IBM WebSphere XS40 Installation manual

WebSphere®DataPower XML Security Gateway XS40
Command Reference
Version 3.7.2


WebSphere®DataPower XML Security Gateway XS40
Command Reference
Version 3.7.2


Note
Before using this information and the product it supports, read the information in “Notices and trademarks” on page 1011.
First Edition (December 2008)
This edition applies to version 3, release 7, modification 2, level 0 of IBM WebSphere DataPower XML Security
Gateway XS40 and to all subsequent releases and modifications until otherwise indicated in new editions.
© Copyright International Business Machines Corporation 1999, 2008.
US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract
with IBM Corp.

Contents
Preface ..............xix
Who should read this document .......xix
Publications ..............xix
Installation and upgrade documentation . . . xix
Administration documentation .......xx
Development documentation .......xx
Reference documentation .........xx
Integration documentation ........xxi
Problem determination documentation ....xxi
Supplemental documentations .......xxi
Reading syntax statements .........xxii
Directories on the appliance ........xxii
Object name conventions .........xxiv
Typeface conventions ..........xxiv
Chapter 1. Initial login and common
commands .............1
Initial login commands ...........1
Common commands............2
admin-state ...............3
alias .................3
cancel.................4
clock .................5
configure terminal ............6
diagnostics ...............6
disable ................6
disconnect ...............7
echo .................7
enable ................7
exec .................8
exit .................9
help .................9
login ................10
ntp.................10
ping .................11
reset .................12
show ................12
shutdown ...............13
summary ...............13
switch domain .............14
template ...............14
test schema ..............15
test tcp-connection ............16
top.................16
traceroute ...............17
Chapter 2. Global configuration mode 19
aaapolicy ...............19
account (Common Criteria) .........19
acl.................21
action ................22
alias .................23
application-security-policy .........24
audit delete-backup (Common Criteria) .....25
audit level (Common Criteria) ........25
audit reserve (Common Criteria) .......25
cache schema ..............26
cache stylesheet .............27
cache wsdl ..............27
clear aaa cache .............28
clear arp ...............28
clear dns-cache .............29
clear pdp cache .............29
clear rbm cache .............30
clear xsl cache .............30
cli remote open .............31
cli telnet ...............31
compact-flash (Type 9235) .........33
compact-flash-initialize-filesystem (Type 9235) . . . 33
compact-flash-repair-filesystem (Type 9235) ....33
compile-options .............34
conformancepolicy ............35
copy.................35
create-tam-files .............37
crypto ................39
delete ................40
deployment-policy ............40
dir.................41
disable ................42
dns.................42
document-crypto-map ...........43
documentcache .............43
domain ................44
failure-notification ............44
file-capture ..............45
flash.................46
ftp-quote-command-list ..........46
host-alias ...............46
httpserv ...............47
import-execute .............48
import-package .............48
include-config .............49
input-conversion-map ...........50
interface ...............50
ip domain ...............51
ip host ................52
ip name-server .............53
iscsi-chap (Type 9235) ...........54
iscsi-fs-init (Type 9235) ..........54
iscsi-fs-repair (Type 9235) ..........55
iscsi-hba (Type 9235) ...........56
iscsi-target (Type 9235) ..........56
iscsi-volume (Type 9235) ..........56
loadbalancer-group ............57
locate-device (Type 9235) ..........57
known-host ..............58
ldap-search-parameters ..........59
load-interval ..............59
logging category.............60
logging event..............60
logging eventcode ............61
© Copyright IBM Corp. 1999, 2008 iii

logging eventfilter ............62
logging object .............63
logging target .............64
loglevel................64
logsize ................65
matching ...............66
memoization ..............67
message-matching ............68
message-type ..............68
metadata ...............69
mkdir ................69
monitor-action .............70
monitor-count .............70
monitor-duration ............71
move ................71
mpgw ................72
mtom ................73
network ...............73
nfs-client ...............74
nfs-dynamic-mounts ...........74
nfs-static-mount .............75
ntp.................75
ntp-service ..............76
peer-group ..............76
policy-attachments ............77
policy-parameters ............77
radius ................78
raid-activate (Type 9235) ..........78
raid-delete (Type 9235) ..........79
raid-initialize (Type 9235) ..........79
raid-rebuild (Type 9235) ..........79
raid-volume (Type 9235) ..........80
raid-volume-initialize-filesystem (Type 9235) . . . 80
raid-volume-repair-filesystem (Type 9235) ....81
rbm.................81
refresh stylesheet ............82
remove chkpoint ............82
reset domain ..............83
reset username .............84
restart domain .............85
rmdir ................85
rollback chkpoint ............86
rule.................87
save chkpoint..............88
save error-report.............89
save internal-state ............89
save-config overwrite ...........90
schema-exception-map...........90
search results ..............91
send error-report ............92
send file ...............92
service battery-installed ..........93
service nagle ..............93
service-monitor .............94
set-system-var .............94
simple-rate-limiter ............95
slm-action ...............96
slm-cred ...............96
slm-policy ...............97
slm-rsrc................97
slm-sched ...............97
snmp ................98
soap-disposition .............99
source-ftp-poller .............99
source-ftp-server ............100
source-http ..............100
source-https ..............100
source-nfs-poller ............101
source-raw ..............101
source-stateful-tcp ............102
ssh.................102
sslforwarder ..............103
sslproxy ...............105
ssltrace ...............107
startup ...............108
statistics ...............109
stylepolicy ..............109
no stylesheet .............110
switch domain .............111
syslog ................112
system................113
tam.................113
tcpproxy ...............114
template ...............115
test hardware .............116
test logging ..............116
test schema ..............117
test urlmap ..............118
test tcp-connection............119
test urlrefresh .............119
test urlrewrite .............120
tfim ................121
throttle ...............121
timezone ...............123
traceroute ..............123
uddi-registry .............123
uddi-subscription ............124
undo ................124
urlmap ...............125
urlrefresh...............126
urlrewrite ..............127
user ................127
user-agent ..............128
user-expire-password ...........128
user-password .............129
usergroup ..............129
vlan-sub-interface ............129
watchdog...............130
web-application-firewall ..........131
web-mgmt ..............131
webapp-error-handling ..........133
webapp-gnvc .............133
webapp-request-profile ..........134
webapp-response-profile..........134
webapp-session-management ........135
write memory .............135
wsgw ................136
wsm-agent ..............136
wsm-endpointrewrite...........136
wsm-rule ...............137
wsm-stylepolicy ............137
wsrr-server ..............138
iv Command Reference

wsrr-subscription ............138
wsrr-synchronize ............139
xml parser limits ............139
xml validate ..............139
xmlfirewall ..............141
xml-manager .............141
xml-mgmt ..............142
xpath-routing .............143
xsl cache size .............143
xsl checksummed cache ..........144
xslconfig ...............145
xslcoproc ...............145
xslproxy ...............147
xslrefresh ...............148
zos-nss ...............149
Chapter 3. AAA Policy configuration
mode ...............151
actor-role-id ..............151
authenticate ..............152
authorize ...............153
authorized-counter ...........154
cache-allow ..............154
cache-ttl ...............154
dos-valve...............155
extract-identity .............156
extract-resource.............156
ldap-suffix ..............157
ldap-version ..............157
log-allowed ..............158
log-allowed-level ............158
log-rejected ..............158
log-rejected-level ............159
map-credentials ............159
map-resource .............160
namespace-mapping ...........160
ping-identity-compatibility .........161
post-process ..............161
rejected-counter ............161
saml-artifact-mapping ..........162
saml-attribute .............162
saml-name-qualifier ...........163
saml-server-name ............163
saml-sign-alg .............163
saml-sign-cert .............164
saml-sign-hash .............164
saml-sign-key .............165
saml-valcred..............165
saml2-metadata.............165
ssl.................166
transaction-priority ...........166
wstrust-encrypt-key ...........166
Chapter 4. Access Control List
configuration mode.........169
allow ................169
deny ................170
Chapter 5. Application Domain
configuration mode.........173
config-mode ..............173
deployment-policy............173
domain-user (deprecated) .........174
file-monitoring .............175
file-permissions.............175
import-format .............176
import-url ..............176
local-ip-rewrite .............177
maxchkpoints .............177
reset domain .............178
visible-domain .............179
Chapter 6. Application Security Policy
configuration mode.........181
error-match ..............181
request-match .............182
response-match.............182
Chapter 7. Compact Flash
configuration mode (Type 9235) . . . 185
directory ...............185
read-only ...............185
Chapter 8. Compile Options Policy
configuration mode.........187
allow-soap-enc-array ...........187
debug ................187
minesc ...............188
profile ................188
stack-size ...............189
stream................189
strict ................190
try-stream ..............190
validate-soap-enc-array ..........191
wildcard-ignore-xsi-type..........191
wsdl-strict-soap-version ..........191
wsdl-validate-body ...........192
wsdl-validate-faults ...........192
wsdl-validate-headers ..........193
wsdl-wrapped-faults ...........194
wsi-validate ..............194
xacml-debug .............194
xslt-version ..............195
Chapter 9. Conformance Policy
configuration mode.........197
assert-bp10-conformance .........197
fixup-stylesheet.............197
ignored-requirements...........198
profiles ...............199
reject-include-summary ..........200
reject-level ..............200
report-level ..............201
report-target ..............202
response-properties-enabled ........202
response-reject-include-summary .......203
response-reject-level ...........203
response-report-level ...........204
response-report-target ..........204
Contents v

result-is-conformance-report ........205
Chapter 10. CRL configuration mode 207
bind-dn ...............207
bind-pass...............207
fetch-url ...............208
issuer ................208
read-dn ...............209
refresh................209
remote-address .............210
ssl-profile...............211
Chapter 11. Crypto configuration
mode ...............213
certificate...............213
cert-monitor ..............215
crl.................215
crypto-export .............216
crypto-import .............216
decrypt ...............217
encrypt ...............219
fwcred................220
hsm-clone-kwk (HSM models)........221
hsm-delete-key (HSM models)........222
hsm-reinit (HSM models) .........222
idcred ................222
kerberos-kdc .............224
kerberos-keytab ............224
key.................225
keygen ...............227
password-map .............230
profile ................231
sign ................236
sskey ................237
test password-map ...........239
valcred ...............240
validate ...............241
Chapter 12. Crypto Certificate Monitor
configuration mode.........243
disable-expired-certs ...........243
log-level ...............244
poll.................244
reminder ...............245
Chapter 13. Crypto Firewall
Credentials configuration mode . . . 247
certificate...............247
key.................247
sskey ................248
Chapter 14. Crypto Validation
Credentials configuration mode . . . 251
cert-validation-mode ...........251
certificate...............252
crldp ................253
explicit-policy .............253
initial-policy-set ............254
require-crl ..............255
use-crl................256
Chapter 15. Deployment Policy
configuration mode.........257
??? accept ..............257
??? filter ...............258
??? modify ..............259
Chapter 16. DNS Settings
configuration mode.........263
name-server ..............263
search-domain .............264
static-host ..............265
Chapter 17. Document Cache
configuration mode.........267
clear ................267
maxdocs ...............268
policy ................268
size.................270
static-document-calls ...........270
Chapter 18. Document Crypto Map
configuration mode.........273
namespace-mapping ...........273
operation ...............273
select ................274
Chapter 19. Failure Notification
configuration mode.........275
always-on-startup ............275
email-address .............275
internal-state .............275
location-id ..............276
remote-address .............276
Chapter 20. Flash configuration mode 277
boot config ..............277
boot delete ..............277
boot image ..............278
boot switch ..............278
boot update ..............279
copy ................280
delete ................282
dir.................283
move ................284
reinitialize ..............284
shutdown ..............285
Chapter 21. FTP Poller Front Side
Handler configuration mode .....287
delay-time ..............287
error-delete ..............287
error-rename-pattern ...........287
match-pattern .............288
processing-rename-pattern .........288
processing-seize-pattern ..........289
processing-seize-timeout..........290
vi Command Reference

result ................291
result-name-pattern ...........291
success-delete .............292
success-rename-pattern ..........292
target-dir ...............292
xml-manager .............293
Chapter 22. FTP Quoted Commands
configuration mode.........295
quoted-command ............295
Chapter 23. FTP Server Front Side
Handler mode ...........297
acl.................298
address ...............298
allow-ccc ...............299
allow-compression............299
allow-restart ..............300
allow-unique-filename ..........300
certificate-aaa-policy ...........300
data-encryption.............301
default-directory ............301
filesystem ..............302
filesystem-size .............303
idle-timeout ..............303
max-filename-len ............303
passive ...............304
passive-idle-timeout ...........304
passive-port-max ............305
passive-port-min ............306
passive-port-range............306
persistent-filesystem-timeout ........307
password-aaa-policy ...........307
port ................308
require-tls ..............308
response-nfs-mount ...........309
response-storage ............309
response-suffix .............310
response-type .............311
response-url ..............311
restart-timeout .............312
ssl.................312
unique-filename-prefix ..........312
virtual-directory ............313
Chapter 24. Hard Disk Array
configuration mode (Type 9235) . . . 315
directory ...............315
read-only ...............315
Chapter 25. Host Alias configuration
mode ...............317
ip-address ..............317
Chapter 26. HTTP Front Side Handler
mode ...............319
acl.................319
allowed-features ............320
compression ..............321
local-address .............321
http-client-version ............321
max-header-count ............322
max-header-name-len...........322
max-header-value-len...........323
max-querystring-len ...........323
max-total-header-len ...........323
max-url-len ..............324
persistent-connections ..........324
port ................325
Chapter 27. HTTP Input Conversion
Map configuration mode ......327
default-encoding ............327
rule ................328
Chapter 28. HTTP Service
configuration mode.........329
acl.................329
identifier ...............329
ip-address ..............330
local-directory .............330
mode ................331
port ................332
priority ...............332
start-page ..............332
Chapter 29. HTTPS Front Side Handler
mode ...............335
acl.................335
allowed-features ............336
compression ..............337
local-address .............337
http-client-version ............337
max-header-count ............338
max-header-name-len...........338
max-header-value-len...........339
max-querystring-len ...........339
max-total-header-len ...........339
max-url-len ..............340
persistent-connections ..........340
port ................341
ssl.................341
Chapter 30. Import Configuration File
configuration mode.........343
auto-execute..............343
deployment-policy............344
import-format .............344
local-ip-rewrite .............345
overwrite-files .............345
overwrite-objects ............345
source-url ..............346
Chapter 31. Include Configuration File
configuration mode.........347
auto-execute..............347
config-url...............347
interface-detection ............348
Contents vii

Chapter 32. Interface configuration
mode ...............351
arp.................351
dhcp ................351
ip address ..............352
ip default-gateway ...........353
ip route ...............353
mac-address ..............354
mode ................355
mtu ................355
packet-capture .............356
standby ...............357
Chapter 33. iSCSI CHAP configuration
mode (Type 9235) .........361
password...............361
username...............361
Chapter 34. iSCSI Host Bus Adapter
configuration mode (Type 9235) . . . 363
dhcp ................363
iname ................364
ip-address ..............364
ip default-gateway ...........365
Chapter 35. iSCSI Target configuration
mode (Type 9235) .........367
chap ................367
hba.................367
hostname...............368
port ................368
target-name ..............369
Chapter 36. iSCSI Volume
configuration mode (Type 9235) . . . 371
directory ...............371
lun.................371
read-only ...............372
target................372
Chapter 37. Kerberos KDC Server
configuration mode.........373
port ................373
realm ................373
server ................374
tcp.................374
udp-timeout ..............375
Chapter 38. Kerberos Keytab
configuration mode.........377
filename ...............377
use-replay-cache ............377
Chapter 39. LDAP Search Parameters
configuration mode.........379
base-dn ...............379
filter-prefix ..............379
filter-suffix ..............380
returned-attribute ............380
scope ................381
Chapter 40. Load Balancer Group
configuration mode.........383
algorithm...............383
damp ................384
giveup-when-all-members-down .......385
health-check ..............385
masquerade ..............387
server ................387
try-every-server ............388
Chapter 41. Log Target configuration
mode ...............389
ansi-color...............389
archive-mode .............389
backup ...............390
email-address .............390
encrypt ...............390
event ................391
event-code ..............392
event-detection .............392
event-filter ..............393
facility................394
feedback-detection............394
format................394
group (deprecated) ...........395
local-address .............395
local-file ...............396
local-ident ..............396
nfs-file................396
nfs-static-mount ............397
object ................397
rate-limit ...............398
remote-address .............398
remote-directory ............399
remote-login..............400
remote-port ..............401
retry (deprecated) ............402
rotate ................402
sender-address .............403
sign ................403
size.................403
smtp-domain .............404
soap-version..............405
ssl.................405
suppression-period ...........405
timeout (deprecated) ...........406
timestamp ..............406
type ................406
upload-method .............407
url.................408
Chapter 42. Matching Rule
configuration mode.........409
combine-with-or ............409
errorcode ...............409
fullurlmatch (deprecated) .........410
viii Command Reference