Config-Mode Commands
ssc host host-name interface dhcp
Configures host instance DHCP on the specified interface.
Syntax
ssc host host host-name name interface interface-name dhcp | [dns-nameservers dns-name-servers] | [dns-search dns-suffixes] | [auto]Parameters
nameSpecify the host name.
interface interface-nameSpecify the interface name
dhcpSpecify to enable DHCP on this interface.
dns-nameservers dns-name-serversOptionally, specify the DNS name server.
dns-search dns-suffixesOptionally, specify a comma separated list of searched domain suffixes.
autoOptionally, specify this interface to automatically start up.
Examples
amnesiac (config) # ssc host host host-name host1 interface lxcbr0 dhcpRelated Commands
ssc host host-name interface ip
Configures the static IP address for the specified interface.
Syntax
ssc host host host-name name interface interface-name ip ip-addr netmask netmask | [gateway ip-addr] | [dns-nameservers dns-name-servers] | [dns-search dns-suffixes] | [auto]Parameters
nameSpecify a unique name for the host.
interface interface-nameSpecify the interface name
ip ip-addrSpecify the IP address on this interface.
netmask netmask-addrSpecify the netmask address.
gateway ip-addrSpecify the IP address for the gateway.
dns-nameservers dns-name-serversSpecify the DNS name server.
dns-search dns-suffixesOptionally, specify a comma separated list of searched domain suffixes.
autoOptionally, specify this interface to automatically start up.
Examples
amnesiac (config) # ssc host host host-name host1 interface lxcbr0 ip 10.0.0.1 netmask 255.255.255.0 gateway 10.0.0.2Related Commands
ssc host host-name user
Configures the log in username and password for the Services Director host.
Syntax
ssc host host-name name user user password passwordParameters
nameSpecify the host name.
userSpecify the login username for the host.
passwordSpecify the login password for the host.
Examples
amnesiac (config) # ssc host host-name host1 user admin password test123Related Commands
ssc host list
Lists the Services Director hosts.
Syntax
ssc host listExamples
amnesiac (config) # ssc host list
+---------------+
| Host |
+---------------+
| tmainline68-h |
+---------------+Related Commands
ssc host ssh-clear-key
Clears known SSH host entries for a given host.
Syntax
ssc host ssh-clear-key host-name nameParameters
nameSpecify the host name.
Examples
amnesiac (config) # ssc host ssh-clear-key host-name host1Related Commands
ssc host update host-name
Updates values for a Services Director host.
Syntax
ssc host update host-name host | [username user] | [status [Active | Inactive]] | [usage-info description] | [max-instances number] | [cpu-cores string] | [info description]Parameters
hostSpecify the host name.
username userOptionally, specify the user for SSH access; this user must be root.
status [Active | Inactive]Specify the status:
ActiveActivates a resource.
InactiveDeactivates a resource. A resource cannot be marked as Inactive if it is in use. The resource cannot be reactivated Inactive status has been specified.
usage-info descriptionThis property is not used.
max-instances numberThe number of instances that you can create on this host.
cpu-cores stringThis property is not used.
info descriptionOptionally, specify descriptive information about the new host.
Usage Guidelines
Update a host resources to add or change common parameters.
Examples
*** Parameter change ***
amnesiac (config) # ssc host update host-name host1 status InactiveRelated Commands
ssc host update template-name
Updates a Services Director host based on the specified template.
Syntax
ssc host update template-name name | [host-name name] | [username name] | [status [Active | Inactive] ] | [info description]Parameters
nameSpecify the template name.
host-name nameSpecify the host name.
username nameOptionally, specify the user for SSH access; this user must be root.
status Active | InactiveSpecify the status:
ActiveActivates a resource.
InactiveDeactivates a resource. A resource cannot be marked as Inactive if it is in use. The resource cannot be reactivated Inactive status has been specified.
info descriptionOptionally, specify descriptive information about the new host.
Usage Guidelines
Update an instance host with the parameters predefined in an existing template. The existing template is created by the ssc template create command. The predefined parameters in the existing template are passed to the resource to update the command. You have the option to replace or add extra parameters that exist in the specified template (that is, add extra arguments).
Examples
amnesiac (config) # ssc host update template-name hosttemp1 status ActiveRelated Commands
ssc import-cert
Imports an SSL certificate.
Syntax
ssc import-cert cert-data | [import-key key-data] | [password password]Parameters
cert-dataSpecify the certificate data in PEM format.
import-key key-dataSpecify the key data in PEM format.
password passwordSpecify the private key password.
Usage Guidelines
You must import the SSL certificate and private key before you create instances.
Examples
amnesiac (config) # ssc import-cert "cert-data" import-key "<key-data>"Related Commands
ssc import-cert-key
Imports an SSL certificate and private key.
Syntax
ssc import-cert-key cert-data password passwordParameters
cert-dateSpecify the location of the SSL certificate and private key, for example, http, ftp, or scp URL (scp://username:password@host/path/filename).
password passwordOptionally, specify the private key password.
Usage Guidelines
You must import the SSL certificate and private key before you create instances.
Examples
amnesiac (config) # ssc import-cert-key scp://username:[email protected]/ssc_archive/cert_key.pem
Certificate and Private Key imported successfullyRelated Commands
ssc import-lic
Imports the Services Director license.
Syntax
ssc import-lic filename | file remote-file-pathParameters
filenameSpecify the Services Director license filename.
file remote-file-pathOptionally, specify the remote location of the license, for example <http, ftp, or scp URL (e.g. scp://username:password@host/path)>
Usage Guidelines
You must import the Services Director license before you create instances.
Examples
amnesiac (config) # ssc import-lic file scp://username:[email protected]/ssc_archive/taranis-license
License imported successfullyRelated Commands
ssc instance add instance-name
Adds an externally-deployed vTM instance to the estate of the Services Director.
Syntax
ssc instance add instance-name name bandwidth bandwidth owner instance-owner-name
stm-fpname feature-pack-name mgmt-address host-or-ip-addr [config-options string]
[admin-username username] [admin-password password] [rest-address uri-and-port]
[snmp-address ip-address] [ui-address ip-addr] [access-profile access-profile]
[analytics-profile analytics-profile]Parameters
instance-name nameThe name of the externally-deployed Traffic Manager instance.
bandwidth bandwidthThe maximum allowed bandwidth for the Traffic Manager instance (in Mbps).
owner ownerSpecify who owns the instance.
stm-fpname feature-pack-nameThe name of the feature_pack resource associated with the Traffic Manager instance. This represents the set of features that are available for the instance.
mgmt-address host-or-ip-addrSpecify the host name or IP address to reach the instance.
config-options stringA single configuration option is supported:
- snmp!community: The SNMP v2 community setting for this externally-deployed Traffic Manager instance. This must be set to the same value as the equivalent snmp!community property on the instance resource (default: "public").
Unlike Services Director-deployed instances, externally-deployed instances do not restart when config_options are changed.
admin-username nameThe user name for the admin account for the externally-deployed instance.
admin-password passwordThe password for the admin account for the externally-deployed instance.
rest-address host-or-ip-addrThe address (host or IP address plus port number) of the Traffic Manager instance configuration REST API. If left blank, it defaults to :9070. The rest-address must match the instance host name. If you use a hostname instead of an IP address, you must use a fully qualified domain name. You can modify this property only for a externally-deployed Traffic Manager instance (or in a database-only request).
snmp-address host-or-ip-addrThe address (host or IP address plus port number) of the Traffic Manager instance SNMP responder. This setting enables you to set the SNMP address used for metering. If you use a hostname instead of an IP address, you must use a fully qualified domain name. You can modify this property only for a externally-deployed Traffic Manager instance (or in a database-only request).
ui-address host-or-ip-addrThe address (host or IP address plus port number) of the Traffic Manager instance Administration UI. If you do not enter a value, the UI address defaults to :9090. If you use a hostname instead of an IP address, you must use a fully qualified domain name. You can modify this property only for a externally-deployed Traffic Manager instance (or in a database-only request).
access-profileThe access profile identifies the authenticator and permission groups required for the user authentication on this Traffic Manager instance.
Access profile is a cluster-level configuration property, and is typically set for the vTM cluster (see ssc cluster create cluster-name). The current cluster-level setting is displayed in this dialogue. If you provide a new value for this property, the analytics profile will be applied to the Traffic Manager, and all other traffic manager instances in its cluster.
See also ssc access-profile remove-perm-group.
analytics-profileThe analytics profile identifies the vTM analytics settings for this Traffic Manager instance.
Analytics profile is a cluster-level configuration property, and is typically set for the vTM cluster (see ssc cluster create cluster-name). If you provide a new value for this property, the analytics profile will be applied to the Traffic Manager, and all other traffic manager instances in its cluster.
Usage Guidelines
Before you create a externally-deployed Traffic Manager instance, ensure that you have created a feature pack for the Traffic Manager.
You cannot create a externally-deployed Traffic Manager instance using containers.
Use the no instance instance-name <name> to delete an instance.
Examples
amnesiac (config) # ssc instance add instance-name stm-i1 bandwidth 1200 owner janet stm-fpname default-fp mgmt-address test-demoRelated Commands
ssc instance create instance-name
Creates a vTM instance.
Syntax
ssc instance create instance-name name license-name name bandwidth bandwidth cpu-usage cpu owner instance-owner-name stm-fpname feature-pack-name stm-version stm-version-name host-name host mgmt-address host-or-ip-addr [config-options string] [cluster-id name] [container-name name] [container-cfg config-data] [deploy none] [managed yes-or-none] [status [Active | Inactive]]Parameters
instance-name nameSpecify a unique name for the Traffic Manager instance.
license-name nameThe name of the license resource you want to use for this instance. When you modify this property, the Services Director updates the license on the Traffic Manager instance.
bandwidth bandwidthSpecify the bandwidth allowed for this instance (in Mbps).
cpu-usage cpuA string that describes which CPUs are used for this Traffic Manager instance. If used, you must either:
- Specify a value in a form that is used by the taskset command. For example, "0,3,57".
- Set this property to an empty string. This indicates that the host is not limited in its use of CPU cores (unless it is deployed within an LXC container). This is the default setting for the property if you do not specify a string.
Any change to the cpu_usage settings will cause a restart of the instance.
owner nameSpecify a string that describes an owner of the instance.
stm-fpname feature-pack-nameSpecify the Traffic Manager feature-pack name associated with the instance.
stm-version stm-version-nameThe name of the Traffic Managerversion resource for the instance. If you modify this property, the Services Director upgrades the Traffic Manager instance to the new version. You can change this property only if the instance status is Idle.
host-name hostSpecify the name of the Traffic Manager instance host on which the instance is running.
mgmt-address host-or-ip-addrSpecify the host name or IP address to reach the instance.
config-options stringA string containing configuration options for optional features. If specified, this is a space-delimited combination of one or more the following:
- default: This option has no effect and is used to avoid an empty string. If this is option is used, no other options can be specified in the config_options.
- admin_ui=yes/no: Start or bypass the Administration UI for the Traffic Manager instance (default: yes). You must set this to yes if you use the cluster_id property.
- maxfds=number: The maximum number of file descriptors (default: 4096). This setting must be consistent between all instances in a cluster. (See Notes, below).
- webcache!size=number: The size of RAM for the web cache (default: 0). This value can be specified in %, MB, GB by appending the corresponding unit symbol to the end of the value when not specifying a value in bytes. For example, 100%, 256MB, 1GB, and so on. This setting must be consistent between all instances in a cluster. (See Notes, below).
- java!enabled=yes/no: Start or bypass the Java server (default: no). This setting must be consistent between all instances in a cluster. (See Notes, below).
- statd!rsync_enabled=yes/no: Synchronize historical activity data within a cluster. If this data is unwanted, disable this setting to save CPU and bandwidth (default: yes). This setting must be consistent between all instances in a cluster. (See Notes, below).
- snmp!community: The SNMP v2 community setting for this instance resource. For metering of externally-deployed instances, this must be set to the same value as the equivalent snmp!community property on the instance itself (default: "public").
- num_children=number: The number of child processes (default: 1).
- start_flipper=yes/no: Start or bypass the flipper process (default: yes). You must set this to yes if you use the cluster_id property.
- afm_deciders=number: The number of application firewall decider processes. If 0 is specified, the application firewall is not installed (default: 0). Note: You cannot update this option after the instance has been deployed.
- flipper!frontend_check_addrs=host: Check instance front-end connectivity with a specific host. When the Services Director deploys an instance, it checks connectivity to the default gateway of the instance host by sending ICMP requests to it. If the default gateway is protected by a firewall or blocks ICMP requests, instance deployment can fail. To disable deployment connectivity checks, use flipper!frontend_check_addrs="". This setting must be consistent between all instances in a cluster. (See Notes, below).
- flipper!monitor_interval=number: The interval, in milliseconds, between flipper monitoring actions. (default: 500 ms). For higher density Traffic Manager instance deployments, use a larger value such as 2000ms. This setting must be consistent between all instances in a cluster. (See Notes, below).
Any change to the config_options settings will cause a restart of the instance.
Some configuration options, if specified here, must be consistent between all Traffic Manager instances in a cluster:
- maxfds
- webcache!size
- java!enabled
- statd!rsync_enabled
- flipper!monitor_interval
- flipper!frontend_check_addrs
If you set or update the value in one instance resource, the Services Director replicates this update automatically to the other instance resources. The instance will restart whenever these are changed, but other instances in the cluster must be restarted manually.
Whenever the config_options property is set, all currently modified options must be specified again in the REST call. Any options that are not specified will lose their current value and be reset to their default value.
cluster-id ID-or-nameOptionally, specify the name of a cluster resource to which the instance belongs.
If you do not specify a cluster name, a new cluster name is generated automatically and assigned to the instance.
container-name nameSpecify the name of the LXC container in which the instance is running. If this is an empty string or none, the Traffic Manager is not run inside a container.
container-cfg config-dataOptionally, specify configuration data for the instance container. The string populates the container configuration file with the gateway IP, the management IP, the WAN IP, the LAN IP, the data plane gateway IP, and the flavor (also called size).
Use the following format:
"{'gateway': '10.5.27.1', 'mgmtip':'10.10.10.1/24', 'wanip':'10.10.10.2/24', 'lanip':'10.10.10.3/24', 'dataplanegw':'10.5.5.2', 'flavor':'small'}"Possible flavor values are: small= 256, 1 CPU, medium= 512 2 CPU, or large= 1024 4 CPU.
deploy noneThe default value is true. Specify none to apply changes to the database but not cause deployment changes. This setting supports testing and database reconciliation. No actions are carried out and no intermediate status is set. If a new instance resource is set to none then the status is set to Idle upon creation.
managed noneSpecify yes.
active [Active | Inactive]Specify the status:
- Active: Activates a resource.
- Inactive: Deactivates a resource. A resource cannot be marked as Inactive if it is in use. The resource cannot be reactivated Inactive status has been specified.
Usage Guidelines
Before you create a Traffic Manager instance, make sure you have:
- Imported the SSL certificate and key, the Services Director license, the enterprise bandwidth license key, and the Traffic Manager FLA license.
- Created a resource entry for the Traffic Manager FLA license.
- Imported the Traffic Manager image and created a resource entry for it.
- Imported the host OVA and created the host resource.
- Created a feature pack for the Traffic Manager.
- Provisioned the host OVA. When you execute the ssc host provision command, it un-tars the OVA, repackages the SSH public key created above and it is provisioned on ESXi. After the host is created in ESXi, the public key is assigned to the user defined in the ssc host provision command. After this command is executed you can SSH to the host without a password.
You can create instances without using containers, but you must ensure a degree of network isolation.
Before you create a container using the CLI, make sure that you have a host entry that includes the IP address and host name for the container you are going to create and that you can ping it.
Use the no instance instance-name <name> to delete an instance.
Examples
*** no container ***
amnesiac (config) # ssc instance create instance-name stm-i1 license name fla-ssl-ssc bandwidth 1200 cpu-usage 0 owner tim stm-fpname default-fp stm-version stm97 host-name test-demo mgmt-address test-demo
*** container ***
amnesiac (config) # ssc instance create instance-name stm-cont-i2 license name fla-ssl-ssc bandwidth 1200 cpu-usage 0 owner tim stm-fpname default-fp stm-version stm97 host-name test-demo mgmt-address 10.l0.10.1 container-name stm-cont-i1 container-cfg "{'gateway': '10.5.27.1', 'mgmtip':'10.10.10.1/24', 'wanip':'10.10.10.2/24', 'lanip':'10.10.10.3/24', 'dataplanegw':'10.5.5.2', 'flavor':'small'}"Related Commands
ssc instance force-start instance-name
Forces the status of the instance in the MySQL database to be Active.
Syntax
ssc instance force-start instance-name instanceParameters
instanceThe instance name.
Usage Guidelines
This command is used where there is an inconsistency between the actual status of the instance and the status of the instance in the MySQL database.
Examples
amnesiac (config) # ssc instance force-start instance-name DMaxhill-05
amnesiac (config) # ssc instance force-start instance-name Instance-345879389713Related Commands
show ssc instance instance-name, ssc instance start instance-name, ssc instance list, ssc instance force-stop instance-name
ssc instance force-stop instance-name
Forces the status of the instance in the MySQL database to be Idle.
Syntax
ssc instance force-stop instance-name instanceParameters
instanceThe instance name.
Usage Guidelines
This command is used where there is an inconsistency between the actual status of the instance and the status of the instance in the MySQL database.
Examples
amnesiac (config) # ssc instance force-stop instance-name DMaxhill-05
amnesiac (config) # ssc instance force-stop instance-name Instance-345879389713Related Commands
ssc instance list
Displays a list of names for vTM instances that are registered on the Services Director.
Syntax
ssc instance listExamples
amnesiac (config) # ssc instance list
+------------------------+
| Instance |
+------------------------+
| Pendragon-00 |
| Pendragon-01 |
| DMaxhill-05 |
| Instance-345879389713 |
+------------------------+Related Commands
ssc instance create instance-name, ssc instance start instance-name, ssc instance stop instance-name
ssc instance start instance-name
Starts a vTM instance.
Syntax
ssc instance start instance-name instanceParameters
instanceThe instance name.
Examples
amnesiac (config) # ssc instance start instance-name DMaxhill-05
amnesiac (config) # ssc instance start instance-name Instance-345879389713Related Commands
ssc instance stop instance-name
Stops a vTM instance.
Syntax
ssc instance stop instance-name instanceParameters
instanceThe instance name.
Examples
amnesiac (config) # ssc instance start instance-name DMaxhill-05
amnesiac (config) # ssc instance start instance-name Instance-345879389713Related Commands
ssc instance relicense instance-name
Relicenses a vTM instance that uses Universal FLA licensing. The instance must have its rest_enabled set to True .
Syntax
ssc instance relicense instance-name instanceParameters
instanceThe instance name.
Examples
amnesiac (config) # ssc instance relicense instance-name DMaxhill-05Related Commands
ssc instance update instance-name
Updates values in a vTM instance.
Syntax
ssc instance update instance-name instance [new-inst-name instance] [license-name name]
[bandwidth bandwidth] [cpu-usage cpu] [stm-fpname feature-pack-name] [stm-version stm-version-name] [config-options options] [container-cfg config-data] [managed yes-or-none] [deploy none]
[admin-username username] [admin-password password] [rest-address uri-and-port]
[snmp-address ip-address] [status [Active | Inactive]] [ui-address ip-addr] [access-profile access-profile] [analytics-profile analytics-profile]Parameters
instanceSpecify the name of the Traffic Manager instance.
new-inst-name instanceSpecify the new name for the instance.
license-name nameSpecify name of the FLA license resource for the instance
bandwidth bandwidthSpecify the bandwidth allowed for this instance.
cpu-usage cpuSpecify a string that describes which CPUs that can be used for the instance. The format can be used by the taskset command and typically is a single CPU number, such as 0. This command might be unnecessary depending on the container configuration.
stm-fpname feature-pack-nameSpecify the Traffic Manager feature-pack name associated with the instance.
stm-version stm-version-nameSpecify the name of the Traffic Manager version-resource for the instance. This is the Traffic Manager version name that is assigned when you imported the Traffic Manager into the Services Director.
host-name hostSpecify the name of the Traffic Manager instance host on which the instance is running.
mgmt-address host-or-ip-addrSpecify the host name or IP address to reach the instance.
config-options stringSpecify a string that defines the values for the instance container. The string populates the container configuration file with the gateway IP, the management IP, the WAN IP, the LAN IP, the data plane gateway IP, and the flavor or size: small= 256, 1 CPU, medium= 512 2 CPU, or large= 1024 4 CPU. Use the following format:
"{'gateway': '10.5.27.1', 'mgmtip':'10.10.10.1/24', 'wanip':'10.10.10.2/24', 'lanip':'10.10.10.3/24', 'dataplanegw':'10.5.5.2', 'flavor':'small'}"
container-cfg config-dataOptionally, specify configuration data for the instance container.
managed yes-or-noneSpecify yes for Services Director-deployed instances or none for externally-deployed instances.
deploy noneThe default value is true. Specify none to apply changes to the database but not cause deployment changes. This setting supports testing and database reconciliation. No actions are carried out and no intermediate status is set. If a new instance resource is set to none then the status is set to Idle upon creation.
admin-username usernameSpecify only for externally-deployed instances. Specify the user name of the Traffic Manager instance-administrator user.
admin-password passwordSpecify only for externally-deployed instances. Specify the password of the Traffic Manager instance-administrator user.
rest-address uri-and-portSpecify only for externally-deployed instances. Specify the IP address, including the port, for the instance REST API.
snmp-address ip-addressSpecify only for externally-deployed instances. Specify the IP address, including the port, for the Traffic Manager instance SNMP server.
active [Active | Inactive]Specify the status:
- Active: Activates a resource.
- Inactive: Deactivates a resource. A resource cannot be marked as Inactive if it is in use. The resource cannot be reactivated Inactive status has been specified.
ui-address ip-addrSpecify only for externally-deployed instances. Specify the IP address, including the port, for the Traffic Manager instance Admin UI.
access-profileThe access profile identifies the authenticator and permission groups required for the user authentication on this Traffic Manager instance.
Access profile is a cluster-level configuration property, and is typically set for the vTM cluster (see ssc cluster create cluster-name). The current cluster-level setting is displayed in this dialogue. If you provide a new value for this property, the analytics profile will be applied to the Traffic Manager, and all other traffic manager instances in its cluster.
See also ssc access-profile remove-perm-group.
analytics-profileThe analytics profile identifies the vTM analytics settings for this Traffic Manager instance.
Analytics profile is a cluster-level configuration property, and is typically set for the vTM cluster (see ssc cluster create cluster-name). If you provide a new value for this property, the analytics profile will be applied to the Traffic Manager, and all other traffic manager instances in its cluster.
Examples
amnesiac (config) # ssc instance update instance-name inst1 admin-user root admin-password 1234Related Commands
ssc instance update template-name
Updates a vTM instance based on the specified template.
Syntax
ssc instance update template-name name instance-name instance [new-inst-name instance]
[license-name name] [bandwidth bandwidth] [cpu-usage cpu] [stm-fpname feature-pack-name]
[stm-version stm-version-name] [config-options options] [container-cfg configdata]
[managed yes-or-none] [deploy none] [admin-username username] [admin-password password]
[rest-address uri-and-port] [snmp-address ip-address] [status [Active | Inactive]] [ui-address ip-addr] [access-profile access-profile] [analytics-profile analytics-profile]Parameters
template-name nameSpecify the template name.
instance-name instanceSpecify the current instance name.
new-inst-name instanceSpecify the new name for the instance.
license-name nameSpecify name of the FLA license resource for the instance
bandwidth bandwidthSpecify the bandwidth allowed for this instance.
cpu-usage cpuSpecify a string that describes which CPUs that can be used for the instance. The format can be used by the taskset command and typically is a single CPU number, such as 0. This command might be unnecessary depending on the container configuration.
stm-fpname feature-pack-nameSpecify the Traffic Manager feature-pack name associated with the instance.
stm-version stm-version-nameSpecify the name of the Traffic Manager version-resource for the instance. This is the Traffic Manager version name that is assigned when you imported the Traffic Manager into the Services Director.
host-name hostSpecify the name of the Traffic Manager instance host on which the instance is running.
mgmt-address host-or-ip-addrSpecify the host name or IP address to reach the instance.
config-options stringSpecify a string that defines the values for the instance container. The string populates the container configuration file with the gateway IP, the management IP, the WAN IP, the LAN IP, the data plane gateway IP, and the flavor or size: small= 256, 1 CPU, medium= 512 2 CPU, or large= 1024 4 CPU. Use the following format:
"{'gateway': '10.5.27.1', 'mgmtip':'10.10.10.1/24', 'wanip':'10.10.10.2/24', 'lanip':'10.10.10.3/24', 'dataplanegw':'10.5.5.2', 'flavor':'small'}"
container-cfg config-dataOptionally, specify configuration data for the instance container.
managed yes-or-noneSpecify yes for Services Director-deployed instances or none for externally-deployed instances.
deploy noneThe default value is true. Specify none to apply changes to the database but not cause deployment changes. This setting supports testing and database reconciliation. No actions are carried out and no intermediate status is set. If a new instance resource is set to none then the status is set to Idle upon creation.
admin-username usernameSpecify only for externally-deployed instances. Specify the user name of the Traffic Manager instance-administrator user.
admin-password passwordSpecify only for externally-deployed instances. Specify the password of the Traffic Manager instance-administrator user.
rest-address uri-and-portSpecify only for externally-deployed instances. Specify the IP address, including the port, for the instance REST API.
snmp-address ip-addressSpecify only for externally-deployed instances. Specify the IP address, including the port, for the Traffic Manager instance SNMP server.
active [Active | Inactive]Specify the status:
- Active: Activates a resource.
- Inactive: Deactivates a resource. A resource cannot be marked as Inactive if it is in use. The resource cannot be reactivated Inactive status has been specified.
ui-address ip-addrSpecify only for externally-deployed instances. Specify the IP address, including the port, for the Traffic Manager instance Admin UI.
access-profileThe access profile identifies the authenticator and permission groups required for the user authentication on this Traffic Manager instance.
Access profile is a cluster-level configuration property, and is typically set for the vTM cluster (see ssc cluster create cluster-name). The current cluster-level setting is displayed in this dialogue. If you provide a new value for this property, the analytics profile will be applied to the Traffic Manager, and all other traffic manager instances in its cluster.
See also ssc access-profile remove-perm-group.
analytics-profileThe analytics profile identifies the vTM analytics settings for this Traffic Manager instance.
Analytics profile is a cluster-level configuration property, and is typically set for the vTM cluster (see ssc cluster create cluster-name). If you provide a new value for this property, the analytics profile will be applied to the Traffic Manager, and all other traffic manager instances in its cluster.
Usage Guidelines
Updates a Traffic Manager instance with the parameters predefined in an existing template. The existing template is created by the ssc template create command. The predefined parameters in the existing template are passed to the resource to update the command. You have the option to replace or add extra parameters that exist in the specified template (that is, add extra arguments).
Examples
amnesiac (config) # ssc instance update template-name tempinst1 instance-name inst1 admin-user root admin-password 1234Related Commands
ssc kpti
Changes the reboot setting for the Kernel Page-Table Isolation (KPTI) feature.
Syntax
ssc kpti [ enable | disable ]Examples
*** check current state ***
amnesiac (config) # show ssc kpti
KPTI is currently enabled and will remain enabled after reboot.
*** request a change of state ***
amnesiac (config) # ssc kpti disable
Disabled KPTI for next boot. Use "reload" to reboot.Related Commands
show ssc kpti, reload
ssc license enterprise add-on
Activates the enterprise add-on license.
Syntax
[no] ssc license enterprise add-on add license-keyParameters
add license-key
Specify the add-on license key.
Usage Guidelines
For detailed information about add-on licenses, see Services Director Advanced User Guide. Use the no ssc license enterprise add-on <license key> command option to deactivate the enterprise add-on license.
Examples
amnesiac (config) # ssc license enterprise add-on XXXXX-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXRelated Commands
ssc license enterprise add-on list
Displays a list of add-on licenses installed.
Syntax
ssc license enterprise add-on list licenseParameters
license(Optional) Specify an Enterprise add-on license.
Examples
amnesiac (config) # ssc license enterprise add-on list
+-----------------------------------------+
| Enterprise Add-On Licenses |
+-----------------------------------------+
| 417928-23bbc2fb77767ac82db4df862658cabb |
+-----------------------------------------+
amnesia (config) # show ssc license enterprise add-on 417928-23bbc2fb77767ac82db4df862658cabb
+---------------------------+-----------------------------------------------------
| Field | Value
+---------------------------+-----------------------------------------------------
| valid_until | 2016-10-07
| timestamp | 2016-09-27T21:37:13.1475037433
| controller_license | ERSSC381243-0000-42B9
| bandwidth | 5000.0
| serial | 417928
| license_key | LK1-ERSSCAPADD_FIPS:5:417928:20160924237433-0000-...
| controller_license_serial | 381243
| valid_from | Perpetual
| add_on_sku | ADD-FIPS
| valid | True
+---------------------------+-----------------------------------------------------Related Commands
ssc license enterprise bandwidth activate
Activates an enterprise bandwidth license.
Syntax
ssc license enterprise bandwidth activate license-keyParameters
license-keySpecify the enterprise bandwidth license key.
Usage Guidelines
You can have one or more bandwidth licenses depending on the needs of your enterprise. The bandwidth licenses are activated when you import the license key.
Use the no ssc license enterprise bandwidth <license key> command to delete an enterprise bandwidth license.
Examples
amnesiac (config) # ssc license enterprise bandwidth activate 116415-0e60bc0fe6b16d659b90d732
+---------------------------+-----------------------------------------------------
| Field | Value
+---------------------------+-----------------------------------------------------
| status | Active
| valid_until | 2016-10-07
| timestamp | 2016-09-27T21:37:13.1475037433
| controller_license | ERSSC381243-0000-42B9
| bandwidth | 5000.0
| valid_from | Perpetual
| serial | 115415
| license_key | LK1-ERSSCTPSTM_B_400:5:116415:20160927T213713147...
| controller_license_serial | 381243
| stm_sku | STM-400
| valid | True
+---------------------------+-----------------------------------------------------Related Commands
ssc license enterprise bandwidth add
Adds an enterprise bandwidth license.
Syntax
ssc license enterprise bandwidth add license-keyParameters
license-keySpecify the enterprise bandwidth license key.
Usage Guidelines
You can have one or more bandwidth licenses depending on the needs of your enterprise. The bandwidth licenses are activated when you import the license key.
Use the no ssc license enterprise bandwidth <license key> command to delete an enterprise bandwidth license.
Examples
amnesiac (config) # ssc license enterprise bandwidth add LK1-ERSSCTPSTM_B_400:5:115415:20160927T27433-0000-43B9-5-5263-460B-1E66
+---------------------------+-----------------------------------------------------
| Field | Value
+---------------------------+-----------------------------------------------------
| status | Active
| valid_until | 2016-10-07
| timestamp | 2016-09-27T21:37:13.1475037433
| controller_license | ERSSC381243-0000-43B9
| bandwidth | 5000.0
| valid_from | Perpetual
| serial | 115415
| license_key | LK1-ERSSCTPSTM_B_400:5:115415:20160927T2265764750...
| controller_license_serial | 381243
| stm_sku | STM-400
| valid | True
+---------------------------+-----------------------------------------------------Related Commands
ssc license enterprise bandwidth list
Lists enterprise bandwidth license keys.
Syntax
ssc license enterprise bandwidth listUsage Guidelines
You can have one or more bandwidth licenses depending on the needs of your enterprise. The bandwidth licenses are activated when you import the license key.
Examples
amnesiac (config) # ssc license enterprise bandwidth list
+-----------------------------------------+
| Enterprise Bandwidth Licenses |
+-----------------------------------------+
| 342005-5e876d4bc34885e04f2c58867e21f1cf |
+-----------------------------------------+Related Commands
ssc license enterprise controller list
Lists enterprise controller license keys.
Syntax
ssc license enterprise controller listUsage Guidelines
Use no license enterprise controller <key> to delete an enterprise controller license.
Examples
amnesiac (config) # ssc license enterprise controller list
+--------------------------------+
| Enterprise Controller Licenses |
+--------------------------------+
| ERSSC381244-0000-52A9 |
+--------------------------------+Related Commands
ssc license enterprise resource-pack add
Adds a resource pack license key.
Syntax
ssc license enterprise resource-pack add license-keyUsage Guidelines
Use no license enterprise resource-pack <key> to delete an enterprise resource pack license.
Examples
amnesiac (config) # ssc license enterprise resource-pack add LK1-
BR_ADC_RES_EMBAS5I_S_01:5:261755:2017081341503363094-0000-4401-5-6DC1-34C2-7045
+---------------------------+------------------------------------------------------
| Field | Value
+---------------------------+------------------------------------------------------
| valid_until | 2017-08-31
| timestamp | 2017-08-21T17:51:34.1503363094
| controller_license |
| valid_from | Perpetual
| license_key | LK1-BR_ADC_RES_EMBAS5I_S_01:5:261755:2017081341503...
| serial | 261755
| controller_license_serial |
| stm_sku | ENT-ENTM
| resource_amount | 5
| valid | False
+---------------------------+------------------------------------------------------Related Commands
ssc license enterprise resource-pack list
Lists resource pack license keys.
Syntax
ssc license enterprise resource-pack listUsage Guidelines
Use no license enterprise resource-pack <key> to delete an enterprise resource pack license.
Examples
*** list resource pack licenses ***
amnesiac (config) # ssc license enterprise resource-pack list
+---------------------------------------------------------------------------------+
| Enterprise Resource-Pack Licenses |
+---------------------------------------------------------------------------------+
| LK1-BR_ADC_RES_EMBAS5I_S_01:5:261755:2017341363094-0000-4401-5-6DC1-34C2-7045 |
+---------------------------------------------------------------------------------+
*** delete a resource pack license ***
amnesiac (config) # no ssc license enterprise resource-pack
LK1-BR_ADC_RES_EMBAS5I_S_01:5:261755:2017341363094-0000-4401-5-6DC1-34C2-7045
Successfully deleted resource-pack key
(LK1-BR_ADC_RES_EMBAS5I_S_01:5:261755:2017341363094-0000-4401-5-6DC1-34C2-7045)Related Commands
ssc license list
Displays a list of FLA licenses that are present. Where no FLA license is present, this is indicated.
Syntax
ssc license listExamples
amnesiac (config) # ssc license list
+--------------+
| License |
+--------------+
| universal_v4 |
| legacy_9.3 |
+--------------+Related Commands
ssc log metering clear
Deletes backup Services Director metering logs.
Syntax
ssc log metering clearExamples
amnesiac (config) # ssc log metering clearRelated Commands
ssc log metering generate
Extracts metering logs.
Syntax
ssc log metering generate [backup [yes | no]]Parameters
backup yes/noOptional. Specify to indicate whether previously-generated logs are to be included. New logs are always included.
Examples
amnesiac (config) # ssc log metering generate backup noIn this example, the backup switch indicates that no previously-generated logs are required; only new log data (since the most recent log generation) is included. A maximum of ten metering logs can be generated by this process.
Related Commands
ssc log metering phone-home enable
Enables/disables the phone home service for Services Director metering logs.
Syntax
[no] ssc log metering phone-home enableUsage Guidelines
The no command option disables the phone home feature.
Examples
amnesiac (config) # ssc log metering phone-home enableRelated Commands
ssc log-export create
Creates a new log-export resource. This resource is used for vTM analytics.
Syntax
ssc log-export create tag value files file-list [history {None | All}] [appliance-only Boolean]Parameters
tag valueThe customer-facing name for the log-export resource. If this is not set, the tag is set to the UUID value for the resource.
files file-listA comma-separated list of log files. The files identified by this list will be sent by the vTM to its assigned collection endpoint.
You can include wildcards if required. You can also include the %ZEUSHOME% variable if required, which represents the Services Director's home directory.
For example: %ZEUSHOME%/zxtm/log/stingrayafm/log-master/*,%ZEUSHOME%/zxtm/log/stingrayafm/log/*
history(Optional) Identifies how much historic activity should be exported for this log. Use one of the following settings:
- None. This indicates that only current activity logs will be exported. All historic activity logs will not be included. This is the default setting.
- All. This indicates that all current and historic activity logs will be exported.
appliance_only(Optional) a Boolean setting that indicates log-export usage:
- true: the log-export is only supported on virtual appliance installations of the Virtual Traffic Manager, and not on software installations.
- false: the log-export is supported on all installations. This is the default setting.
Examples
*** create a log-export resource ***
amnesiac (config) # ssc log-export create tag "Request Logs" files "%ZEUSHOME%/zxtm/log/myvirtualserver.log"
+----------------+-----------------------------------------+
| Field | Value |
+----------------+-----------------------------------------+
| files | %ZEUSHOME%/zxtm/log/myvirtualserver.log |
| tag | Request Logs |
| appliance_only | False |
| built_in | False |
| log_export_id | Log-Export-1YRJ-LIPR-ZWY7-3J1Q |
| history | none |
+----------------+-----------------------------------------+
*** list all log-export resources to confirm the addition ***
amnesiac (config) # ssc log-export list
+--------------------------------+-----------------------------+
| ID | Tag |
+--------------------------------+-----------------------------+
| Log-Export-1YRJ-LIPR-ZWY7-3J1Q | Request Logs |
| Audit Log | Audit Log |
| Application Firewall | Application Firewall |
| Process Monitor | Process Monitor |
| Admin Server Access | Admin Server Access |
| System - syslog | System - syslog |
| Event Log | Event Log |
| Routing Software | Routing Software |
| Data Plane Acceleration | Data Plane Acceleration |
| System - authentication log | System - authentication log |
+--------------------------------+-----------------------------+Related Commands
ssc log-export delete
Deletes a log-export resource. This resource is used for vTM analytics.
Syntax
ssc log-export delete id log-export-idParameters
id log-export-idThe identifier for the log-export resource, either its tag or its UUID.
Usage Guidelines
You can only delete a log-export resource that has an ID of the form Log-Export-xxxx-xxxx-xxxx-xxxx. This indicates that the log-export resource was created by a user.
You cannot delete a log-export resource that has an ID that uses English words, and which matches its tag. For example: Audit Logs. This indicates that the log-export resource was created automatically when the Services Director was installed.
Examples
*** list all log-export resources ***
amnesiac (config) # ssc log-export list
+--------------------------------+-----------------------------+
| ID | Tag |
+--------------------------------+-----------------------------+
| Log-Export-1YRJ-LIPR-ZWY7-3J1Q | Request Logs |
| Audit Log | Audit Log |
| Application Firewall | Application Firewall |
| Process Monitor | Process Monitor |
| Admin Server Access | Admin Server Access |
| System - syslog | System - syslog |
| Event Log | Event Log |
| Routing Software | Routing Software |
| Data Plane Acceleration | Data Plane Acceleration |
| System - authentication log | System - authentication log |
+--------------------------------+-----------------------------+
*** try to delete log-export resource that was provided with the product ***
amnesiac (config) # ssc log-export delete id "Audit Log"
+-------+-------------------------------------------------------------------------
| Field | Value
+-------+-------------------------------------------------------------------------
| error | Access to resource is forbidden (Deleting a built-in log export entry...
+-------+-------------------------------------------------------------------------
*** delete a specific log-export resource ***
amnesiac (config) # ssc log-export delete id "Request Logs"
+--------------------------------------------------------+
| Deleted |
+--------------------------------------------------------+
| Log Export type Log-Export-1YRJ-LIPR-ZWY7-3J1Q deleted |
+--------------------------------------------------------+
*** list all log-export resources to confirm the deletion ***
amnesiac (config) # ssc log-export list
+--------------------------------+-----------------------------+
| ID | Tag |
+--------------------------------+-----------------------------+
| Audit Log | Audit Log |
| Application Firewall | Application Firewall |
| Process Monitor | Process Monitor |
| Admin Server Access | Admin Server Access |
| System - syslog | System - syslog |
| Event Log | Event Log |
| Routing Software | Routing Software |
| Data Plane Acceleration | Data Plane Acceleration |
| System - authentication log | System - authentication log |
+--------------------------------+-----------------------------+Related Commands
ssc log-export list
Lists all log-export resources. These resources are used for vTM analytics.
Syntax
ssc log-export listExamples
amnesiac (config) # ssc log-export list
+--------------------------------+-----------------------------+
| ID | Tag |
+--------------------------------+-----------------------------+
| Audit Log | Audit Log |
| Application Firewall | Application Firewall |
| Process Monitor | Process Monitor |
| Admin Server Access | Admin Server Access |
| System - syslog | System - syslog |
| Event Log | Event Log |
| Routing Software | Routing Software |
| Data Plane Acceleration | Data Plane Acceleration |
| System - authentication log | System - authentication log |
+--------------------------------+-----------------------------+Related Commands
ssc log-export update
Updates a log-export resource. This resource is used for vTM analytics.
Syntax
ssc log-export update id log-export-id [tag value [files file-list] [history {None | All}] [appliance-only Boolean]Parameters
id log-export-idThe identifier for the log-export resource, either its tag or its UUID.
tag valueThe customer-facing name for the log-export resource. If this is not set, the tag is set to the UUID value for the resource.
files files-listA comma-separated list of log files. The files identified by this list will be sent by the vTM to its assigned collection endpoint.
You can include wildcards if required. You can also include the %ZEUSHOME% variable if required, which represents the Services Director's home directory.
For example: %ZEUSHOME%/zxtm/log/stingrayafm/log-master/*,%ZEUSHOME%/zxtm/log/stingrayafm/log/*
historyIdentifies how much historic activity should be exported for this log. Use one of the following settings:
- None. This indicates that only current activity logs will be exported. All historic activity logs will not be included. This is the default setting.
- All. This indicates that all current and historic activity logs will be exported.
appliance_onlyA Boolean setting that indicates log-export usage:
- true: the log-export is only supported on virtual appliance installations of the Virtual Traffic Manager, and not on software installations.
- false: the log-export is supported on all installations. This is the default setting.
Usage Guidelines
You can only update a log-export resource that has an ID of the form Log-Export-xxxx-xxxx-xxxx-xxxx. This indicates that the log-export resource was created by a user.
You cannot update a log-export resource that has an ID that uses English words, and which matches its tag. For example: Audit Logs. This indicates that the log-export resource was created automatically when the Services Director was installed.
Examples
*** list all log-export resources ***
amnesiac (config) # ssc log-export list
+--------------------------------+-----------------------------+
| ID | Tag |
+--------------------------------+-----------------------------+
| Log-Export-1YRJ-LIPR-ZWY7-3J1Q | Request Logs |
| Audit Log | Audit Log |
| Application Firewall | Application Firewall |
| Process Monitor | Process Monitor |
| Admin Server Access | Admin Server Access |
| System - syslog | System - syslog |
| Event Log | Event Log |
| Routing Software | Routing Software |
| Data Plane Acceleration | Data Plane Acceleration |
| System - authentication log | System - authentication log |
+--------------------------------+-----------------------------+
*** display properties for a specific log-export resource ***
amnesiac (config) # show ssc log-export id "Request Logs"
+----------------+-----------------------------------------+
| Field | Value |
+----------------+-----------------------------------------+
| files | %ZEUSHOME%/zxtm/log/myvirtualserver.log |
| tag | Request Logs |
| appliance_only | False |
| built_in | False |
| log_export_id | Log-Export-1YRJ-LIPR-ZWY7-3J1Q |
| children | None |
| history | none |
+----------------+-----------------------------------------+
*** update the history property for this log-export resource ***
amnesiac (config) # ssc log-export update id "Request Logs" history all
+----------------+-----------------------------------------+
| Field | Value |
+----------------+-----------------------------------------+
| files | %ZEUSHOME%/zxtm/log/myvirtualserver.log |
| tag | Request Logs |
| appliance_only | False |
| built_in | False |
| log_export_id | Log-Export-1YRJ-LIPR-ZWY7-3J1Q |
| history | all |
+----------------+-----------------------------------------+Related Commands
ssc manager list
Lists Services Director managers.
Syntax
ssc manager listExamples
amnesiac (config) # ssc manager list
+----------+
| Manager |
+----------+
| amnesiac |
+----------+Related Commands
ssc manager update manager-name
Updates Services Director manager settings.
Syntax
ssc manager update manager-name name mgmt-mode [enabled | disabled] metering-mode [all | none] licensing-mode [enabled |disabled |enabled-with-alerts]Parameters
nameSpecify a unique name for the manager.
mgmt-modeSpecify the management mode for the manager: enabled, disabled.
metering-modeSpecify the metering mode for the manager: all, none.
licensing-modeSpecify the licensing mode for the manager: enabled, disabled, enabled-with-alerts.
Usage Guidelines
Use the no ssc manager manager-name <name> command to delete a manager that is flagged as failed.
Use the no ssc manager manager-name <name> force-delete command to delete a manager that is not flagged as failed.
Examples
amnesiac (config) # ssc manager update manager-name amnesiac mgmt-mode enabled metering-mode all licensing-mode enabledRelated Commands
ssc manager update template-name
Updates the Services Director manager based on the specified template.
Syntax
ssc manager update template-name name | [manager-name name mgmt-mode enabled | disabled] | [metering-mode all | none] | [licensing-mode enabled | disabled | enabledwithalerts]Parameters
nameSpecify the template name.
manager-name nameSpecify the manager name.
mgmt-modeSpecify the management mode for the manager: enabled, disabled.
metering-modeSpecify the metering mode for the manager: all, none.
licensing-modeSpecify the licensing mode for the manager: enabled, disabled, enabled-with-alerts.
Usage Guidelines
Updates a manager with the parameters predefined in an existing template. The existing template is created by the ssc template create command. The predefined parameters in the existing template are passed to the resource to update the command. You have the option to replace or add extra parameters that exist in the specified template (that is, add extra arguments).
Examples
amnesiac (config) # ssc manager update template-name mantemp1 manager-name amnesiac mgmt-mode disabledRelated Commands
ssc metering warning list
Displays a list of all Traffic Manager instances that have a metering warning raised against them.
Syntax
ssc metering warning listUsage Guidelines
To display information for failed Traffic Manager instances, see show ssc owner.
Examples
amnesiac (config) # ssc metering warning list
+-----------+
| Instance |
+-----------+
| cerise-02 |
| sienna-01 |
+-----------+Related Commands
show ssc dashboard, show ssc metering warning instance-name, show ssc settings metering, ssc settings metering update
ssc owner create
Creates an owner on the Services Director. This is used to indicate ownership of registered vTMs and vTM clusters, and is required during automated self-registration of vTMs.
Syntax
ssc owner create [e-mail email-address] [secret password] [timezone timezone] [[tag name]Parameters
e-mail email-addressOptionally, specify a valid e-mail address that will be used to contact an administrator if required.
secret passwordOptionally, specify a password for this owner. This is required for automatic self-registration.
timezone timezoneOptionally, specify a timezone for this owner. For example: "Europe/London", "America/Detroit", "GMT".
tagOptionally, specify a unique name for this owner.
Usage Guidelines
No parameters are mandatory. If none are provided, an owner is created with only the UUID set.
Examples
*** list owners to confirm which are available ***
amnesiac (config) # ssc owner list
+---------------------------+------+
| Owner ID | Tag |
+---------------------------+------+
| Owner-HSC1-T4QV-BXPB-Z4CZ | HC |
| Owner-NS3F-FHQ4-RO11-5Y0A | JK |
| Owner-JJM6-0UII-JUAH-R979 | JRRT |
+---------------------------+------+
*** create new owner 'TK' ***
amnesiac (config) # ssc owner create tag TK timezone Europe/London
+---------------+---------------------------+
| Field | Value |
+---------------+---------------------------+
| instances | [] |
| tag | TK |
| timezone | Europe/London |
| email_address | |
| secret | QUK5qKRPy2mt |
| clusters | [] |
| owner_id | Owner-58I2-2N4F-IXG0-8084 |
+---------------+---------------------------+
*** list owners again ***
amnesiac (config) # ssc owner list
+---------------------------+------+
| Owner ID | Tag |
+---------------------------+------+
| Owner-HSC1-T4QV-BXPB-Z4CZ | HC |
| Owner-NS3F-FHQ4-RO11-5Y0A | JK |
| Owner-58I2-2N4F-IXG0-8084 | TK |
| Owner-JJM6-0UII-JUAH-R979 | JRRT |
+---------------------------+------+Related Commands
ssc owner delete
Deletes an owner on the Services Director.
Syntax
ssc owner delete owner-id ownerParameters
owner-id ownerSpecify the owner you want to delete, using either its tag or UUID.
Examples
*** list owners ***
amnesiac (config) # ssc owner list
+---------------------------+------+
| Owner ID | Tag |
+---------------------------+------+
| Owner-HSC1-T4QV-BXPB-Z4CZ | HC |
| Owner-NS3F-FHQ4-RO11-5Y0A | JK |
| Owner-58I2-2N4F-IXG0-8084 | TK |
| Owner-JJM6-0UII-JUAH-R979 | JRRT |
+---------------------------+------+
*** delete owner ***
amnesiac (config) # ssc owner delete owner-id JK
+-----------------------------------------+
| Deleted |
+-----------------------------------------+
| Owner Owner-NS3F-FHQ4-RO11-5Y0A deleted |
+-----------------------------------------+
*** list owners to confirm deletion ***
amnesiac (config) # ssc owner list
+---------------------------+------+
| Owner ID | Tag |
+---------------------------+------+
| Owner-HSC1-T4QV-BXPB-Z4CZ | HC |
| Owner-58I2-2N4F-IXG0-8084 | TK |
| Owner-JJM6-0UII-JUAH-R979 | JRRT |
+---------------------------+------+Related Commands
ssc owner list
Displays a list of all owners on the Services Director.
Syntax
ssc owner listExamples
amnesiac (config) # ssc owner list
+---------------------------+------+
| Owner ID | Tag |
+---------------------------+------+
| Owner-HSC1-T4QV-BXPB-Z4CZ | HC |
| Owner-NS3F-FHQ4-RO11-5Y0A | JK |
| Owner-58I2-2N4F-IXG0-8084 | TK |
| Owner-JJM6-0UII-JUAH-R979 | JRRT |
+---------------------------+------+Related Commands
ssc owner update
Updates an owner on the Services Director.
Syntax
ssc owner update owner-id owner [e-mail email-address] [secret password] [timezone timezone] [[tag name]Parameters
owner-id ownerIdentify the owner that you want to update, using either its tag or UUID.
e-mail email-addressOptionally, specify a valid e-mail address that will be used to contact an administrator if required.
secret passwordOptionally, specify a password for this owner. This is required for automatic self-registration.
timezoneOptionally, specify a timezone for this owner. For example: "Europe/London", "America/Detroit", "GMT".
tagOptionally, specify a unique name for this owner.
Examples
*** list owners ***
amnesiac (config) # ssc owner list
+---------------------------+------+
| Owner ID | Tag |
+---------------------------+------+
| Owner-HSC1-T4QV-BXPB-Z4CZ | HC |
| Owner-NS3F-FHQ4-RO11-5Y0A | JK |
| Owner-58I2-2N4F-IXG0-8084 | TK |
| Owner-JJM6-0UII-JUAH-R979 | Demo |
+---------------------------+------+
*** rename 'Demo' to 'JRRT' ***
amnesiac (config) # ssc owner update owner-id Demo tag JRRT
+---------------+-----------------------------------+
| Field | Value |
+---------------+-----------------------------------+
| instances | [u'Instance-097D-W8HI-XR4K-GYUF'] |
| tag | JRRT |
| timezone | Europe/Lisbon |
| email_address | |
| secret | |
| clusters | [u'Cluster-3FRI-XJST-S2UY-CCMD'] |
| owner_id | Owner-JJM6-0UII-JUAH-R979 |
+---------------+-----------------------------------+
*** list owners ***
amnesiac (config) # ssc owner list
+---------------------------+------+
| Owner ID | Tag |
+---------------------------+------+
| Owner-HSC1-T4QV-BXPB-Z4CZ | HC |
| Owner-NS3F-FHQ4-RO11-5Y0A | JK |
| Owner-58I2-2N4F-IXG0-8084 | TK |
| Owner-JJM6-0UII-JUAH-R979 | JRRT |
+---------------------------+------+Related Commands
ssc registration delete
Deletes a specified self-registration request.
Syntax
ssc registration delete registration-idParameters
registration-idSpecify the ID for the self-registration request.
Examples
amnesiac (config) # ssc registration delete registration-id Reg-NF8H-W5UT-ECL3-HFMH
Successfully deleted registration Reg-NF8H-W5UT-ECL3-HFMHRelated Commands
ssc registration list
Lists all self-registration requests received by Services Director. This list includes all Approved, Pending, Declined and Blacklisted requests.
Syntax
ssc registration listExamples
amnesiac (config) # ssc registration list
+-------------------------+--------------------+-------------+
| ID | REST Address | Status |
+-------------------------+--------------------+-------------+
| Reg-NF8H-W5UT-ECL3-HFMH | 10.62.169.167:9070 | Accepted |
| Reg-RUE7-NV0B-TXE7-RQO6 | 10.62.169.168:9070 | Blacklisted |
| Reg-1K8R-1C1Z-JM3S-W12R | 10.62.169.167:9070 | Pending |
+-------------------------+--------------------+-------------+Related Commands
ssc registration update
Updates the state of a specified self-registration request. This is the standard method for approving a request.
Syntax
ssc registration update registration-id registration-id state [ blacklist | pending | decline [ reason declined-reason ] | accept [ instance-name name owner owner feature-pack feature_pack bandwidth bandwidth [access_profile access_profile] [analytics_profile analytics_profile] ]Parameters
registration-idSpecify the ID for the self-registration request.
stateSpecify a new state for the self-registration request. Supported transitions are:
- Pending --> Accepted
- Pending --> Declined
- Pending --> Blacklisted
- Declined --> Pending
- Blacklisted --> Pending
declined-reasonOptionally, specify a reason (as a string) for the transition from Pending to Declined. This is not used for any other state transition.
instance-nameThe name for the instance.
ownerThe owner of the instance.
feature_packThe feature pack for the instance.
bandwidthThe bandwidth for the instance.
access_profile(Optional) The access_profile for the instance.
analytics_profile(Optional) The analytics profile for the instance.
Usage Guidelines
The following commands represent the four supported state transitions:
- Pending to Declined:
ssc registration update registration-id <reg-id> state decline reason <reason>
- Pending to Blacklisted:
ssc registration update registration-id <reg-id> state blacklist
- Declined/Blacklisted back to Pending:
ssc registration update registration-id <reg-id> state pending
- Pending to Accepted:
ssc registration update registration-id <reg-id> state accept instance-name <name> owner <owner> feature-pack <feature_pack> bandwidth <bandwidth> access_profile <access_profile> analytics_profile <analytics_profile>
When the Pending to Accepted transition is performed, the authenticator and permission groups in the access profile are applied to the vTM. Existing authenticators and permission groups may be overwritten, but none will be deleted. All members of a cluster are affected.
Examples
amnesiac (config) # ssc registration update registration-id Reg-RUE7-NV0B-TXE7-RQO6 state decline reason "Unexpected submission"
+----------------------+--------------------------------------+
| Field | Value |
+----------------------+--------------------------------------+
| snmp_address | 10.62.169.168:161 |
| registration_message | Cerise-02 10.4 registration (Tekton) |
| bandwidth | None |
| owner | None |
| email_address | [email protected] |
| instance_name | None |
| uuid | 06711d65-b1c6-3301-96d6-005056a63342 |
| hostname | 10.62.169.168 |
| declined_reason | Unexpected submission |
| instance_version | 10.4 |
| status | Declined |
| snmp_community | public |
| admin_address | 10.62.169.168:9090 |
| rest_address | 10.62.169.168:9070 |
| feature_pack | None |
| cluster_identifier | |
| registration_time | 2016-03-07 16:44:24 |
| instance_id | None |
| management_ip | 10.62.169.168 |
| pending_time | 2016-03-07 16:44:24 |
| access_profile | None |
| analytics_profile | None |
+----------------------+--------------------------------------+Related Commands
ssc reg-policy create
Creates a registration policy on the Services Director. This is used during the automatic self-registration of externally-deployed vTMs and cloud-based vTMs.
Syntax
ssc reg-policy create feature-pack feature-pack bandwidth bandwidth mgmt-ip-subnet subnet [tag name] [inst-version-low version] [inst-version-high version] [access-profile access-profile] [analytics-profile analytics-profile]Parameters
feature-packSpecify the name of a feature pack.
This is the feature pack that will be assigned to a vTM that is successfully evaluated using this policy.
This is not an acceptance condition, but the evaluation of the bandwidth property refers to this property.
bandwidthThis is the required bandwidth (in Mbps) for a vTM that is evaluated using this policy.
If there is insufficient bandwidth in the specified Feature Pack for a vTM, the auto-acceptance of the vTM is rejected by the self-registration policy.
mgmt-ip-subnetSpecify the IP address and netmask of a subnetwork in CIDR format. For example, 10.122.12.13/18.
This identifies the subnet to which a vTM must belong to be accepted by this policy.
If a vTM that is evaluated by this policy is from outside the specified subnetwork, the auto-acceptance of the vTM is rejected by the self-registration policy.
tag(Optional) A unique name for the self-registration policy.
inst-version-low(Optional) The minimum version for the vTM software. This takes the form X.Y. Examples: 10.0, 10.3.
R1 releases are included automatically for any base version. For example, 10.0 includes 10.0r1.
If a vTM that is evaluated by this policy does not meet this condition, the auto-acceptance of the vTM is rejected by the self-registration policy.
inst-version-high(Optional) The maximum version for the vTM software. This takes the form X.Y. Examples: 10.4, 11.0.
R1 releases are included automatically for any base version. For example, 10.3 includes 10.3r1.
If a vTM that is evaluated by this policy does not meet this condition, the auto-acceptance of the vTM is rejected by the self-registration policy.
access-profile(Optional) The Access Profile for the policy. This profile identifies the authenticator and permission groups required for the user authentication on this vTM.
If selected, these will be applied to the vTM once it is accepted. All cluster members are affected by this change.
analytics-profile(Optional) The Analytics Profile for the policy. This profile identifies the resources required for analytics on this vTM.
If selected, these will be applied to the vTM once it is accepted. All cluster members are affected by this change.
Examples
*** list existing self-reg policies ***
amnesiac (config) # ssc reg-policy list
+----------------------------+----------------+
| Policy ID | Tag |
+----------------------------+----------------+
| Policy-MHM8-AB62-SI2J-DNUX | jk-self-reg-01 |
| Policy-8QU3-ZERY-8IW6-3W6J | self-reg-01 |
+----------------------------+----------------+
*** create a new sel-reg policy 'jk-self-reg-02' ***
amnesiac (config) # ssc reg-policy create feature-pack STM-400_full bandwidth 80 mgmt-ip-subnet 10.20.128.0/18 inst-version-low 10.2 tag jk-self-reg-02
+-----------------------------+----------------------------+
| Field | Value |
+-----------------------------+----------------------------+
| instance_version_range_low | 10.2 |
| bandwidth | 80 |
| tag | jk-self-reg-02 |
| management_ip_subnet | 10.20.128.0/18 |
| feature_pack | STM-400_full |
| access_profile | None |
| analytics_profile | None |
| instance_version_range_high | |
| policy_id | Policy-I7A7-3DN2-6IEB-QF96 |
+-----------------------------+----------------------------+
amnesiac (config) # ssc reg-policy list
+----------------------------+----------------+
| Policy ID | Tag |
+----------------------------+----------------+
| Policy-MHM8-AB62-SI2J-DNUX | jk-self-reg-01 |
| Policy-I7A7-3DN2-6IEB-QF96 | jk-self-reg-02 |
| Policy-8QU3-ZERY-8IW6-3W6J | self-reg-01 |
+----------------------------+----------------+Related Commands
ssc reg-policy delete
Deletes a registration policy from the Services Director.
Syntax
ssc reg-policy delete policy-id registration-policyParameters
registration-policySpecify the name of the registration policy that you want to delete.
Examples
*** list self-reg policies ***
amnesiac (config) # ssc reg-policy list
+----------------------------+----------------+
| Policy ID | Tag |
+----------------------------+----------------+
| Policy-MHM8-AB62-SI2J-DNUX | jk-self-reg-01 |
| Policy-I7A7-3DN2-6IEB-QF96 | jk-self-reg-02 |
| Policy-8QU3-ZERY-8IW6-3W6J | self-reg-01 |
+----------------------------+----------------+
*** delete self-reg policy 'jk-self-reg-02' ***
amnesiac (config) # ssc reg-policy delete policy-id jk-self-reg-02
+--------------------------------------------------------+
| Deleted |
+--------------------------------------------------------+
| Registration policy Policy-I7A7-3DN2-6IEB-QF96 deleted |
+--------------------------------------------------------+
*** list self-reg policies to confirm deletion ***
amnesiac (config) # ssc reg-policy list
+----------------------------+----------------+
| Policy ID | Tag |
+----------------------------+----------------+
| Policy-MHM8-AB62-SI2J-DNUX | jk-self-reg-01 |
| Policy-8QU3-ZERY-8IW6-3W6J | self-reg-01 |
+----------------------------+----------------+Related Commands
ssc reg-policy list
Displays a list of all a registration policies on the Services Director.
Syntax
ssc reg-policy listExamples
amnesiac (config) # ssc reg-policy list
+----------------------------+----------------+
| Policy ID | Tag |
+----------------------------+----------------+
| Policy-MHM8-AB62-SI2J-DNUX | jk-self-reg-01 |
| Policy-I7A7-3DN2-6IEB-QF96 | jk-self-reg-02 |
| Policy-8QU3-ZERY-8IW6-3W6J | self-reg-01 |
+----------------------------+----------------+Related Commands
ssc reg-policy update
Updates a registration policy on the Services Director.
Syntax
ssc reg-policy update policy-id id [tag name] [feature-pack feature-pack] [bandwidth bandwidth]
[mgmt-ip-subnet subnet] [inst-version-low version] [inst-version-high version] [access-profile access-profile] [analytics-profile analytics-profile]Parameters
policy-id idSpecify the name of the registration policy that you want to update.
tag(Optional) A unique name for the self-registration policy.
feature-pack(Optional) The name of a feature pack.
This is the feature pack that will be assigned to a vTM that is successfully evaluated using this policy.
This is not an acceptance condition, but the evaluation of the bandwidth property refers to this property.
bandwidth(Optional) The required bandwidth (in Mbps) for a vTM that is evaluated using this policy.
If there is insufficient bandwidth in the specified Feature Pack for a vTM, the auto-acceptance of the vTM is rejected by the self-registration policy.
mgmt-ip-subnet(Optional) The IP address and netmask of a subnetwork in CIDR format. For example, 10.122.12.13/18.
This identifies the subnet to which a vTM must belong to be accepted by this policy.
If a vTM that is evaluated by this policy is from outside the specified subnetwork, the auto-acceptance of the vTM is rejected by the self-registration policy.
inst-version-low(Optional) The minimum version for the vTM software. This takes the form X.Y. Examples: 10.0, 10.3.
R1 releases are included automatically for any base version. For example, 10.0 includes 10.0r1.
If a vTM that is evaluated by this policy does not meet this condition, the auto-acceptance of the vTM is rejected by the self-registration policy.
inst-version-high(Optional) The maximum version for the vTM software. This takes the form X.Y. Examples: 10.4, 11.0.
R1 releases are included automatically for any base version. For example, 10.3 includes 10.3r1.
If a vTM that is evaluated by this policy does not meet this condition, the auto-acceptance of the vTM is rejected by the self-registration policy.
access-profile(Optional) An access profile. This profile identifies the authenticator and permission groups required for the user authentication on this vTM.
If selected, these will be applied to the vTM once it is accepted. All cluster members are affected by this change.
analytics-profile(Optional) An analytics profile. This profile identifies the resources required to implement analytics on this vTM.
If selected, these will be applied to the vTM once it is accepted. All cluster members are affected by this change.
Examples
*** show details for a self-reg policy ***
amnesiac (config) # show ssc reg-policy policy-id self-reg-01
+-----------------------------+----------------------------+
| Field | Value |
+-----------------------------+----------------------------+
| instance_version_range_low | |
| bandwidth | 100 |
| tag | self-reg-01 |
| management_ip_subnet | 10.62.128.0/18 |
| feature_pack | STM-400_full |
| access_profile | None |
| analytics_profile | None |
| instance_version_range_high | |
| policy_id | Policy-8QU3-ZERY-8IW6-3W6J |
+-----------------------------+----------------------------+
*** change bandwidth from 100 to 120 ***
amnesiac (config) # ssc reg-policy update policy-id self-reg-01 bandwidth 120
+-----------------------------+----------------------------+
| Field | Value |
+-----------------------------+----------------------------+
| instance_version_range_low | |
| bandwidth | 120 |
| tag | self-reg-01 |
| management_ip_subnet | 10.62.128.0/18 |
| feature_pack | STM-400_full |
| access_profile | None |
| analytics_profile | None |
| instance_version_range_high | |
| policy_id | Policy-8QU3-ZERY-8IW6-3W6J |
+-----------------------------+----------------------------+Related Commands
ssc sd-admin-ca create
Creates a Services Director CA certificate that is for use with a secure LDAP server authenticator.
Syntax
ssc sd-admin-ca create admin-ca-name tag certificate-authority certificate-textParameters
tagA unique name for the CA certificate.
certificate-textThe text of the CA certificate.
Examples
*** list certificates ***
amnesiac (config) # ssc sd-admin-ca list
+------+------------------------------+
| Name | Unique ID |
+------+------------------------------+
| CA-1 | Admin-CA-5XJ0-HP0Y-YQAX-69O2 |
+------+------------------------------+
*** add a new certificate ***
amnesiac (config) # ssc sd-admin-ca create admin-ca-name CA-2 certificate-authority "-----BEGIN CERTIFICATE----- ...<certificate body>... -----END CERTIFICATE----- >"
+------------------------------------------+
| Created |
+------------------------------------------+
| admin certificate authority CA-2 created |
+------------------------------------------+
*** confirm creation ***
amnesiac (config) # ssc sd-admin-ca list
+------+------------------------------+
| Name | Unique ID |
+------+------------------------------+
| CA-1 | Admin-CA-5XJ0-HP0Y-YQAX-69O2 |
| CA-2 | Admin-CA-6J21-KKH3-VSAJ-3209 |
+------+------------------------------+Related Commands
ssc sd-admin-ca list, ssc sd-admin-ca update, show ssc sd-admin-ca, show ssc sd-admin-ca, ssc sd-authenticator add ldap auth-name, ssc sd-authenticator test auth-name, ssc sd-authenticator update ldap auth-name
ssc sd-admin-ca list
Lists all Services Director CA certificates that are for use with a secure LDAP server authenticator.
Syntax
ssc sd-admin-ca listExamples
amnesiac (config) # ssc sd-admin-ca list
+------+------------------------------+
| Name | Unique ID |
+------+------------------------------+
| CA-1 | Admin-CA-5XJ0-HP0Y-YQAX-69O2 |
| CA-2 | Admin-CA-6J21-KKH3-VSAJ-3209 |
+------+------------------------------+Related Commands
ssc sd-admin-ca create, ssc sd-admin-ca update, show ssc sd-admin-ca, show ssc sd-admin-ca, ssc sd-authenticator add ldap auth-name, ssc sd-authenticator test auth-name, ssc sd-authenticator update ldap auth-name
ssc sd-admin-ca update
Updates a Services Director CA certificate that is for use with a secure LDAP server authenticator.
Syntax
ssc sd-admin-ca create admin-ca-name tag certificate-authority certificate-text new-admin-ca-name new-tagParameters
tagA unique name for the CA certificate.
certificateThe text of the CA certificate.
new-tagA new unique name for the CA certificate.
Examples
*** list certificates ***
amnesiac (config) # ssc sd-admin-ca list
+------+------------------------------+
| Name | Unique ID |
+------+------------------------------+
| CA-1 | Admin-CA-5XJ0-HP0Y-YQAX-69O2 |
| CA-2 | Admin-CA-6J21-KKH3-VSAJ-3209 |
+------+------------------------------+
*** rename the CA-2 certificate ***
amnesiac (config) # ssc sd-admin-ca update admin-ca-name CA-2 new-admin-ca-name LDP2
+------------------------------------------+
| Updated |
+------------------------------------------+
| admin certificate authority CA-2 updated |
+------------------------------------------+
*** confirm update ***
amnesiac (config) # ssc sd-admin-ca list
+------+------------------------------+
| Name | Unique ID |
+------+------------------------------+
| CA-1 | Admin-CA-5XJ0-HP0Y-YQAX-69O2 |
| LDP2 | Admin-CA-6J21-KKH3-VSAJ-3209 |
+------+------------------------------+Related Commands
ssc sd-admin-ca create, ssc sd-admin-ca list, show ssc sd-admin-ca, show ssc sd-admin-ca, ssc sd-authenticator add ldap auth-name, ssc sd-authenticator test auth-name, ssc sd-authenticator update ldap auth-name
ssc sd-authenticator add ldap auth-name
Adds an LDAP-based Services Director authenticator. This can be either secure or non-secure.
Syntax
ssc sd-authenticator add ldap auth-name authenticator-name auth-status [enabled | disabled] server server server dn-method method filter filter base-dn base-DN fallback-group fallback-group port port timeout timeout-period group-attribute group-attribute group-field group-field bind-dn bind-DN group-filter group-filter ssl ssl [search-dn search-DN search-password password]Parameters
authenticator-nameSpecify a name for the LDAP Services Director authenticator.
auth-statusSpecify whether the authenticator is either enabled or disabled.
serverSpecify the IP address or hostname of the LDAP server.
methodSpecify how the bind DN for a user will be derived. Either:
- construct: the bind DN for a user can be constructed from a known string, (see <bind-DN>) or
- search: the bind DN for a user can be searched for in the directory. This is necessary if you have users under different directory paths.
filterSpecify a filter that uniquely identifies a user located under the Base DN.
The string "%u" will be substituted with the username. For example:
- Active Directory: "sAMAccountName=%u"
- Unix LDAP: "uid=%u"
base-DNSpecify the base DN (Distinguished Name) for directory searches.
fallback-groupSpecify a permission group. For example, "admin". If <group-attribute> is not defined, or is not set for the user, this permission group will be used. If not specified, users with no attribute matching group-attribute will be denied access.
portSpecify the port used to connect to the LDAP server.
timeout-periodSpecify the timeout period (in seconds) for a connection to the LDAP server.
group-attributeSpecify the LDAP attribute that gives a user's group. For example: "memberOf". If multiple values are returned by the LDAP server, the first valid one will be used.
group-fieldSpecify the sub-field of the group-attribute that gives a user's group. For example: if <group-attribute> is "memberOf" which delivers "CN=mygroup, OU=groups, OU=users, DC=mycompany, DC=local", set group-field to "CN". The first matching field will be used.
bind-DNSpecify a template to construct the bind DN from the username. This is only used when <method> is "construct". The string "%u" is replaced by the username. For example:
- "cn=%u,dn=mycompany,dn=local"
group-filterSpecify an alternative group search filter. This is only used when the user record returned by the LDAP filter does not contain the required group information.
This will typically be required if you have Unix/POSIX-style user records. If multiple records are returned the list of group names will be extracted from all of them.
The string "%u" will be replaced by the username. For example:
- "(&(memberUid=%u)(objectClass=posixGroup))"
ssl(Optional) Select the required LDAP security type:
- none. Select this if your LDAP server does not support secure connections.
- starttls. Select this if your LDAP server supports STARTTLS secure connections. You must ensure that a matching CA certificate is present to use this option.
- ldaps. Select this if your LDAP server supports LDAPS secure connections. You must ensure that a matching CA certificate is present to use this option.
search-DNSpecify a DN to use when searching the directory for a user's bind DN. These are only used when the DN Method is Search. You can leave these blank if it is possible to perform the bind DN search using an anonymous bind.
search-passwordSpecify the password for the search-DN.
Usage Guidelines
Use the no ssc sd-authenticator auth-name command to delete an authenticator.
You cannot delete a Services Director authenticator that is associated with an access profile.
Examples
*** create an LDAP Services Director authenticator ***
amnesiac (config) # ssc sd-authenticator add ldap auth-name "LDAP Server" auth-status enabled server 10.62.169.170 dn-method "construct" filter "sAMAccountName=%u" base-dn "OU=users, DC=tekton, DC=local" fallback-group admin port 389 timeout 30 group-attribute "memberOf" group-field "CN" bind-dn "%[email protected]" group-filter ssl starttls "(&(memberUid=%u)(objectClass=posixGroup))"
+--------------------------------------+
| Created |
+--------------------------------------+
| SD Authenticator LDAP Server created |
+--------------------------------------+
*** delete an LDAP Services Director ***
amnesiac (config) # no ssc sd-authenticator auth-name "LDAP Server"
+-----------------------------------+
| Deleted |
+-----------------------------------+
| Authenticator LDAP Server deleted |
+-----------------------------------+Related Commands
show ssc sd-admin-ca, ssc sd-authenticator list, ssc sd-authenticator test auth-name, ssc sd-authenticator update ldap auth-name, show ssc sd-admin-ca, ssc sd-admin-ca create, ssc sd-admin-ca list, ssc sd-admin-ca update
ssc sd-authenticator add radius auth-name
Adds a RADIUS-based Services Director authenticator.
Syntax
ssc sd-authenticator add radius auth-name authenticator-name auth-status [enable | disable] server server fallback-group fallback-group port port timeout timeout-period group-attribute group-attribute group-vendor group-vendor secret secret nas-identifier NAS-identifier nas-ip-address NAS-ip-addressParameters
authenticator-nameSpecify a name for the RADIUS Services Director authenticator.
auth-statusSpecify whether the authenticator is either enabled or disabled.
serverSpecify the IP address or hostname of the RADIUS server.
fallback-groupSpecify a permission group. For example, "admin". If no group is found using the vendor and group identifiers, or the group found is not valid, the permission group specified here will be used.
portSpecify the port used to connect to the RADIUS server.
timeout-periodSpecify the timeout period (in seconds) for a connection to the RADIUS server.
group-attributeSpecify the RADIUS identifier for the attribute that specifies an account's group. May be left blank if <fallback-group> is specified.
group-vendorSpecify the RADIUS identifier for the vendor of the RADIUS attribute that specifies an account's group. Leave blank if using a standard attribute such as Filter-Id.
secretSpecify the secret key shared with the RADIUS server.
NAS-identifierSpecify a string identifying the Network Access Server (NAS) which is requesting authentication of the user. This value is sent to the RADIUS server. If left blank the address of the interface used to connect to the server will be used.
NAS-ip-addressSpecify the identifying IP Address of the NAS which is requesting authentication of the user. This value is sent to the RADIUS server.
Usage Guidelines
Use the no ssc sd-authenticator auth-name command to delete an authenticator.
You cannot delete a Services Director authenticator that is associated with an access profile.
Examples
*** create a RADIUS authenticator ***
amnesiac (config) # ssc sd-authenticator add radius auth-name "RADIUS Server" server 10.62.167.193 fallback-group admin port 1812 timeout 30 group-attribute 1 group-vendor 1476 secret * nas-identifier "Internal RADIUS" nas-ip-address 127.0.0.1
+-------------------------------------+
| Created |
+-------------------------------------+
| Authenticator RADIUS Server created |
+-------------------------------------+
*** delete an authenticator ***
amnesiac (config) # no ssc sd-authenticator auth-name "RADIUS Server"
+-------------------------------------+
| Deleted |
+-------------------------------------+
| Authenticator RADIUS Server deleted |
+-------------------------------------+Related Commands
show ssc sd-admin-ca, ssc sd-authenticator list, ssc sd-authenticator test auth-name, ssc sd-authenticator update radius auth-name
ssc sd-authenticator add tacacs_plus auth-name
Adds a TACACS+-based Services Director authenticator.
Syntax
ssc sd-authenticator add tacacs-plus auth-name authenticator-name auth-status [enable | disable] server server auth-type [pap | ascii] fallback-group fallback-group port port timeout timeout-period group-field group-field group-service group-service secret secretParameters
authenticator-nameSpecify a name for the TACACS+ Services Director authenticator.
auth-statusSpecify whether the authenticator is either enabled or disabled.
serverSpecify the IP address or hostname of the TACACS+ server.
auth-typeSpecify the TACACS+ authentication type, either PAP or ACSII.
fallback-groupSpecify a permission group. If <group-service> is not defined, or no group value is provided for the user by the TACACS+ server, the group specified here will be used. If this is not specified, users with no TACACS+ defined group will be denied access.
portSpecify the port used to connect to the TACACS+ server.
timeout-periodSpecify the timeout period (in seconds) for a connection to the TACACS+ server.
group-fieldSpecify the TACACS+ "service" field that provides each user's group.
group-serviceSpecify the TACACS+ "service" that identifies a user's group field.
secretSpecify the secret key shared with the TACACS+ server.
Usage Guidelines
Use the no ssc sd-authenticator auth-name command to delete an authenticator.
You cannot delete a Services Director authenticator that is associated with an access profile.
Examples
*** create a TACACS+ authenticator ***
amnesiac (config) # ssc sd-authenticator add tacacs-plus auth-name "TACACS+ Server" auth-status enabled server 10.62.167.198 auth-type pap fallback-group admin port 49 timeout 30 group-field permission-group group-service "Hoobland" secret "tacacs_plus_secret"
+-----------------------------------------+
| Created |
+-----------------------------------------+
| SD Authenticator TACACS+ Server created |
+-----------------------------------------+
*** delete an authenticator ***
amnesiac (config) # no ssc sd-authenticator auth-name "TACACS+ Server"
+-----------------------------------------+
| Deleted |
+-----------------------------------------+
| SD Authenticator TACACS+ Server deleted |
+-----------------------------------------+Related Commands
show ssc sd-admin-ca, ssc sd-authenticator list, ssc sd-authenticator test auth-name, ssc sd-authenticator update tacacs_plus auth-name
ssc sd-authenticator list
Lists all defined Services Director authenticators.
Syntax
ssc sd-authenticator listExamples
amnesiac (config) # ssc sd-authenticator list
+----------------+-----------------------------------+
| Name | Unique ID |
+----------------+-----------------------------------+
| LDAP Server | Authenticator-D83I-9095-TT8R-CUAT |
| Secure LDAP | Authenticator-E723-MT4B-JJ3W-BARK |
| RADIUS Server | Authenticator-808G-LJWJ-MT3B-WMDZ |
| TACACS+ Server | Authenticator-7F1D-A1K3-1PO4-VSEF |
+----------------+-----------------------------------+Related Commands
show ssc sd-admin-ca, ssc sd-authenticator add ldap auth-name, ssc sd-authenticator add radius auth-name, ssc sd-authenticator add tacacs_plus auth-name, ssc sd-authenticator test auth-name, ssc sd-authenticator update ldap auth-name, ssc sd-authenticator update radius auth-name, ssc sd-authenticator update tacacs_plus auth-name
ssc sd-authenticator test auth-name
Tests a Services Director authenticator using a remote user name and password.
For secure LDAP server, a matching CA certificate must be present on Services Director to enable the operation.
Syntax
ssc sd-authenticator test auth-name authenticator-name username user-name password passwordParameters
authenticator-nameSpecify a name for the Services Director authenticator.
user-nameSpecify the required user.
passwordSpecify the password for the required user.
Examples
amnesiac (config) # ssc sd-authenticator test auth-name bbotservices username tacadmin password tacpassword
+--------+---------+
| Result | Message |
+--------+---------+
| True | |
+--------+---------+Related Commands
show ssc sd-admin-ca, ssc sd-authenticator add ldap auth-name, ssc sd-authenticator add radius auth-name, ssc sd-authenticator add tacacs_plus auth-name, ssc sd-authenticator list, ssc sd-authenticator update ldap auth-name, ssc sd-authenticator update radius auth-name, ssc sd-authenticator update tacacs_plus auth-name, show ssc sd-admin-ca, ssc sd-admin-ca create, ssc sd-admin-ca list, ssc sd-admin-ca update
ssc sd-authenticator update ldap auth-name
Updates an LDAP-based Services Director authenticator.
Syntax
ssc sd-authenticator update ldap auth-name authenticator-name auth-status [enable | disable] [server server | dn-method method | filter filter | base-dn base-DN | fallback-group fallback-group | port port | timeout timeout-period | group-attribute group-attribute | group-field group-field | bind-dn bind-DN | group-filter group-filter | ssl ssl | search-dn search-DN | search-password password]Parameters
authenticator-nameSpecify the name of the LDAP Services Director authenticator.
auth-statusSpecify whether the authenticator is either enabled or disabled.
serverSpecify the IP address or hostname of the LDAP server.
methodSpecify how the bind DN for a user will be derived. Either:
- construct: the bind DN for a user can be constructed from a known string, (see <bind-DN>) or
- search: the bind DN for a user can be searched for in the directory. This is necessary if you have users under different directory paths.
filterSpecify a filter that uniquely identifies a user located under the Base DN.
The string "%u" will be substituted with the username. For example:
- Active Directory: "sAMAccountName=%u"
- Unix LDAP@: "uid=%u"
base-DNSpecify the base DN (Distinguished Name) for directory searches.
fallback-groupSpecify a permission group. For example, "admin". If <group-attribute> is not defined, or is not set for the user, this permission group will be used. If not specified, users with no attribute matching group-attribute will be denied access.
portSpecify the port used to connect to the LDAP server.
timeout-periodSpecify the timeout period (in seconds) for a connection to the LDAP server.
group-attributeSpecify the LDAP attribute that gives a user's group. For example: "memberOf". If multiple values are returned by the LDAP server, the first valid one will be used.
group-fieldSpecify the sub-field of the group-attribute that gives a user's group. For example: if <group-attribute> is "memberOf" which delivers "CN=mygroup, OU=groups, OU=users, DC=mycompany, DC=local", set group-field to "CN". The first matching field will be used.
bind-DNSpecify a template to construct the bind DN from the username. This is only used when <method> is "construct". The string "%u" is replaced by the username. For example:
- "cn=%u,dn=mycompany,dn=local"
group-filterSpecify an alternative group search filter. This is only used when the user record returned by the LDAP filter does not contain the required group information.
This will typically be required if you have Unix/POSIX-style user records. If multiple records are returned the list of group names will be extracted from all of them.
The string "%u" will be replaced by the username. For example:
- "(&(memberUid=%u)(objectClass=posixGroup))"
ssl(Optional) Select the required LDAP security type:
- none. Select this if your LDAP server does not support secure connections.
- starttls. Select this if your LDAP server supports STARTTLS secure connections. You must ensure that a matching CA certificate is present to use this option.
- ldaps. Select this if your LDAP server supports LDAPS secure connections. You must ensure that a matching CA certificate is present to use this option.
search-DNSpecify a DN to use when searching the directory for a user's bind DN. These are only used when the DN Method is Search. You can leave these blank if it is possible to perform the bind DN search using an anonymous bind.
search-passwordSpecify the password for the search-DN.
Examples
amnesiac (config) # ssc sd-authenticator update ldap auth-name "LDAP Server" server 10.62.169.170 dn-method construct filter "sAMAccountName=%u" base-dn "OU=users, DC=tekton, DC=local" fallback-group admin port 389 timeout 20 group-attribute "memberOf" group-field "CN" bind-dn "%[email protected]" group-filter "(&(memberUid=%u)(objectClass=posixGroup))"
+---------------------------------------+
| Modified |
+---------------------------------------+
| SD Authenticator LDAP Server modified |
+---------------------------------------+Related Commands
show ssc sd-admin-ca, ssc sd-authenticator add ldap auth-name, ssc sd-authenticator list, ssc sd-authenticator test auth-name, show ssc sd-admin-ca, ssc sd-admin-ca create, ssc sd-admin-ca list, ssc sd-admin-ca update
ssc sd-authenticator update radius auth-name
Updates a RADIUS-based Services Director authenticator.
Syntax
ssc sd-authenticator create radius auth-name authenticator-name auth-status [enable | disable] [server server | fallback-group fallback-group | port port | timeout timeout-period | group-attribute group-attribute | group-vendor group-vendor | secret secret | nas-identifier NAS-identifier | nas-ip-address NAS-ip-address]Parameters
authenticator-nameSpecify the name of the RADIUS Services Director authenticator.
auth-statusSpecify whether the authenticator is either enabled or disabled.
serverSpecify the IP address or hostname of the RADIUS server.
fallback-groupSpecify a permission group. For example, "admin". If no group is found using the vendor and group identifiers, or the group found is not valid, the permission group specified here will be used.
portSpecify the port used to connect to the RADIUS server.
timeout-periodSpecify the timeout period (in seconds) for a connection to the RADIUS server.
group-attributeSpecify the RADIUS identifier for the attribute that specifies an account's group. May be left blank if <fallback-group> is specified.
group-vendorSpecify the RADIUS identifier for the vendor of the RADIUS attribute that specifies an account's group. Leave blank if using a standard attribute such as Filter-Id.
secretSpecify the secret key shared with the RADIUS server.
NAS-identifierSpecify a string identifying the Network Access Server (NAS) which is requesting authentication of the user. This value is sent to the RADIUS server. If left blank the address of the interface used to connect to the server will be used.
NAS-ip-addressSpecify the identifying IP Address of the NAS which is requesting authentication of the user. This value is sent to the RADIUS server.
Examples
amnesiac (config) # ssc sd-authenticator update radius auth-name "RADIUS Server" server 10.62.167.193 fallback-group admin port 1812 timeout 30 group-attribute 1 group-vendor 1476 secret "radius_secret" nas-identifier "Internal RADIUS" nas-ip-address 127.0.0.1
+-----------------------------------------+
| Modified |
+-----------------------------------------+
| SD Authenticator RADIUS Server modified |
+-----------------------------------------+Related Commands
show ssc sd-admin-ca, ssc sd-authenticator add radius auth-name, ssc sd-authenticator list, ssc sd-authenticator test auth-name
ssc sd-authenticator update tacacs_plus auth-name
Updates a TACACS+-based Services Director authenticator.
Syntax
ssc sd-authenticator update tacacs-plus auth-name authenticator-name auth-status [enable | disable] [server server | auth-type [pap | ascii]| fallback-group fallback-group | port port | timeout timeout-period | group-field group-field | group-service group-service | secret secret]Parameters
authenticator-nameSpecify the name of the TACACS+ Services Director authenticator.
auth-statusSpecify whether the authenticator is either enabled or disabled.
serverSpecify the IP address or hostname of the TACACS+ server.
auth-typeSpecify the TACACS+ authentication type, either PAP or ACSII.
fallback-groupSpecify a permission group. If <group-service> is not defined, or no group value is provided for the user by the TACACS+ server, the group specified here will be used. If this is not specified, users with no TACACS+ defined group will be denied access.
portSpecify the port used to connect to the TACACS+ server.
timeout-periodSpecify the timeout period (in seconds) for a connection to the TACACS+ server.
group-fieldSpecify the TACACS+ "service" field that provides each user's group.
group-serviceSpecify the TACACS+ "service" that identifies a user's group field.
secretSpecify the secret key shared with the TACACS+ server.
Examples
amnesiac (config) # ssc sd-authenticator update tacacs-plus auth-name "TACACS+ Server" server 10.62.167.198 auth-type pap fallback-group admin port 49 timeout 30 group-field permission-group group-service "Hoobland" secret "tacacs_plus_secret"
+------------------------------------------+
| Modified |
+------------------------------------------+
| SD Authenticator TACACS+ Server modified |
+------------------------------------------+Related Commands
show ssc sd-admin-ca, ssc sd-authenticator add tacacs_plus auth-name, ssc sd-authenticator list, ssc sd-authenticator test auth-name
ssc sd-permission-group create pg-name
Creates a Services Director permission group for user authentication.
Syntax
ssc sd-permission-group create pg-name pg-name [description description]Parameters
pg-nameSpecify a name for the Services Director permission group.
descriptionOptionally, specify a description of the permission group.
Usage Guidelines
Typically, there is a single Services Director permission group, with full access. The name of this permission group must match the group returned by the authenticator.
Use the no ssc sd-permission-group pg-name command to delete a permission group.
Examples
amnesiac (config) # ssc sd-permission-group create pg-name admin2 description "administration group"
+--------------------------------+
| Created |
+--------------------------------+
| permission group admin created |
+--------------------------------+
*** delete the admin permission group ***
amnesiac (config) # no ssc sd-permission-group pg-name admin
+--------------------------------+
| Deleted |
+--------------------------------+
| permission group admin deleted |
+--------------------------------+Related Commands
show ssc sd-permission-group, ssc sd-permission-group list, ssc sd-permission-group update pg-name
ssc sd-permission-group list
Lists all defined Services Director permission groups.
Syntax
ssc sd-permission-group listExamples
Typically, there is a single Services Director permission group, with full access. The name of this permission group matches the group returned by the authenticator.
amnesiac (config) # ssc sd-permission-group list
+-------+--------------------------------------+
| Name | Unique ID |
+-------+--------------------------------------+
| admin | Permission-Group-XG8K-FUYG-WKKV-9IKP |
+-------+--------------------------------------+Related Commands
show ssc sd-permission-group, ssc sd-permission-group create pg-name, ssc sd-permission-group update pg-name
ssc sd-permission-group update pg-name
Updates a Services Director permission group.
Syntax
ssc sd-permission-group update permission-group-name pg-name [new-pg-name new-pg-name] [description description]Parameters
permission-group-name pg-nameSpecify a name for the Services Director permission group.
new-pg-nameOptionally, specify a new name for the Services Director permission group.
descriptionOptionally, specify a description of the permission group.
Usage Guidelines
Typically, there is a single Services Director permission group, with full access. The name of this permission group matches the group returned by the authenticator.
Only the description and name can be changed.
Examples
*** list the Services Director permission groups (there is only one) ***
amnesiac (config) # ssc sd-permission-group list
+-------+--------------------------------------+
| Name | Unique ID |
+-------+--------------------------------------+
| admin | Permission-Group-IPI9-J91T-B5J7-D63F |
+-------+--------------------------------------+
*** show details of the only permission group ***
amnesiac (config) # show ssc sd-permission-group pg-name admin
+---------------------+-----------------------------------------------------+
| Field | Value |
+---------------------+-----------------------------------------------------+
| description | Single permission group for SD user authentication. |
| permission_group_id | Permission-Group-IPI9-J91T-B5J7-D63F |
| tag | admin |
| children | None |
+---------------------+-----------------------------------------------------+
*** update the permission group ***
amnesiac (config) # ssc sd-permission-group update pg-name admin new-pg-name charcoal
+--------------------------------+
| Updated |
+--------------------------------+
| permission group admin updated |
+--------------------------------+
*** display changes ***
amnesiac (config) # show ssc sd-permission-group pg-name charcoal
+---------------------+-----------------------------------------------------+
| Field | Value |
+---------------------+-----------------------------------------------------+
| description | Single permission group for SD user authentication. |
| permission_group_id | Permission-Group-IPI9-J91T-B5J7-D63F |
| tag | charcoal |
| children | None |
+---------------------+-----------------------------------------------------+