updating Your Application Protocol Inspection Configurations A-3

Performing Software Upgrades and Downgrades A-4

Task Flow for Upgrading the ACE Software A-4

Task Flow for Downgrading the ACE Software A-7

Copying the Software Upgrade Image to the ACE A-9

Configuring the ACE to Autoboot the Software Image A-10

Setting the Boot Variable A-10

Configuring the Configuration Register to Autoboot the Boot Variable A-10

Reloading the ACE A-11

Displaying Software Image Information A-11

Displaying the Boot Variable and Configuration Register A-12

Displaying the Software Version A-12

NDEX

Contents

Cisco 4700 Series Application Control Engine Appliance Administration Guide OL-20823-01

Autres manuels pour 4700M

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Cisco Logiciel

Cisco

Cisco DVD-ROM Manuel d'installation et d'exploitation

Cisco

Cisco Surveillance Media Server Mode d’emploi

Cisco

Cisco OL-6900-01 Manuel de l'opérateur

Cisco

Cisco C8510-CHAS5-RF - Catalyst 8510 Campus Switch Router Modular Expansion... Instructions d'installation et d'utilisation

Cisco

Cisco 15454-TCC - Network Processor Card Manuel utilisateur

Cisco

Cisco WS-SUP32-GE-3B - Supervisor Engine 32 Manuel utilisateur

Cisco

Cisco PIX 520 - PIX Firewall 520 Guide de référence

Cisco

Cisco TELEPRESENCE MANAGEMENT SUITE Manuel utilisateur

Cisco

Cisco ONS 15327 Manuel utilisateur

Cisco

Cisco AP775A - Nexus Converged Network Switch 5010 Manuel utilisateur

Cisco

Cisco Unified Contact Center Express Manuel utilisateur

Cisco

Cisco IP Communicator Manuel utilisateur

Cisco

Cisco AS5200 - Universal Access Server Comment utiliser

Cisco

Cisco CCNA NETWORK SIMULATOR Manuel utilisateur

Cisco

Cisco 1701 Mode d’emploi

Cisco

Cisco TELEPRESENCE MANAGEMENT SUITE EXTENSION 2.2 - FOR MICROSOFT... Manuel utilisateur

Cisco

Cisco 1811W - Integrated Services Router Wireless Mode d’emploi

Cisco

Cisco PIX 520 - PIX Firewall 520 Manuel utilisateur

Cisco

Cisco Network Assistant Manuel utilisateur

Cisco

Cisco XO Manuel utilisateur

Cisco

Cisco TrustSec 3.0 Comment utiliser

Cisco

Cisco Digital Media Player Manuel utilisateur

Cisco

Cisco 11.0 BT Comment utiliser

Cisco

Cisco III - Supervisor Engine III Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur