Cisco 4700M Instruction Manual

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco 4700 Series Application Control
Engine Appliance Administration Guide
Software Version A3(2.x)
October 2009
Text Part Number: OL-20823-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
CCDE, CCENT, CCSI, Cisco Eos, Cisco Explorer, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase,
Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco TrustSec, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip
Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work,
Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and
Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the
Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity,
Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the
IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY,
PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are
registered trademarks of Cisco and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respect
ive owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (1002R)
Cisco 4700 Series Application Control Engine Appliance Administration Guide
Copyright © 2007-2008 Cisco Systems, Inc. All rights reserved.

iii
Cisco 4700 Series Application Control Engine Appliance Administration Guide
OL-20823-01
CONTENTS
Preface xi
Audience xi
How to Use This Guide xii
Related Documentation xiii
Symbols and Conventions xv
Obtaining Documentation, Obtaining Support, and Security Guidelines xvi
CHAPTER 1Setting Up the ACE 1-1
Prerequisites for Setting Up the ACE 1-2
Default Settings 1-2
Setting Up the ACE 1-4
Establishing a Console Connection on the ACE 1-4
Using the Setup Script to Enable Connectivity to the Device Manager 1-5
Connecting and Logging In to the ACE 1-8
Changing or Resetting the Administrative Password 1-9
Changing the Administrative Password 1-10
Resetting the Administrator Account Password 1-11
Assigning a Name to the ACE 1-12
Configuring an ACE Inactivity Timeout 1-13
Configuring a Message-of-the-Day Banner 1-14
Configuring the Date and Time 1-16
Setting the System Time and Date 1-16
Configuring the Time Zone 1-17
Adjusting for Daylight Saving Time 1-20
Synchronizing the ACE with an NTP Server 1-22
Configuring Terminal Settings 1-24
Configuring Terminal Display Attributes 1-24
Configuring Virtual Terminal Line Settings 1-26
Modifying the Boot Configuration 1-27
Setting the Boot Method from the Configuration Register 1-27
Setting the BOOT Environment Variable 1-28
Configuring the ACE to Bypass the Startup Configuration File During the Boot Process 1-29
Restarting the ACE 1-31
Restarting the ACE From the CLI 1-31

Contents
iv
Cisco 4700 Series Application Control Engine Appliance Administration Guide OL-20823-01
Using the GRUB Boot Loader to Specify the System Boot Image During a Reload 1-32
Shutting Down the ACE 1-33
Displaying or Clearing the ACE Setup Configuration and Statistics 1-33
Displaying ACE Setup Configuration and Statistics 1-33
Displaying NTP Statistics and Information 1-33
Displaying Other ACE Setup Configuration Information 1-36
Clearing NTP Statistics 1-37
CHAPTER 2Enabling Remote Access to the ACE 2-1
Guidelines and Limitations 2-2
Default Settings 2-2
Enabling Remote Access to the ACE 2-3
Task Flow for Enabling Remote Access to the ACE 2-3
Configuring Remote Network Management Traffic Services 2-4
Creating and Configuring a Remote Management Class Map 2-5
Creating a Layer 3 and Layer 4 Remote Access Policy Map 2-9
Applying a Service Policy Globally to All VLAN Interfaces in the Same Context 2-11
Applying a Service Policy to a Specific VLAN Interface 2-13
Configuring the Maximum Number of Telnet Management Sessions 2-15
Configuring SSH Management Session Parameters 2-16
Configuring Maximum Number of SSH Sessions 2-16
Generating SSH Host Key Pairs 2-17
Terminating an Active User Session 2-19
Enabling ICMP Messages to the ACE 2-20
Directly Accessing a User Context Through SSH 2-21
Displaying Remote Access Session Information 2-22
Displaying Telnet Session Information 2-23
Displaying SSH Session Information 2-23
Displaying Other Remote Access Session Information 2-24
Configuration Example for Enabling Remote Access to the ACE 2-25
CHAPTER 3Managing ACE Software Licenses 3-1
Information about ACE Licenses 3-1
Guidelines and Limitations 3-5
Prerequisites 3-5
Default License Feature Capabilities 3-5
Managing ACE Appliance Software Licenses 3-6
Tasks for Ordering an Upgrade License and Generating a Key 3-6

Contents
v
Cisco 4700 Series Application Control Engine Appliance Administration Guide
OL-20823-01
Copying a License File to the ACE 3-6
Installing a New or Upgrade License File 3-7
Replacing a Demo License with a Permanent License 3-8
Removing a License 3-9
Removing a Performance Throughput, HTTP Compression, Application Acceleration License, or
SSL License 3-9
Removing a Virtual Context License 3-11
Backing Up an ACE License File 3-13
Retrieving an ACE License File 3-13
Displaying ACE License Configurations and Statistics 3-14
CHAPTER 4Managing the ACE Software 4-1
Saving Configuration Files 4-1
Saving the Configuration File in Flash Memory 4-2
Saving Configuration Files to a Remote Server 4-2
Copying the Configuration File to the disk0: File System 4-3
Merging the Startup-Configuration File with the Running-Configuration File 4-4
Displaying Configuration File Content 4-4
Clearing the Startup-Configuration File 4-6
Copying Configuration Files from a Remote Server 4-7
Using the File System on the ACE 4-8
Copying Files 4-8
Copying Files to Another Directory on the ACE 4-9
Copying Licenses 4-9
Copying a Packet Capture Buffer 4-10
Copying Files to a Remote Server 4-10
Copying Files from a Remote Server 4-12
Copying an ACE Software System Image to a Remote Server 4-12
Uncompressing Files in the disk0: File System 4-13
Untarring Files in the disk0: File System 4-14
Creating a New Directory 4-15
Deleting an Existing Directory 4-15
Moving Files 4-15
Deleting Files 4-16
Displaying Files Residing On the ACE 4-18
Saving show Command Output to a File 4-19
Managing Core Dump Files 4-21
Copying Core Dumps 4-21
Clearing the Core Directory 4-22

Contents
vi
Cisco 4700 Series Application Control Engine Appliance Administration Guide OL-20823-01
Deleting a Core Dump File 4-23
Capturing Packet Information 4-23
Enabling the Packet Capture Function 4-24
Copying Packet Capture Buffer Information 4-25
Displaying or Clearing Packet Information 4-26
Displaying Packet Information 4-26
Clearing Capture Buffer Information 4-27
Using the Configuration Checkpoint and Rollback Service 4-27
Creating a Configuration Checkpoint 4-27
Deleting a Configuration Checkpoint 4-28
Rolling Back a Running Configuration 4-29
Displaying Checkpoint Information 4-29
Reformatting the Flash Memory 4-30
CHAPTER 5Displaying ACE Hardware and Software System Information 5-1
Information About Displaying ACE Hardware and Software Information 5-1
Displaying Hardware Information 5-2
Displaying Installed Software Information 5-3
Displaying System Processes and Memory Resources Limits 5-4
Displaying General System Process Information 5-4
Displaying Detailed Process Status Information and Memory Resource Limits 5-7
Displaying System Information 5-9
Displaying or Clearing ICMP Statistics 5-11
Displaying or Collecting Technical Information for Reporting Problems 5-13
CHAPTER 6Configuring Redundant ACEs 6-1
Information About Redundancy 6-1
Redundancy Protocol 6-2
Stateful Failover 6-3
FT VLAN 6-4
Configuration Synchronization 6-4
Redundancy State for Software Upgrade or Downgrade 6-5
Guidelines and Limitations 6-5
Default Settings 6-6
Configuring Redundant ACEs 6-7
Task Flow for Configuring Redundancy 6-7
Configuring Redundancy 6-9
Configuring an FT VLAN 6-9

Contents
vii
Cisco 4700 Series Application Control Engine Appliance Administration Guide
OL-20823-01
Configuring an Alias IP Address 6-11
Configuring an FT Peer 6-12
Configuring an FT Group 6-14
Modifying an FT Group 6-16
Specifying the Peer Hostname 6-16
Specifying the MAC Address Banks for a Shared VLAN 6-17
Forcing a Failover 6-18
Synchronizing Redundant Configurations 6-19
Configuring Tracking and Failure Detection 6-21
Configuring Tracking and Failure Detection for a Host or Gateway 6-22
Configuring Tracking and Failure Detection for an Interface 6-25
Displaying or Clearing Redundancy Information 6-27
Displaying Redundancy Information 6-28
Displaying Redundancy Configuration Information 6-28
Displaying Bulk Synchronization Command Failures on the Standby ACE 6-28
Displaying FT Group Information 6-29
Displaying the Redundancy Internal Software History 6-32
Displaying the IDMAP Table 6-32
Displaying Memory Statistics 6-32
Displaying Peer Information 6-33
Displaying FT Statistics 6-35
Displaying FT Tracking Information 6-36
Clearing Redundancy Statistics 6-39
Clearing Transport-Layer Statistics 6-39
Clearing Heartbeat Statistics 6-40
Clearing Tracking-Related Statistics 6-40
Clearing All Redundancy Statistics 6-40
Clearing the Redundancy History 6-40
Configuration Example of Redundancy 6-41
CHAPTER 7Configuring SNMP 7-1
Information About SNMP 7-1
Managers and Agents 7-2
SNMP Manager and Agent Communication 7-2
SNMP Traps and Informs 7-3
SNMPv3 CLI User Management and AAA Integration 7-3
CLI and SNMP User Synchronization 7-4
Multiple String Index Guidelines 7-4
Supported MIBs and Notifications 7-5

Contents
viii
Cisco 4700 Series Application Control Engine Appliance Administration Guide OL-20823-01
Default Settings for SNMP 7-30
Configuring SNMP 7-31
Task Flow for Configuring SNMP 7-31
Configuring SNMP Users 7-32
Defining SNMP Communities 7-35
Configuring an SNMP Contact 7-36
Configuring an SNMP Location 7-37
Configuring SNMP Notifications 7-38
Configuring SNMP Notification Hosts 7-38
Enabling SNMP Notifications 7-40
Enabling the IETF Standard for SNMP linkUp and linkDown Traps 7-42
Unmasking the SNMP Community Name and Community Security Name OIDs 7-43
Assigning a Trap-Source Interface for SNMP Traps 7-44
Accessing ACE User Context Data Through the Admin Context IP Address 7-45
Accessing User Context Data When Using SNMPv1/v2 7-45
Accessing User Context Data When Using SNMPv3 7-46
Configuring an SNMPv3 Engine ID for an ACE Context 7-46
Configuring SNMP Management Traffic Services 7-47
Creating and Configuring a Layer 3 and Layer 4 Class Map 7-48
Creating a Layer 3 and Layer 4 Policy Map 7-50
Applying a Service Policy Globally to All VLAN Interfaces in the Same Context 7-52
Applying a Service Policy to a Specific VLAN Interface 7-53
Displaying or Clearing SNMP and Service Policy Statistics 7-55
Displaying SNMP and Service Policy Statics 7-55
Displaying SNMP Statistical Information 7-55
Displaying SNMP Service Policy Statistics 7-58
Clearing SNMP Service Policy Statistics 7-59
Example of an SNMP Configuration 7-59
CHAPTER 8Configuring the XML Interface 8-1
Information About XML 8-1
HTTP and HTTPS Support with the ACE 8-2
HTTP Return Codes 8-3
Document Type Definition 8-4
Guidelines and Limitations 8-6
Default Settings 8-6
Configuring the XML Interface 8-7
Task Flow for Configuring XML 8-7
Configuring HTTP and HTTPS Management Traffic Services 8-8

Contents
ix
Cisco 4700 Series Application Control Engine Appliance Administration Guide
OL-20823-01
Creating and Configuring a Class Map 8-8
Creating a Layer 3 and Layer 4 Policy Map 8-11
Applying a Service Policy Globally to All VLAN Interfaces in the Same Context 8-13
Applying a Service Policy to a Specific VLAN Interface 8-14
Enabling the Display of Raw XML Request show Command Output in XML Format 8-15
Accessing the ACE DTD File 8-18
Displaying or Clearing XML Service Policy Statistics 8-19
Displaying XML Service Policy Statistics 8-19
Clearing XML Service Policy Statistics 8-19
Example of ACE CLI Command and the XML Equivalent 8-20
APPENDIX AUpgrading or Downgrading Your ACE Software A-1
Overview of Upgrading ACE Software A-1
Prerequisites for Upgrading Your ACE A-2
Changing the Admin Password A-2
Changing the www User Password A-2
Checking Your Configuration for FT Priority and Preempt A-2
Creating a Checkpoint A-2
Updating Your Application Protocol Inspection Configurations A-3
Performing Software Upgrades and Downgrades A-4
Task Flow for Upgrading the ACE Software A-4
Task Flow for Downgrading the ACE Software A-7
Copying the Software Upgrade Image to the ACE A-9
Configuring the ACE to Autoboot the Software Image A-10
Setting the Boot Variable A-10
Configuring the Configuration Register to Autoboot the Boot Variable A-10
Reloading the ACE A-11
Displaying Software Image Information A-11
Displaying the Boot Variable and Configuration Register A-12
Displaying the Software Version A-12
I NDEX

Contents
x
Cisco 4700 Series Application Control Engine Appliance Administration Guide OL-20823-01