Config-Mode Commandnds

ssc search-endpoint create

Creates a new Search Endpoint resource. This resource is used for vTM analytics.

Syntax

ssc search-endpoint create search-endpoint-address address transactions-index index logs-index index use-tls Boolean tls-verify Boolean [name value] auth-username username auth-password password endpoint-cert certificate

Parameters

search-endpoint-address

The address of the search endpoint in your analytics system, in the form <server>:<port>.

For example: demo.com:2020

transactions-index

This is the index used for transactions on the Splunk platform.

For example, zxtm_transactions.

logs-index

This is the index used for logs on the Splunk platform.

For example, zxtm_logs.

use-tls

Indicates whether queries require secure transmission. If true, you must also specify endpoint-cert.

tls-verify

Indicates whether queries require verification.

name

(Optional) The customer-facing name for the search endpoint resource. If this is not set, the tag is set to the UUID value for the resource.

auth-username

The authorization username for the search endpoint.

auth-password

The authorization password for the search endpoint.

endpoint-cert

The certificate for the search endpoint. This is required if use-tls is true.

Usage Guidelines

This command is only used for Search Endpoint resources. Collection Endpoint resources are handled separately, by an equivalent "collection-endpoint" command.

Examples

*** list all search endpoints (empty) ***
amnesiac (config) # ssc search-endpoint list
+-----------------+
| Message |
+-----------------+
| No record found |
+-----------------+
*** add a search endpoint resource ***
amnesiac (config) # ssc search-endpoint create search-endpoint-address demo.com:2020 transactions-index zxtm_transactions logs-index zxtm_logs use-tls true tls-verify true name JK-EP-Search-01 auth-username admin auth-password password endpoint-cert "LS0tLS1CRUdJTiBDRVJUSAUG5T...SVElGSUNBVEUtLS0tLQo="
+-----------------------------+----------------------------------------------------
| Field | Value
+-----------------------------+----------------------------------------------------
| verify_tls | True
| tag | JK-EP-Search-01
| search_endpoint_id | Search-Endpoint-P5Y0-8JS4-X0BS-2P9M
| auth_password | password
| auth_username | admin
| search_endpoint_address | demo.com:2020
| use_tls | True
| search_endpoint_certificate | LS0tLS1CRUdJTiBDRVJUSAUG5T...SVElGSUNBVEUtLS0tLQo=
| transactions_index | zxtm_transactions
| logs_index | zxtm_logs
+-----------------------------+----------------------------------------------------
*** list all search endpoints to confirm the addition ***
amnesiac (config) # ssc search-endpoint list
+-------------------------------------+-----------------+
| ID | Tag |
+-------------------------------------+-----------------+
| Search-Endpoint-OFFO-I80A-RVLP-4C49 | JK-EP-Search-01 |
+-------------------------------------+-----------------+

show ssc search-endpoint, ssc search-endpoint delete, ssc search-endpoint list, ssc search-endpoint update

ssc search-endpoint delete

Delete a Search Endpoint resource. This resource is used for vTM analytics.

Syntax

ssc search-endpoint delete name endpoint-id

Parameters

name endpoint-id

The identifier for the search endpoint resource, either its tag or its UUID.

Usage Guidelines

This command is only used for Search Endpoint resources. Collection Endpoint resources are handled separately, by an equivalent "collection-endpoint" command.

Examples

*** display a list of all (typically one) search endpoint ***
amnesiac (config) # ssc search-endpoint list
+-------------------------------------+-----------------+
| ID | Tag |
+-------------------------------------+-----------------+
| Search-Endpoint-P5Y0-8JS4-X0BS-2P9M | JK-EP-Search-01 |
+-------------------------------------+-----------------+
*** Delete a search endpoint ***
amnesiac (config) # ssc search-endpoint delete name JK-EP-Search-01
+-------------------------------------------------------------+
| Deleted |
+-------------------------------------------------------------+
| Search Endpoint Search-Endpoint-P5Y0-8JS4-X0BS-2P9M deleted |
+-------------------------------------------------------------+

show ssc search-endpoint, ssc search-endpoint create, ssc search-endpoint list, ssc search-endpoint update

ssc search-endpoint list

Lists all Search Endpoint resources. These resources are used for vTM analytics.

Syntax

ssc search-endpoint list

Usage Guidelines

Typically, there is a single search endpoint.

This command is only used for Search Endpoint resources. Collection Endpoint resources are handled separately, by an equivalent "collection-endpoint" command.

Examples

amnesiac (config) # ssc search-endpoint list
+-------------------------------------+-----------------+
| ID | Tag |
+-------------------------------------+-----------------+
| Search-Endpoint-P5Y0-8JS4-X0BS-2P9M | JK-EP-Search-01 |
+-------------------------------------+-----------------+

show ssc search-endpoint, ssc search-endpoint create, ssc search-endpoint delete, ssc search-endpoint update

ssc search-endpoint update

Updates a Search Endpoint resource. This resource is used for vTM analytics.

Syntax

ssc search-endpoint update name endpoint-id [search-endpoint-address address]
[use-tls Boolean] [tls-verify Boolean] [endpoint-cert certificate] [auth-username username] [auth-password password] [new-name value]

Parameters

name endpoint-id

Specify a unique identifier for the search-endpoint resource, either its tag or UUID.

search-endpoint-address

The address of the search endpoint on the Splunk platform, in the form <server>:<port>.

For example: demo.com:2020

transactions-index

This is the index used for transactions on the Splunk platform.

For example, zxtm_transactions.

logs-index

This is the index used for logs on the Splunk platform.

For example, zxtm_logs.

use-tls

Indicates whether queries require secure transmission. If true, you must also specify endpoint-cert.

tls-verify

Indicates whether queries require verification.

endpoint-cert

The certificate for the search endpoint. This is required if use-tls is true.

auth-username

The authorization username for the search endpoint.

auth-password

The authorization password for the search endpoint.

new-name

(Optional) A replacement name for the search endpoint resource.

Usage Guidelines

This command is only used for Search Endpoint resources. Collection Endpoint resources are handled separately, by an equivalent "collection-endpoint" command.

Examples

*** list all search endpoints ***
amnesiac (config) # ssc search-endpoint list
+-------------------------------------+-----------------+
| ID | Tag |
+-------------------------------------+-----------------+
| Search-Endpoint-P5Y0-8JS4-X0BS-2P9M | JK-EP-Search-01 |
+-------------------------------------+-----------------+
*** display details for a specific search endpoint ***
amnesiac (config) # show ssc search-endpoint name JK-EP-Search-01
+-----------------------------+----------------------------------------------------
| Field | Value
+-----------------------------+----------------------------------------------------
| verify_tls | True
| tag | JK-EP-Search-01
| search_endpoint_id | Search-Endpoint-P5Y0-8JS4-X0BS-2P9M
| auth_password | password
| auth_username | admin
| search_endpoint_address | demo.com:2020
| use_tls | True
| search_endpoint_certificate | LS0tLS1CRUdJTiBDRVJUSAUG5T...SVElGSUNBVEUtLS0tLQo=
| transactions_index | zxtm_transactions
| logs_index | zxtm_logs
+-----------------------------+----------------------------------------------------
*** update a search endpoint to disable verification ***
amnesiac (config) # ssc search-endpoint update name JK-EP-Search-01 tls-verify false
+-----------------------------+----------------------------------------------------
| Field | Value
+-----------------------------+----------------------------------------------------
| verify_tls | False
| tag | JK-EP-Search-01
| search_endpoint_id | Search-Endpoint-P5Y0-8JS4-X0BS-2P9M
| auth_password | password
| auth_username | admin
| search_endpoint_address | demo.com:2020
| use_tls | True
| search_endpoint_certificate | LS0tLS1CRUdJTiBDRVJUSAUG5T...SVElGSUNBVEUtLS0tLQo=
| transactions_index | zxtm_transactions
| logs_index | zxtm_logs
+-----------------------------+----------------------------------------------------

show ssc search-endpoint, ssc search-endpoint create, ssc search-endpoint delete, ssc search-endpoint list

ssc server rest-port-num

Configures the Services Director REST API port number.

Syntax

[no] ssc server rest-port-num port-number

Parameters

port-number

Specify the REST API port number.

Usage Guidelines

Use the no command option to delete the REST API port number.

Examples

amnesiac (config) # ssc server rest-port-num 1234

show ssc server

ssc service enable

Starts the Services Director service.

Syntax

[no] ssc service enable

Usage Guidelines

Use the no command option disable the service.

Examples

amnesiac (config) # ssc service enable

show ssc server

ssc service restart

Restarts the Services Director service.

Syntax

ssc service restart

Examples

amnesiac (config) # ssc service restart

show ssc server

ssc settings analytics update

Sets the transaction type to match the setting on your vTM analytics platform.

Syntax

sssc settings analytics update transaction-source-type source-type

Parameters

transaction-source-type source-type

Specify the text of the transaction type on your Analytics System.

Examples

*** view current setting ***
amnesiac (config) # show ssc settings analytics
+-------------------------+-------------------+
| Field | Value |
+-------------------------+-------------------+
| transaction_source_type | zxtm_transactions |
+-------------------------+-------------------+
*** change the default setting to match a tailored analytics system ***
amnesiac (config) # ssc settings analytics update transaction-source-type xxx_transactions
+-------------------------+------------------+
| Field | Value |
+-------------------------+------------------+
| transaction_source_type | xxx_transactions |
+-------------------------+------------------+

show ssc settings analytics

ssc settings con-lic update exp-warningdays

Sets expiration days for a warning to be sent for the Services Director license.

Syntax

ssc settings con-lic update exp-warningdays number-of-days

Parameters

number-of-days

Specify the number of days in advance to warn before Services Director license expires.

Examples

amnesiac (config) # ssc settings con-lic update exp-warningdays 30

show ssc settings con-lic

ssc settings con-lic update template-name

Updates Services Director license expiration settings based on the specified template.

Syntax

ssc settings con-lic update template-name name | exp-warningdays number-of-days

Parameters

name

Specify the template name.

number-of-days

Specify the number of days in advance to warn before Services Director license expires.

Usage Guidelines

Updates a Services Director license expiration settings with the parameters predefined in an existing template. The existing template is created by the ssc template create command. The predefined parameters in the existing template are passed to the resource to update the command. You have the option to replace or add extra parameters that exist in the specified template (that is, add extra arguments).

Examples

amnesiac (config) # ssc settings con-lic update template-name con-lic-temp1 exp-warningdays 30

show ssc settings licensing

ssc settings deployment update max-instances

Sets the maximum number of deployable instances.

Syntax

ssc settings deployment update max-instances integer

Parameters

integer

Specify maximum number of deployable instances, 0 equals no limit.

Usage Guidelines

Typically, zero is the correct value for most deployments. Instances that have been deleted do not count towards the limit. Instances that have been deployed but are not active (that is, have not been started) do count towards the limit. If you create a new instance in excess of this number, the instance is rejected with an error message. If this property is set to a lower number than the number of currently deployed instances then there is no immediate effect but subsequent deployment requests are rejected.

Examples

amnesiac (config) # ssc settings deployment update max-instances 0

ssc settings list

ssc settings deployment update template-name

Updates a Services Director deployment based on the specified template.

Syntax

ssc settings deployment update template-name name | max-instances integer

Parameters

name

Specify the template name.

integer

Specify the maximum number of Traffic Manager instances that can be deployed. The default value zero (0) equals no limit. The value must be a positive integer.

Usage Guidelines

Updates a deployment settings with the parameters predefined in an existing template. The existing template is created by the ssc template create command. The predefined parameters in the existing template are passed to the resource to update the command. You have the option to replace or add extra parameters that exist in the specified template (that is, add extra arguments).

Examples

amnesiac (config) # ssc settings deployment update template-name deploytemp1 max-instances 0

ssc settings list, ssc template create template-name

ssc settings external-ip

Sets the external IP corresponding to the Services Endpoint Address when Services Director is running in a private network behind a NAT.

Syntax

[no] ssc settings external-ip

Usage Guidelines

The no command option clears the set external IP address.

Examples

amnesiac (config) # ssc settings external-ip 10.62.150.30
+-------------+--------------+
| Field | Value |
+-------------+--------------+
| external_ip | 10.62.150.30 |
+-------------+--------------+
amnesiac (config) # no ssc settings external-ip
+-------------+-------+
| Field | Value |
+-------------+-------+
| external_ip | None |
+-------------+-------+

show ssc settings external-ip

ssc settings fla-check enable

Enables the FLA checker for the Services Director.

Syntax

[no] ssc settings fla-check enable

Usage Guidelines

The no command option disables the FLA checker.

Examples

amnesiac (config) # ssc settings fla-check enable
+-------------------+-------+
| Field | Value |
+-------------------+-------+
| fla_check_enabled | True |
+-------------------+-------+
amnesiac (config) # no ssc settings fla-check enable
+-------------------+-------+
| Field | Value |
+-------------------+-------+
| fla_check_enabled | False |
+-------------------+-------+

show ssc settings fla-check

ssc settings licensing update alert-threshold

Updates Services Director licensing settings.

Syntax

ssc settings licensing update alert-threshold integer alert-thld-itvl seconds

Parameters

integer

Specify the number of alerts that can be sent. The range is 1-3600, inclusive; the value must be a positive integer.

alert-thld-itvl seconds

Specify the period of time, in seconds, between alerts. The default value is 3600 seconds (1 hour). The range is 1-3600, inclusive; the value must be a positive integer.

Usage Guidelines

The threshold and interval settings enable you to specify the time interval before an alert email is sent to the configured alert email addresses. The threshold and interval is reached then an alert message is sent. At most one message is sent per hour, to protect against a flood of messages being sent in the case of complete failure of the primary license server on a busy system.

Examples

amnesiac (config) # ssc settings licensing update alert-threshold 10 alert-thld-itvl 3600

ssc settings list

ssc settings licensing update template-name

Updates Services Director licensing settings based on the specified template.

Syntax

ssc settings licensing update template-name name alert-threshold integer alert-thld-itvl seconds

Parameters

name

Specify the template name.

alert-threshold integer

Specify the number of alerts that can be sent. The range is 1-3600, inclusive; the value must be a positive integer.

alert-thld-itvl seconds

Specify the period of time, in seconds, between alerts. The default value is 3600 seconds (1 hour). The range is 1-3600, inclusive; the value must be a positive integer.

Usage Guidelines

Updates a licensing settings with the parameters predefined in an existing template. The existing template is created by the ssc template create command. The predefined parameters in the existing template are passed to the resource to update the command. You have the option to replace or add extra parameters that exist in the specified template (that is, add extra arguments).

Examples

amnesiac (config) # ssc settings licensing update template-name lictemp1 alert-threshold 5 alert-thld-itvl 1600

ssc settings list

Lists Services Director settings.

Syntax

ssc settings list

Examples

amnesiac (config) # ssc settings list
+-------------------------+
| Settings |
+-------------------------+
| master_password |
| logging |
| fla_check |
| controller_licensing |
| metering |
| phone_home |
| licensing |
| deployment |
| monitoring |
| bandwidthpack_licensing |
+-------------------------+

ssc settings list

ssc settings logging update

Updates Services Director logging settings.

Syntax

ssc settings logging update | [license-log integer] | [metering-log integer] | [inventory-log integer]

Parameters

license-log integer

Specify the license value. The range is 0-10. The default value is 0, which equals no logging. A log level of 3+ causes responses to license server requests to be logged in full, including the feature values set by the feature pack and bandwidth associated with the instance making the request. The value must be a positive integer; there is no upper limit.

metering-log integer

Specify the metering logging value. The range is 0-10. The default value is 0 which equals no logging. A log level of 5+ gives a summary of the activities of the metering thread (that is, starting metering, stopping metering, and so forth), while a log level of 9+ provides a detailed logging of each instance being metered. The value must be a positive integer; there is no upper limit.

inventory-log integer

Specify the metering logging value. The range is 0-10. The default value is 0, which equals no logging. A log level of 1+ causes inventory changes to be logged (the equivalent of the audit records). A log level of 3+ causes logging of all deployment and action commands. A log level of 8+ causes logging of the output from all deployment and actions. The value must be a positive integer; there is no upper limit.

Examples

amnesiac (config) # ssc settings logging update license-log 5

ssc settings list

ssc settings logging update template-name

Updates Services Director logging settings based on the specified template.

Syntax

ssc settings logging update template-name name | [license-log integer] | [metering-log integer] | [inventory-log integer]

Parameters

name

Specify the template name.

license-log integer

metering-log integer

inventory-log integer

Usage Guidelines

Updates logging with the parameters predefined in an existing template. The existing template is created by the ssc template create command. The predefined parameters in the existing template are passed to the resource to update the command. You have the option to replace or add extra parameters that exist in the specified template (that is, add extra arguments).

Examples

amnesiac (config) # ssc settings logging update template-name tempset1 settemp1 license-log 7

ssc settings list, ssc template create template-name

ssc settings master-password reset

This command resets the master password for a Services Director if it in unknown or lost. This command should only be used as a final resort to re-establish a master password.

Syntax

ssc settings master-password reset password new-password [force [true | false]]

Parameters

new-password

Specify the new master password. This must be at least 8 characters long, and must have at least:

One lower case character.

One upper case character.

One digit.

One non-alphanumeric symbol.

force [true | false]

Specify true or false. If set to true, you can reset the password when there are Traffic Manager instances on the Services Director.

Usage Guidelines

This command is invisible from the command line, but is available.

If you wish to change the master password (that is, you know what the current master password is), use the "ssc settings master-password update" on page 227.

If you have just upgraded from Services Director v2.2r1 or earlier, a default master password has been assigned automatically to the Services Director. The default master password is master1M@. See the Services Director Advanced User Guide for details.

The master password is used to encrypt the passwords of all connected Traffic Manager instances. If you reset the master password, these Traffic Manager passwords are lost, and you must be re-enter the passwords manually. See ssc instance update template-name.

Where Traffic Manager instances are present on the Services Director, you must include the optional force true parameter in the command. This enables the reset to complete. An information message about updating passwords for registered instances is also displayed.

After resetting the master password on the Active Services Director, you must repeat the process for the Standby Services Director.

Examples

*** attempt to reset ***
amnesiac (config) # ssc settings master-password reset password Banj-axed27
Not resetting master password
Ensure that "force true" is passed, to confirm that you wish to reset the master password

*** attempt to reset, including the force true parameter ***
amnesiac (config) # ssc settings master-password reset password Banj-axed27 force true
Successfully reset master password
You must manually update all passwords for registered instances

After resetting the master password on the Active Services Director, you must repeat the process for the Standby Services Director.

show ssc settings master-password, ssc settings list, ssc settings master-password update

ssc settings master-password update

Updates the Services Director master password on a Services Director.

Syntax

ssc settings master-password update current-password current-password new-password new-password

Parameters

current-password current-password

Specify the current password.

new-password new-password

Specify the new password. This must be at least 8 characters long, and must have at least:

One lower case character.

One upper case character.

One digit.

One non-alphanumeric symbol.

Usage Guidelines

This command should be used on the Active node in an HA pair.

While the password change completes, the status displayed by the show ssc settings metering command is Changing. Once complete, it becomes Active.

After you have updated the password on the ActiveServices Director node, repeat the command on the Standby node.

If you wish to reset the master password (that is, you do not know what the current master password is), use the "ssc settings master-password reset" on page 226.

Examples

*** Change the password ***
amnesiac (config) # ssc settings master-password update current-password P0s1-t1ve99 new-password Banj-axed27
+------------------+----------+
| Field | Value |
+------------------+----------+
| status | Changing |
| new_password | None |
| current_password | None |
+------------------+----------+
*** Monitor the password change while it completes ***
*** (status of "Changing" becomes "Active") ***
amnesiac (config) # show ssc settings master-password
+------------------+----------+
| Field | Value |
+------------------+----------+
| status | Active |
| new_password | None |
| current_password | None |
+------------------+----------+

show ssc settings master-password, ssc settings list

ssc settings metering update

Updates Services Director metering settings.

Syntax

ssc settings metering update | [meter-interval integer] | [log-check-itvl seconds] | [snmp-enabled [true | false]] | [alerts-and-notifications [true | false]]

Parameters

meter-interval integer

Specify the period of time, in seconds, between metering actions. The default value is 3600 seconds (1 hour). It cannot be set to more than 3600. The range is 1-3600, inclusive; the value must be a positive integer.

log-check-itvl seconds

Specify the period of time, in seconds, between checks for log-space. The default value is 3600 seconds (1 hour). The range is 1-3600, inclusive; the value must be a positive integer.

snmp-enabled [true | false]

Specify true or false to enable SNMP. By default, this is enabled.

alerts-and-notifications [true | false]

Specify true or false to enable alerts and notifications. By default, this is enabled.

Examples

amnesiac (config) # ssc settings metering update meter-interval 1500 log-check-itvl 1500 snmp-enabled False alerts-and-notifications False
+--------------------------+-------+
| Field | Value |
+--------------------------+-------+
| alerts_and_notifications | False |
| snmp_enabled | False |
| log_check_interval | 1500 |
| meter_interval | 1500 |
+--------------------------+-------+

show ssc dashboard, show ssc metering warning instance-name, show ssc settings metering, ssc metering warning list

ssc settings metering update template-name

Updates Services Director metering settings based on the specified template.

Syntax

ssc settings metering update template-name name | [meter-interval integer] | [log-check-itvl seconds]

Parameters

name

Specify the template name.

meter-interval integer

log-check-itvl seconds

Specify the period of time, in seconds, between checks for log-space. The default value is 3600 seconds (1 hour). The range is 1-3600, inclusive; the value must be a positive integer.

Usage Guidelines

Updates metering with the parameters predefined in an existing template. The existing template is created by the ssc template create command. The predefined parameters in the existing template are passed to the resource to update the command. You have the option to replace or add extra parameters that exist in the specified template (that is, add extra arguments).

Examples

amnesiac (config) # ssc settings metering update template-name mettemp1 meter-interval 3600

ssc settings list

ssc settings monitoring update

Updates Services Director monitoring settings.

Syntax

ssc settings monitoring update [cont-fail-period seconds] | [ins-fail-perid seconds] | [host-fail-period seconds] | [ovd-mon-warn-pd seconds] | [ins-mon-itvl seconds] | [cont-mon-itvl seconds] | [mon-email-itvl seconds] | [host-mon-itvl seconds] | [auto-cleanup-vtms setting]

Parameters

cont-fail-perid seconds

Specify the number of seconds after which a Services Director is considered failed. The default value is 180.

ins-fail-perid seconds

Specify the number of seconds after which an instance is considered failed. The default value is 180.

host-fail-perid seconds

Specify the number of seconds after which a host is considered failed. The default value is 180.

cont-mon-itvl seconds

Specify the number of seconds between monitoring Services Directors. The default value is 60.

ins-mon-itvl seconds

Specify the number of seconds between monitoring instances. The default value is 60.

host-mon-itvl seconds

Specify the number of seconds between monitoring hosts. The default value is 60.

ovd-mon-warn-pd seconds

Specify the number of seconds to consider monitoring overdue. The default value is 300.

mon-email-itvl seconds

Specify the number of seconds between monitoring alert emails. The default value is 60.

auto-cleanup-vtms setting

Select the required setting for auto cleanup of failed vTMs: off, self_registered_vtms, all_vtms.

Examples

amnesiac (config) # ssc settings monitoring update host-mon-itvl 360 mon-email-itvl 3600

show ssc settings monitoring

ssc settings monitoring update template-name

Updates Services Director monitoring settings based on a specified template.

Syntax

ssc settings monitoring update template-name name [cont-fail-period seconds] | [ins-fail-period seconds] | [host-fail-period seconds] | [ovd-mon-warn-pd seconds] | [ins-mon-itvl seconds] | [cont-mon-itvl seconds] | [mon-email-itvl seconds] | [host-mon-itvl seconds]

Parameters

name

Specify the template name.

cont-fail-period seconds

Specify the umber of seconds after which a Services Director is considered failed. The default value is 180 seconds.

ins-fail-period seconds

Specify the number of seconds after which an instance is considered failed. The default value is 180 seconds.

host-fail-period seconds

Specify the number of seconds after which a host is considered failed. The default value is 180 seconds.

ovd-mon-warn-pd seconds

Specify the number of seconds to consider monitoring overdue. The default value is 300 seconds.

ins-mon-itvl seconds

Specify the number of seconds between monitoring instances. The default value is 60 seconds.

cont-mon-itvl seconds

Specify the number of seconds between monitoring Services Directors. The default value is 60 seconds.

mon-email-itvl seconds

Specify the number of seconds between monitoring alert emails. The default value is 60 seconds.

host-mon-itvl seconds

Specify the number of seconds between monitoring hosts. The default value is 60 seconds.

Usage Guidelines

Examples

amnesiac (config) # ssc settings monitoring update template-name monitortemp1 host-mon-itvl 360 mon-email-itvl 360

show ssc settings monitoring

ssc settings security update

Updates Services Director security settings.

Syntax

ssc settings monitoring update [user_lockout_duration_minutes minutes] | [max_login_attempts max_login_attempts]

Parameters

user_lockout_duration_minutes minutes

Specify a suspension lockout duration (in minutes). If the max_login_attempts threshold limit is reached, the suspension duration lockout is applied. This has a default of 1 minute, and a maximum of 1440 minutes (equal to one day).

max_login_attempts max_login_attempts

Specify the maximum number of failed Services Director login attempts for a user. This has a default of zero, which indicates that there is no maximum.

Examples

amnesiac (config) # ssc settings security update max-login-attempts 3 user-lockout-duration 15
+-------------------------------+-------+
| Field | Value |
+-------------------------------+-------+
| user_lockout_duration_minutes | 15 |
| max_login_attempts | 3 |
+-------------------------------+-------+

show ssc settings security

ssc settings telemetry update enabled

Enables/Disables Services Director’s phone home telemetry feature.

When enabled, Services Director collects and exports phone home telemetry data to ivanti.

Syntax

ssc settings telemetry update enabled [true | false]

Parameters

true

Enables the phone home telemetry feature.

false

Disables the phone home telemetry feature.

Examples

*** show phone home telemetry status ***
enable amnesiac (config) # show ssc settings telemetry
+--------------------+-----------------------------------------------------+
| Field | Value |
+--------------------+-----------------------------------------------------+
| destination | https://telemetry.cam.demo.com/product-feedback/1.0 |
| phone_home_enabled | False |
+--------------------+-----------------------------------------------------+
*** Enable phone home telemetry ***
enable amnesiac (config) # ssc settings telemetry update enabled true
+--------------------+-----------------------------------------------------+
| Field | Value |
+--------------------+-----------------------------------------------------+
| destination | https://telemetry.cam.demo.com/product-feedback/1.0 |
| phone_home_enabled | True |
+--------------------+-----------------------------------------------------+
*** Enable phone home telemetry ***
enable amnesiac (config) # ssc settings telemetry update enabled false
+--------------------+-----------------------------------------------------+
| Field | Value |
+--------------------+-----------------------------------------------------+
| destination | https://telemetry.cam.zeus.com/product-feedback/1.0 |
| phone_home_enabled | False |
+--------------------+-----------------------------------------------------+

show ssc settings telemetry archives, show ssc settings telemetry archives

ssc settings throughput update exp-warningdays

Sets expiration days for a warning to be sent for the Services Director about of bandwidth pack licenses.

Syntax

ssc settings throughput update exp-warningdays number-of-days

Parameters

number-of-days

Specify the number of days in advance to warn before Services Director license expires.

Examples

amnesiac (config) # ssc settings throughput update exp-warningdays 30

show ssc settings throughput

ssc settings throughput update template-name

Updates Services Director throughput expiration settings based on the specified template.

Syntax

ssc settings throughput update template-name name | exp-warningdays number-of-days

Parameters

name

Specify the template name.

number-of-days

Specify the number of days in advance to warn for throughput expiration.

Usage Guidelines

Update a Services Director license expiration settings with the parameters predefined in an existing template. The existing template is created by the ssc template create command. The predefined parameters in the existing template are passed to the resource to update the command. You have the option to replace or add extra parameters that exist in the specified template (that is, add extra arguments).

Examples

amnesiac (config) # ssc settings throughput update template-name thrutemp1 exp-warningdays 30

show ssc settings throughput

ssc sku list

Lists Services Director SKUs.

Syntax

ssc sku list [show-all [true | false]

Usage Guidelines

By default, the list only includes SKUs that are compatible with your license.

If show-all is set to true, the list includes all SKUS, and not just those that are compatible with your license.

Examples

*** show SKUs compatible with your license (default) ***
amnesiac (config) # ssc sku list
+-------------+
| Sku |
+-------------+
| STM-200 |
| STM-SAF-400 |
| STM-100 |
| STM-400 |
| STM-SAF-300 |
| STM-300 |
+-------------+

*** show all SKUs, not just those that are compatible with your license ***
amnesiac (config) # ssc sku list show-all true
+----------------------------+
| Sku |
+----------------------------+
| BR-ADC-UTILM-WAFP1G-U-01 |
| BR-ADC-UTILM-WAFP3G-U-01 |
| BR-ADC-UTILM-WAFP400M-U-01 |
| BR-ADC-UTILM-WAFP50M-U-01 |
| BR-ADC-UTILM-WAFP5G-U-01 |
.
. (truncated list)
.
| ENT-ADVANCED |
| ENT-ENTERPRISE |
| ENT-WAFPROXY |
+----------------------------+

show ssc stm images, ssc feature-pack create fpname

ssc stm import-image file

Imports a vTM image.

Syntax

ssc stm import-image file filename-or-remote-location

Parameters

filename-or-remote-location

Specify the filename or the remote location of the Traffic Manager image, for example, http, ftp, or scp URL (scp://username:password@host/path/filename).

Examples

amnesiac (config) # ssc stm import-image file scp://[email protected]/ssc_archive/ZeusTM_97_Linux-x86_64.tgz

show ssc stm images

ssc stm import-lic

Imports the vTM Flexible Licensing Architecture (FLA) license.

Syntax

ssc stm import-lic local-license | [file remote-location license-name remote-license]

Parameters

local-license

Specify the filename of a locally-accessible license.

remote-location

Specify the remote location of the license, for example for example, http, ftp, or scp URL (scp://username:password@host/path/filename).

remote-license

Specify the filename of a remotely-accessible license.

Usage Guidelines

This command can be used to import a license either from a locally-accessible license file, or a remotely-accessible license file.

You must import the following files into the Services Director before you can create instances: SSL certificate and key, Services Director license, enterprise bandwidth license key, FLA license, and Traffic Manager image. If you have not received your license files, contact Ivanti Licensing for assistance.

Examples

*** local file import ***
amnesiac (config) # ssc stm import-lic license.txt

*** remote file import ***
amnesiac (config) # ssc stm import-lic file http://remote.example.com
license-name license.txt

show ssc stm images

ssc template copy source

Creates a copy of a template.

Syntax

ssc template copy source template-name destination new-name

Parameters

template-name

Specify the template source name.

destination new-name

Specify the new template name.

Examples

amnesiac (config) # ssc template copy source hosttemp1 destination hosttemp2

ssc template list

ssc template create template-name

Creates a template for Services Director resources. You use templates to save resource values for reuse later.

Syntax

ssc template create template-name name [arguments]

Usage Guidelines

This command must be used in conjunction with a Services Director CLI command (see below).

Create templates for resources with the predefined parameters for use later. The predefined parameters in the template are passed to the resource. You have the option to replace or add extra parameters that exist in the specified template (that is, add extra arguments) using the resource create and update commands.

To create a feature pack fp-1 without using the template:

ssc feature-pack create fpname fp-1 stm-sku STM-200 excluded 'ts comp'

To create a feature-pack template fptemp-1 :

ssc template create template-name fptemp-1 stm-sku STM-200 excluded 'ts comp'

To create a feature pack fp-2 by using template fptemp-1 :

ssc feature-pack create template-name fptemp-1 fpname fp-2 info test

Update the template fptemp-1 with new values:

ssc template update template-name fptemp-1 stm-sku STM-300

To show the updated template fptemp-1 :

show ssc template template-name fptemp-1
+---------------+----------+
| Field | Value |
+---------------+----------+
| stm-sku | STM-300 |
| excluded | ts comp |
| template-name | fptemp-1 |
+---------------+----------+

Use the no template template-name <name> command option to disable the template.

Examples

amnesiac (config) # ssc template create template-name fptemp-1 stm-sku STM-200 excluded 'ts comp'

ssc template list

Lists Services Director templates.

Syntax

ssc template list

Examples

amnesiac (config) # ssc template list
+-----------------+
| Template |
+-----------------+
| fptemp1 |
| hosttemp1 |
+-----------------+

ssc user create template-name, ssc template update template-name

ssc template update template-name

Updates an existing Services Director template.

Syntax

ssc template update template-name [arguments]

Usage Guidelines

Update templates to add or change common input parameters for specific resources, for example to up date the existing template fptemp-1 with new values:

Examples

ssc template update template-name fptemp-1 stm-sku STM-300
+---------------+----------+
| Field | Value |
+---------------+----------+
| stm-sku | STM-300 |
| excluded | ts comp |
| template-name | fptemp-1 |
+---------------+----------+
amnesiac (config) # ssc template update template-name fptemp-1 stm-sku STM-300

ssc template list

ssc user list

Lists the Services Director user accounts.

Syntax

ssc user list

Examples

amnesiac (config) # ssc user list
+-------+
| User |
+-------+
| admin |
+-------+

ssc user create template-name, ssc template update template-name

ssc user create template-name

Creates a Services Director user account based on a template.

Syntax

ssc user create template-name name user-name name password password

Parameters

name

Specify a unique name for the template.

name

Specify the user name. The default name is sscadmin.

password

Specify the password for the user.

Usage Guidelines

Creates users with the parameters predefined in an existing template. The existing template is created by the ssc template create command. The predefined parameters in the existing template are passed to the resource to create the command. You have the option to replace or add extra parameters that exist in the specified template (that is, add extra arguments).

Examples

amnesiac (config) # ssc user create template-name usertemp1 user-name test password test123

ssc user list

ssc user create user-name

Creates a Services Director user account.

Syntax

ssc user create user-name name password password

Parameters

name

Specify the user name. The default name is sscadmin.

password

Specify the password for the user.

Examples

amnesiac (config) # ssc user create user-name test password test123

ssc user list

ssc user update template-name

Updates user settings based on the specified template.

Syntax

ssc user update template-name name | [user-name name] | [active [Active | Inactive]] | [password password]

Parameters

name

Specify the template name.

name

Specify the user name. The default name is sscadmin.

active

Specify the status:

Active: Activates a resource.

Inactive: Deactivates a resource. A resource cannot be marked as Inactive if it is in use. The resource cannot be reactivated Inactive status has been specified.

password password

Specify the password for the user.

Usage Guidelines

Updates user settings with the parameters predefined in an existing template. The existing template is created by the ssc template create command. The predefined parameters in the existing template are passed to the resource to update the command. You have the option to replace or add extra parameters that exist in the specified template (that is, add extra arguments).

Examples

amnesiac (config) # ssc user update template-name usertemp1 user-name admin1

ssc user list

ssc user update user-name

Updates user template.

Syntax

ssc user update user-name name | [active [Active | Inactive] ] [password password]
[aws-access-key aws-key] [aws-secret-access-key aws-secret-key]

Parameters

name

Specify the user name. The default name is sscadmin.

active

Specify the status:

Active: Activates a resource.

Inactive: Deactivates a resource. A resource cannot be marked as Inactive if it is in use. The resource cannot be reactivated once Inactive status has been specified.

password password

Specify the password for the user.

aws-key

Specify the access key for your AWS credentials.

aws-secret-key

Specify the secret access key for your AWS credentials.

Examples

amnesiac (config) # ssc user update user-name admin1 status Inactive

ssc user list

ssc version create template-name

Creates a vTM version based on a template.

Syntax

ssc version create template-name name vfilename name-of-version-tarball-file vdirectory name-of-directory-to-which-tarball-extracts | [info description]

Parameters

name

Specify a unique name for the template.

name-of-version-tarball-file

Specify the name of the Traffic Manager image.

name-of-directory-to-which-tarball-extracts

Specify the name of directory to which Traffic Manager image extracts; if none, specify the tarball name.

info description

Optionally, specify information about the template.

Usage Guidelines

Creates versions with the parameters predefined in an existing template. The existing template is created by the ssc template create command. The predefined parameters in the existing template are passed to the resource to create the command. You have the option to replace or add extra parameters that exist in the specified template (that is, add extra arguments).

Examples

amnesiac (config) # ssc version create template-name vtemp1 vfilename stm97 vdirectory ZeusTM_97_Linux-x86_64.tgz

show ssc version version-name, ssc version list

ssc version create

Creates an version name for the vTM image or tarball.

Syntax

ssc version create version-name name vfilename name-of-version-tarball-file vdirectory directory-or-tarball-name | [info description]

Parameters

unique-name

Specify a unique name for the Traffic Manager image.

name-of-version-tarball-file

Specify the name of the Traffic Manager image.

directory-or-tarball-name

Specify the name of directory to which tarball extracts; if none, specify the tarball name.

info description

Optionally, specify a description of the image.

Usage Guidelines

Creates a version name for the Traffic Manager image or tarball.

Examples

amnesiac (config) # ssc version create version-name stm97 vfilename ZeusTM_97_Linux-x86_64.tgz

show ssc version version-name, ssc version list

ssc version list

Lists the vTM images.

Syntax

ssc version list

Examples

amnesiac (config) # ssc version list
+---------+
| Version |
+---------+
| stm97 |
+---------+

ssc version create, ssc version update template-name

ssc version update template-name

Updates the version settings based on the specified template.

Syntax

ssc version update template-name name | [version-name name] | [vfilename image-filename]| | [status [Active | Inactive]] | [info description]

Parameters

name

Specify the template name.

name-of-version-tarball-file

Specify the name of the Traffic Manager image.

vdirectory name-of-directory-to-which-tarball-extracts

Specify the name of directory to which Traffic Manager image extracts; if none, specify the tarball name.

status

Specify the status:

Active: Activates a resource.

Inactive: Deactivates a resource. A resource cannot be marked as Inactive if it is in use. The resource cannot be reactivated Inactive status has been specified.

info description

Optionally, specify a description of the template.

Usage Guidelines

Updates version settings with the parameters predefined in an existing template. The existing template is created by the ssc template create command. The predefined parameters in the existing template are passed to the resource to update the command. You have the option to replace or add extra parameters that exist in the specified template (that is, add extra arguments).

Examples

amnesiac (config) # ssc version update template-name vtemp1 status Inactive

show ssc version version-name, ssc version list

ssc version update version-name

Updates the version.

Syntax

ssc version update version-name name | [vfilename image-filename] | | [status [Active | Inactive]] | [info description]

Parameters

name

Specify the version name.

name-of-version-tarball-file

Specify the name of the Traffic Manager image.

status [Active | Inactive]

Specify the status:

Active: Activates a resource.

Inactive: Deactivates a resource. A resource cannot be marked as Inactive if it is in use. The resource cannot be reactivated Inactive status has been specified.

info description

Optionally, specify a description of the template.

Examples

amnesiac (config) # ssc version update version-name stm97 status Inactive

show ssc version version-name, ssc version list

ssc vtm-admin-ca create

Creates a vTM CA certificate that is for use with a secure LDAP server authenticator.

Syntax

ssc vtm-admin-ca create admin-ca-name tag certificate-authority certificate-text

Parameters

tag

A unique name for the CA certificate.

certificate-text

The text of the CA certificate.

Examples

*** List all vTM CA certificates on Services Director ***
amnesiac (config) # ssc vtm-admin-ca list
+----------+----------------------------------+
| Name | Unique ID |
+----------+----------------------------------+
| VTM-CA-1 | VTM-Admin-CA-KBBH-G7LT-K6SK-B6N4 |
+----------+----------------------------------+

*** add a new certificate ***
amnesiac (config) # ssc vtm-admin-ca create admin-ca-name VTM-CA-2 certificate-authority "-----BEGIN CERTIFICATE----- ...<certificate body>... -----END CERTIFICATE----- >"
+----------------------------------------------+
| Created |
+----------------------------------------------+
| admin certificate authority VTM-CA-2 created |
+----------------------------------------------+
*** confirm creation ***
amnesiac (config) # ssc vtm-admin-ca list
+----------+----------------------------------+
| Name | Unique ID |
+----------+----------------------------------+
| VTM-CA-1 | VTM-Admin-CA-KBBH-G7LT-K6SK-B6N4 |
| VTM-CA-2 | VTM-Admin-CA-6J21-KKH3-VSAJ-3209 |
+----------+----------------------------------+

ssc vtm-admin-ca list, ssc vtm-admin-ca update, show ssc vtm-admin-ca, ssc vtm-authenticator add ldap auth-name, ssc vtm-authenticator list, ssc vtm-authenticator update ldap auth-name

ssc vtm-admin-ca list

Lists all vTM CA certificate that are for use with a secure LDAP server authenticator.

Syntax

ssc vtm-admin-ca list

Examples

amnesiac (config) # ssc vtm-admin-ca list
+----------+----------------------------------+
| Name | Unique ID |
+----------+----------------------------------+
| VTM-CA-1 | VTM-Admin-CA-KBBH-G7LT-K6SK-B6N4 |
| VTM-CA-2 | VTM-Admin-CA-6J21-KKH3-VSAJ-3209 |
+----------+----------------------------------+

ssc vtm-admin-ca create, ssc vtm-admin-ca update, show ssc vtm-admin-ca, ssc vtm-authenticator add ldap auth-name, ssc vtm-authenticator list, ssc vtm-authenticator update ldap auth-name

ssc vtm-admin-ca update

Updates a vTM CA certificate that is for use with a secure LDAP server authenticator.

Syntax

ssc vtm-admin-ca create admin-ca-name tag certificate-authority certificate-text new-admin-ca-name new-tag

Parameters

tag

A unique name for the CA certificate.

certificate

The text of the CA certificate.

new-tag

A new unique name for the CA certificate.

Examples

*** list certificates ***
amnesiac (config) # ssc vtm-admin-ca list
+----------+----------------------------------+
| Name | Unique ID |
+----------+----------------------------------+
| VTM-CA-1 | VTM-Admin-CA-KBBH-G7LT-K6SK-B6N4 |
| VTM-CA-2 | VTM-Admin-CA-6J21-KKH3-VSAJ-3209 |
+----------+----------------------------------+
*** rename the CA-2 certificate ***
amnesiac (config) # ssc vtm-admin-ca update admin-ca-name VTM-CA-2 new-admin-ca-name V-LDP2
+------------------------------------------+
| Updated |
+------------------------------------------+
| admin certificate authority CA-2 updated |
+------------------------------------------+
*** confirm update ***
amnesiac (config) # ssc vtm-admin-ca list
+----------+----------------------------------+
| Name | Unique ID |
+----------+----------------------------------+
| VTM-CA-1 | VTM-Admin-CA-KBBH-G7LT-K6SK-B6N4 |
| V-LDP2 | VTM-Admin-CA-6J21-KKH3-VSAJ-3209 |
+----------+----------------------------------+

ssc vtm-admin-ca create, ssc vtm-admin-ca list, show ssc vtm-admin-ca, ssc vtm-authenticator add ldap auth-name, ssc vtm-authenticator list, ssc vtm-authenticator update ldap auth-name

ssc vtm-authenticator add ldap auth-name

Adds an LDAP-based vTM authenticator. This can be either secure on non-secure.

Syntax

ssc vtm-authenticator add ldap auth-name authenticator-name server server dn-method method filter filter base-dn base-DN fallback-group fallback-group port port timeout timeout-period group-attribute group-attribute group-field group-field bind-dn bind-DN group-filter group-filter ssl ssl [search-dn search-DN search-password password]

Parameters

authenticator-name

Specify a name for the LDAP vTM authenticator.

server

Specify the IP address or hostname of the LDAP server.

method

Specify how the bind DN for a user will be derived. Either:

construct: the bind DN for a user can be constructed from a known string, (see <bind-DN>)

search: the bind DN for a user can be searched for in the directory. This is necessary if you have users under different directory paths.

filter

Specify a filter that uniquely identifies a user located under the Base DN.

The string "%u" will be substituted with the username. For example:

Active Directory: "sAMAccountName=%u"

Unix LDAP: "uid=%u"

base-DN

Specify the base DN (Distinguished Name) for directory searches.

fallback-group

Specify a permission group. For example, "admin". If <group-attribute> is not defined, or is not set for the user, this permission group will be used. If not specified, users with no attribute matching group-attribute will be denied access.

port

Specify the port used to connect to the LDAP server.

timeout-period

Specify the timeout period (in seconds) for a connection to the LDAP server.

group-attribute

Specify the LDAP attribute that gives a user's group. For example: "memberOf". If multiple values are returned by the LDAP server, the first valid one will be used.

group-field

Specify the sub-field of the group-attribute that gives a user's group. For example: if <group-attribute> is "memberOf" which delivers "CN=mygroup, OU=groups, OU=users, DC=mycompany, DC=local", set group-field to "CN". The first matching field will be used.

bind-DN

Specify a template to construct the bind DN from the username. This is only used when <method> is "construct". The string "%u" is replaced by the username. For example:

"%[email protected]"

"cn=%u,dn=mycompany,dn=local"

group-filter

Specify an alternative group search filter. This is only used when the user record returned by the LDAP filter does not contain the required group information.

This will typically be required if you have Unix/POSIX-style user records. If multiple records are returned the list of group names will be extracted from all of them.

The string "%u" will be replaced by the username. For example:

"(&(memberUid=%u)(objectClass=posixGroup))"

ssl

(Optional) Select the required LDAP security type:

none. Select this if your LDAP server does not support secure connections.

starttls. Select this if your LDAP server supports STARTTLS secure connections. You must ensure that a matching CA certificate is present to use this option.

ldaps. Select this if your LDAP server supports LDAPS secure connections. You must ensure that a matching CA certificate is present to use this option.

search-DN

Specify a DN to use when searching the directory for a user's bind DN. These are only used when the DN Method is Search. You can leave these blank if it is possible to perform the bind DN search using an anonymous bind.

search-password

Specify the password for the search-DN.

Usage Guidelines

Use the no ssc vtm-authenticator auth-name command to delete an authenticator.

You cannot delete a vTM authenticator that is associated with an access profile.

Examples

*** create an LDAP authenticator ***
amnesiac (config) # ssc vtm-authenticator add ldap auth-name "LDAP Server 2" server 10.62.169.170 dn-method "construct" filter "sAMAccountName=%u" base-dn "OU=users, DC=tekton, DC=local" fallback-group admin port 389 timeout 30 group-attribute "memberOf" group-field "CN" bind-dn "%[email protected]" group-filter "(&(memberUid=%u)(objectClass=posixGroup)) ssl starttls"
+-----------------------------------------+
| Created |
+-----------------------------------------+
| vTM Authenticator LDAP Server 2 created |
+-----------------------------------------+
*** delete an authenticator ***
amnesiac (config) # no ssc vtm-authenticator auth-name "LDAP Server 2"
+-----------------------------------------+
| Deleted |
+-----------------------------------------+
| vTM Authenticator LDAP Server 2 deleted |
+-----------------------------------------+

show ssc vtm-authenticator, ssc vtm-authenticator list, ssc vtm-authenticator update ldap auth-name

ssc vtm-authenticator add radius auth-name

Adds a RADIUS-based vTM authenticator.

Syntax

ssc vtm-authenticator add radius auth-name authenticator-name server server fallback-group fallback-group port port timeout timeout-period group-attribute group-attribute group-vendor group-vendor secret secret nas-identifier NAS-identifier nas-ip-address NAS-ip-address

Parameters

authenticator-name

Specify a name for the RADIUS vTM authenticator.

server

Specify the IP address or hostname of the RADIUS server.

fallback-group

Specify a permission group. For example, "admin". If no group is found using the vendor and group identifiers, or the group found is not valid, the permission group specified here will be used.

port

Specify the port used to connect to the RADIUS server.

timeout-period

Specify the timeout period (in seconds) for a connection to the RADIUS server.

group-attribute

Specify the RADIUS identifier for the attribute that specifies an account's group. May be left blank if <fallback-group> is specified.

group-vendor

Specify the RADIUS identifier for the vendor of the RADIUS attribute that specifies an account's group. Leave blank if using a standard attribute such as Filter-Id.

secret

Specify the secret key shared with the RADIUS server.

NAS-identifier

Specify a string identifying the Network Access Server (NAS) which is requesting authentication of the user. This value is sent to the RADIUS server. If left blank the address of the interface used to connect to the server will be used.

NAS-ip-address

Specify the identifying IP Address of the NAS which is requesting authentication of the user. This value is sent to the RADIUS server.

Usage Guidelines

Use the no ssc vtm-authenticator auth-name command to delete an authenticator.

You cannot delete a vTM authenticator that is associated with an access profile.

Examples

*** create a RADIUS authenticator ***
amnesiac (config) # ssc vtm-authenticator add radius auth-name "RADIUS Server 2" server 10.62.167.193 fallback-group admin port 1812 timeout 30 group-attribute 1 group-vendor 1476 secret * nas-identifier "Internal RADIUS" nas-ip-address 127.0.0.1
+-------------------------------------------+
| Created |
+-------------------------------------------+
| vTM Authenticator RADIUS Server 2 created |
+-------------------------------------------+

*** delete an authenticator ***
amnesiac (config) # no ssc vtm-authenticator auth-name "RADIUS Server 2"
+-------------------------------------------+
| Deleted |
+-------------------------------------------+
| vTM Authenticator RADIUS Server 2 deleted |
+-------------------------------------------+

show ssc vtm-authenticator, ssc vtm-authenticator list, ssc vtm-authenticator update radius auth-name

ssc vtm-authenticator add tacacs_plus auth-name

Adds a TACACS+-based vTM authenticator.

Syntax

ssc vtm-authenticator add tacacs-plus auth-name authenticator-name server server auth-type [pap | ascii] fallback-group fallback-group port port timeout timeout-period group-field group-field group-service group-service secret secret

Parameters

authenticator-name

Specify a name for the TACACS+ vTM authenticator on the Services Director.

server

Specify the IP address or hostname of the TACACS+ server.

auth-type

Specify the TACACS+ authentication type, either PAP or ACSII.

fallback-group

Specify a permission group. If <group-service> is not defined, or no group value is provided for the user by the TACACS+ server, the group specified here will be used. If this is not specified, users with no TACACS+ defined group will be denied access.

port

Specify the port used to connect to the TACACS+ server.

timeout-period

Specify the timeout period (in seconds) for a connection to the TACACS+ server.

group-field

Specify the TACACS+ "service" field that provides each user's group.

group-service

Specify the TACACS+ "service" that identifies a user's group field.

secret

Specify the secret key shared with the TACACS+ server.

Usage Guidelines

Use the no ssc vtm-authenticator auth-name command to delete an authenticator.

You cannot delete a vTM authenticator that is associated with an access profile.

Examples

*** create a TACACS+ authenticator ***
amnesiac (config) # ssc vtm-authenticator add tacacs-plus auth-name "TACACS+ Server 2" server 10.62.167.198 auth-type pap fallback-group admin port 49 timeout 30 group-field permission-group group-service "Hoobland" secret "tacacs_plus_secret"
+--------------------------------------------+
| Created |
+--------------------------------------------+
| vTM Authenticator TACACS+ Server 2 created |
+--------------------------------------------+

*** delete an authenticator ***
amnesiac (config) # no ssc vtm-authenticator auth-name "TACACS+ Server 2"
+--------------------------------------------+
| Deleted |
+--------------------------------------------+
| vTM Authenticator TACACS+ Server 2 deleted |
+--------------------------------------------+

show ssc vtm-authenticator, ssc vtm-authenticator list, ssc vtm-authenticator update tacacs_plus auth-name

ssc vtm-authenticator list

Lists all defined vTM authenticators.

Syntax

ssc vtm-authenticator list

Examples

amnesiac (config) # ssc vtm-authenticator list
+----------------+-----------------------------------+
| Name | Unique ID |
+----------------+-----------------------------------+
| LDAP Server | Authenticator-D83I-9095-TT8R-CUAT |
| Secure LDAP | Authenticator-J82I-2237-GR9R-ADCB |
| RADIUS Server | Authenticator-808G-LJWJ-MT3B-WMDZ |
| TACACS+ Server | Authenticator-7F1D-A1K3-1PO4-VSEF |
+----------------+-----------------------------------+

show ssc vtm-authenticator, ssc vtm-admin-ca create, ssc vtm-authenticator add radius auth-name, ssc vtm-authenticator add tacacs_plus auth-name, ssc vtm-authenticator update ldap auth-name, ssc vtm-authenticator update radius auth-name, ssc vtm-authenticator update tacacs_plus auth-name

ssc vtm-authenticator update ldap auth-name

Updates an LDAP-based vTM authenticator.

Syntax

ssc vtm-authenticator update ldap auth-name authenticator-name [server server | dn-method method | filter filter | base-dn base-DN | fallback-group fallback-group | port port | timeout timeout-period | group-attribute group-attribute | group-field group-field | bind-dn bind-DN | group-filter group-filter | ssl ssl | search-dn search-DN | search-password password]

Parameters

authenticator-name

Specify the name of the LDAP vTM authenticator.

server

Specify the IP address or hostname of the LDAP server.

method

Specify how the bind DN for a user will be derived. Either:

construct: the bind DN for a user can be constructed from a known string, (see <bind-DN>) or

search: the bind DN for a user can be searched for in the directory. This is necessary if you have users under different directory paths.

filter

Specify a filter that uniquely identifies a user located under the Base DN.

The string "%u" will be substituted with the username. For example:

Active Directory: "sAMAccountName=%u"

Unix LDAP: "uid=%u"

base-DN

Specify the base DN (Distinguished Name) for directory searches.

fallback-group

port

Specify the port used to connect to the LDAP server.

timeout-period

Specify the timeout period (in seconds) for a connection to the LDAP server.

group-attribute

Specify the LDAP attribute that gives a user's group. For example: "memberOf". If multiple values are returned by the LDAP server, the first valid one will be used.

group-field

bind-DN

Specify a template to construct the bind DN from the username. This is only used when <method> is "construct". The string "%u" is replaced by the username. For example:

"%[email protected]"

"cn=%u,dn=mycompany,dn=local"

group-filter

Specify an alternative group search filter. This is only used when the user record returned by the LDAP filter does not contain the required group information.

This will typically be required if you have Unix/POSIX-style user records. If multiple records are returned the list of group names will be extracted from all of them.

The string "%u" will be replaced by the username. For example:

"(&(memberUid=%u)(objectClass=posixGroup))"

ssl

(Optional) Select the required LDAP security type:

none. Select this if your LDAP server does not support secure connections.

starttls. Select this if your LDAP server supports STARTTLS secure connections. You must ensure that a matching CA certificate is present to use this option.

ldaps. Select this if your LDAP server supports LDAPS secure connections. You must ensure that a matching CA certificate is present to use this option.

search-DN

search-password

Specify the password for the search-DN.

Examples

amnesiac (config) # ssc vtm-authenticator update ldap auth-name "LDAP Server" server 10.62.169.170 dn-method construct filter "sAMAccountName=%u" base-dn "OU=users, DC=tekton, DC=local" fallback-group admin port 389 timeout 20 group-attribute "memberOf" group-field "CN" bind-dn "%[email protected]" group-filter "(&(memberUid=%u)(objectClass=posixGroup))"
+------------------------------------------+
| Modified |
+------------------------------------------+
| vTM Authenticator LDAP Server modified |
+------------------------------------------+

show ssc vtm-authenticator, ssc vtm-admin-ca create, ssc vtm-authenticator list

ssc vtm-authenticator update radius auth-name

Updates a RADIUS-based vTM authenticator.

Syntax

ssc vtm-authenticator create radius auth-name authenticator-name [server server | fallback-group fallback-group | port port | timeout timeout-period | group-attribute group-attribute | group-vendor group-vendor | secret secret | nas-identifier NAS-identifier | nas-ip-address NAS-ip-address]

Parameters

authenticator-name

Specify the name of the RADIUS vTM authenticator.

server

Specify the IP address or hostname of the RADIUS server.

fallback-group

Specify a permission group. For example, "admin". If no group is found using the vendor and group identifiers, or the group found is not valid, the permission group specified here will be used.

port

Specify the port used to connect to the RADIUS server.

timeout-period

Specify the timeout period (in seconds) for a connection to the RADIUS server.

group-attribute

Specify the RADIUS identifier for the attribute that specifies an account's group. May be left blank if <fallback-group> is specified.

group-vendor

Specify the RADIUS identifier for the vendor of the RADIUS attribute that specifies an account's group. Leave blank if using a standard attribute such as Filter-Id.

secret

Specify the secret key shared with the RADIUS server.

NAS-identifier

NAS-ip-address

Specify the identifying IP Address of the NAS which is requesting authentication of the user. This value is sent to the RADIUS server.

Examples

amnesiac (config) # ssc vtm-authenticator update radius auth-name "RADIUS Server" server 10.62.167.193 fallback-group admin port 1812 timeout 30 group-attribute 1 group-vendor 1476 secret "radius_secret" nas-identifier "Internal RADIUS" nas-ip-address 127.0.0.1
+--------------------------------------------+
| Modified |
+--------------------------------------------+
| vTM Authenticator RADIUS Server modified |
+--------------------------------------------+

show ssc vtm-authenticator, ssc vtm-authenticator add radius auth-name, ssc vtm-authenticator list

ssc vtm-authenticator update tacacs_plus auth-name

Updates a TACACS+-based vTM authenticator.

Syntax

ssc vtm-authenticator update tacacs-plus auth-name authenticator-name [server server | auth-type [pap | ascii] | fallback-group fallback-group | port port | timeout timeout-period | group-field group-field | group-service group-service | secret secret]

Parameters

authenticator-name

Specify the name of the TACACS+ vTM authenticator.

server

Specify the IP address or hostname of the TACACS+ server.

auth-type

Specify the TACACS+ authentication type, either PAP or ACSII.

fallback-group

port

Specify the port used to connect to the TACACS+ server.

timeout-period

Specify the timeout period (in seconds) for a connection to the TACACS+ server.

group-field

Specify the TACACS+ "service" field that provides each user's group.

group-service

Specify the TACACS+ "service" that identifies a user's group field.

secret

Specify the secret key shared with the TACACS+ server.

Examples

amnesiac (config) # ssc vtm-authenticator update tacacs-plus auth-name "TACACS+ Server" server 10.62.167.198 auth-type pap fallback-group admin port 49 timeout 30 group-field permission-group group-service "Hoobland" secret "tacacs_plus_secret"
+---------------------------------------------+
| Modified |
+---------------------------------------------+
| vTM Authenticator TACACS+ Server 2 modified |
+---------------------------------------------+

show ssc vtm-authenticator, ssc vtm-authenticator add tacacs_plus auth-name, ssc vtm-authenticator list

ssc vtm-permission-group create pg-name

Creates a vTM permission group for user authentication.

Syntax

ssc vtm-permission-group create pg-name pg-name [description description] [timeout timeout-period]

Parameters

pg-name

Specify a name for the vTM permission group.

description

Optionally, specify a description of the permission group.

timeout-period

Optionally, specify a timeout period (in minutes).

If this is not specified, it defaults to 30.

Usage Guidelines

This command creates the group, but does not support the setting of permissions. To set access levels for activities, see ssh server allowed-ciphers.

Use the no ssc vtm-permission-group pg-name command to delete a permission group.

You cannot delete a permission group that is associated with an access profile.

Examples

amnesiac (config) # ssc vtm-permission-group create pg-name Statistics description "RO subset of monitoring" timeout 30
+-------------------------------------+
| Created |
+-------------------------------------+
| permission group Statistics created |
+-------------------------------------+

*** delete the Statistics permission group ***
amnesiac (config) # no ssc vtm-permission-group pg-name Statistics
+-------------------------------------+
| Deleted |
+-------------------------------------+
| permission group Statistics deleted |
+-------------------------------------+

show ssc vtm-permission-group, ssc vtm-permission-group list, ssc vtm-permission-group update pg-name

ssc vtm-permission-group list

Lists all defined vTM permission groups.

Syntax

ssc vtm-permission-group list

Examples

amnesiac (config) # ssc vtm-permission-group list
+------------+--------------------------------------+
| Name | Unique ID |
+------------+--------------------------------------+
| admin | admin |
| Demo | Demo |
| Statistics | Permission-Group-E5O9-N28C-13OC-AT0I |
| Monitoring | Monitoring |
| Guest | Guest |
+------------+--------------------------------------+

show ssc vtm-permission-group, ssc vtm-permission-group create pg-name, ssc vtm-permission-group update pg-name

ssc vtm-permission-group update pg-name

Updates a vTM permission group for user authentication.

Syntax

ssc vtm-permission-group update permission-group-name pg-name [new-pg-name new-gp-name] [description description] [timeout timeout-period] [[remove] permission permission access access]

Parameters

pg-name

Specify a name for the vTM permission group.

new-pg-name

Optionally, specify a new name for the permission group.

description

Optionally, specify a description of the permission group.

timeout-period

Optionally, specify a timeout period (in minutes).

If this is not specified, it defaults to 30.

remove

Include this to remove the specified permission instead of adding it.

permission

The permission for which the access is to be set.

access

The required access (none, ro, full) for the permission.

Usage Guidelines

This command includes support for setting access levels for specific activities.

There are four default permission groups (admin, Demo, Monitoring and Guest), and you can create additional permission groups, see ssc vtm-permission-group list.

Each permission supports the following access levels: none, ro (read-only), full.

Where a permission branch node is specified as the permission, all of its leaf nodes will share the specified access level.

Where all permissions require the same access level, the permission "all" can be used. The admin permission group has this setting by default.

Examples

*** update the permission group ***
amnesiac (config) # ssc vtm-permission-group update pg-name my_pg permission Pools access full
+--------------------------------+
| Updated |
+--------------------------------+
| permission group my_pg updated |
+--------------------------------+
*** display changes ***
amnesiac (config) # show ssc vtm-permission-group pg-name my_pg
+--------------+---------------------------------------------------+--------+
| Parameter | Value | |
+--------------+---------------------------------------------------+--------+
| Name | my_pg | |
| Unique Name | Permission-Group-XIG4-FUQT-YAWN-H2JF | |
| Description | | |
| Timeout | 30 | |
| Permissions: | ------------------------------------------------- | ------ |
| | Permission String | Access |
| | ------------------------------------------------- | ------ |
| | Connections | full |
| | Connections!Details | full |
| | Draining | none |
| | Log_Viewer | none |
| | Log_Viewer!View | none |
| | Map | none |
| | Monitoring | none |
| | Monitoring!Edit | none |
| | Pools | full |
| | Pools!Edit | full |
| | Pools!Edit!Autoscaling | full |
| | Pools!Edit!Bandwidth | full |
| | Pools!Edit!Connection_Management | full |
| | Pools!Edit!DNSAutoscaling | full |
| | Pools!Edit!Kerberos_Protocol_Transition | full |
| | Pools!Edit!Load_Balancing | full |
| | Pools!Edit!Monitors | full |
| | Pools!Edit!Persistence | full |
| | Pools!Edit!SSL | full |
| | Request_Logs | none |
| | Statd | none |
| | Web_Cache | none |
| | Web_Cache!Clear | none |
+--------------+---------------------------------------------------+--------+

show ssc vtm-permission-group, ssc vtm-permission-group create pg-name, ssc vtm-permission-group list

ssh server allowed-ciphers

Sets the list of allowed ciphers for ssh server.

Syntax

[no] ssh server allowed-ciphers ciphers

Parameters

ciphers

Specify cipher or comma separated list of ciphers, in quotation marks. Default ciphers configured are aes128-ctr, aes192-ctr, and aes256-ctr.

Supported ciphers are:

aes128cbc

3descbc

blowfishcbc

cast128cbc

arcfour

aes192cbc

aes256cbc

aes128ctr

aes192ctr

aes256ctr

Usage Guidelines

The no command option resets the SSH server allowed ciphers.

Examples

amnesiac (config) # ssh server allowed-ciphers "aes128-ctr,aes192-ctr,aes256-ctr"

show ssc server

ssh server enable

Enables SSH access to the system.

Syntax

[no] ssh server enable

Usage Guidelines

The no command option disables SSH access.

Examples

amnesiac (config) # ssh server enable

show ssc server

ssh server listen enable

Enables SSH interface restriction access to the system (that is, it enables access control and blocks requests on all the interfaces).

Syntax

[no] ssh server listen enable

Usage Guidelines

If the list of interfaces is empty, none of the interfaces respond to the queries.

The no command option disables SSH interface restrictions which causes SSH to accept connections from all interfaces.

SSH interface restrictions are not available through the Management Console.

Examples

amnesiac (config) # ssh server listen enable

show ssc server

ssh server listen interface

Adds one or more interfaces to the SSH server access restriction list (thus, it unblocks requests on the specified interface).

Syntax

[no] ssh server listen interface interface

Parameters

interface

Specify the interface: primary, aux, inpath0_0, inpath0_1, rios_lan0_0, rios_wan0_0

Usage Guidelines

If the list of interfaces is empty, none of the interfaces respond to the queries. If the list of interfaces has at least one entry, then the server listens on that subset of interfaces.

Examples

amnesiac (config) # ssh server listen interface primary

show ssc server

ssh server port

Sets a port for SSH access.

Syntax

[no] ssh server port port

Parameters

port

Specify a port for SSH access.

Usage Guidelines

The no command option resets the SSH port to its default.

Examples

amnesiac (config) # ssh server port 8080

show ssc server

ssh server v2-only enable

Enables SSH server to accept only v2 connections, which are more secure.

Syntax

[no] ssh server v2-only enable

Usage Guidelines

This command restricts the server to accept only v2 protocol connections, which are more secure.

The no command option removes the restriction.

Examples

amnesiac (config) # ssh server v2-only enable

show ssc server

tcpdump stop-trigger delay

Configures the time to wait before stopping a TCP dump.

Syntax

[no] tcpdump stop-trigger delay duration

Parameters

duration

Specify the amount of time to wait before stopping all running TCP dumps when RiOS finds a match. The default delay is 30 seconds.

Usage Guidelines

You might not want to stop your TCP dump immediately. By configuring a delay, the system has time to log more data without abruptly cutting off the dumps. The default delay is 30 seconds.

Examples

amnesiac (config) # tcpdump stop-trigger delay 10

tcpdump stop-trigger enable, tcpdump stop-trigger regex, tcpdump stop-trigger restart

tcpdump stop-trigger enable

Enables the TCP dump to stop running, triggered by a match against a configured regular expression and the system log file.

Syntax

[no] tcpdump stop-trigger enable

Usage Guidelines

There is a limit to the amount of TCP dump data the system can collect. After a problem has occurred, the TCP dump buffer could have rotated, overwriting the information about the problem. This command enables a trigger that stops a continuous TCP dump after a specific log event occurs. This enables you to troubleshoot issues and isolate the TCP dump data specific to a problem.

The no version of the command disables the TCP dump stop-trigger process.

Examples

amnesiac (config) # tcpdump stop-trigger regex ntp
amnesiac (config) # tcpdump stop-trigger delay 20
amnesiac (config) # tcpdump stop-trigger enable

tcpdump stop-trigger delay, tcpdump stop-trigger regex, tcpdump stop-trigger restart

tcpdump stop-trigger regex

Sets the regular expression that triggers the stopping of TCP dumps.

Syntax

tcpdump stop-trigger regex regex

Parameters

regex

Specify a PERL regular expression to match. RiOS compares the PERL regular expression against each entry made to the system logs. The system matches on a per-line basis.

Usage Guidelines

Use the tcpdump stop-trigger regex command to configure a regular expression that represents a condition that, when matched, stops all running TCP dumps. After this match is found, all TCP dump sessions are stopped after the delay configured by the tcpdump stop-trigger delay command.

Examples

In the following example, RiOS searches for the pattern ntp in the system logs. The system waits 20 seconds after there is a match and then stops all TCP dumps that are still running.

amnesiac (config) # tcpdump stop-trigger regex ntp
amnesiac (config) # tcpdump stop-trigger delay 20
amnesiac (config) # tcpdump stop-trigger enable

tcpdump stop-trigger delay, tcpdump stop-trigger enable, tcpdump stop-trigger restart

tcpdump stop-trigger restart

Restarts the TCP dump stop-trigger process.

Syntax

tcpdump stop-trigger restart

Usage Guidelines

If you change the regular expression or delay, use the tcpdump stop-trigger restart command to restart the stop-trigger process.

Examples

amnesiac (config) # tcpdump stop-trigger regex ntp
amnesiac (config) # tcpdump stop-trigger delay 50
amnesiac (config) # tcpdump stop-trigger enable
amnesiac (config) # tcpdump stop-trigger restart

tcpdump stop-trigger delay, tcpdump stop-trigger enable, tcpdump stop-trigger regex

tcpdump-x all-interfaces

Configures a list of all interfaces for a TCP dump capture.

Syntax

[no] tcpdump-x all-interfaces [capture-name capture-name] continuous | | buffer-size size-in-KB | duration seconds [schedule-time HH:MM:SS [schedule-date YYYY/MM/DD]] | [rotate-count num-files] | [snaplength snaplength] | [sip src-addr] | [dip dst-addr] | [sport src-port] | [dport dst-port] | [dot1q {tagged | untagged | both}] | [ip6] | [custom custom-param] | [file-size megabytes]

Parameters

capture-name capture-name

Specify a capture name to help you identify the TCP Dump. The default filename uses the following format:

<hostname>_<interface>_<timestamp>.cap

Where hostname is the hostname of the appliance, interface is the name of the interface selected for the trace (for example, lan0_0, wan0_0), and timestamp is in the YYYY-MM-DD-HH-MM-SS format.

The cap file extension is not included with the filename when it appears in the capture queue.

continuous

Start a continuous capture.

buffer-size size-in-KB

Specify the size in KB for all packets.

duration seconds

Specify the run time for the capture in seconds. The default is 30 seconds.

schedule-time HH:MM:SS

Specify a time to initiate the trace dump in the following format: HH:MM:SS.

schedule-date YYYY/MM/DD

Specify a date to initiate the trace dump in the following format: YYYY/MM/DD

rotate-count num-files

Specify the number of files to rotate.

snaplength snaplength

Specify the snap length value for the trace dump. The default value is 1518. Specify 0 for a full packet capture (recommended for CIFS, MAPI, and SSL traces).

sip src-addr

Specify a comma-separated list of source IP addresses. The default setting is all IP addresses.

dip dst-addr

Specify a comma-separated list of destination IP addresses. The default setting is all IP addresses.

sport src-port

Specify a comma-separated list of source ports. The default setting is all ports.

dport dst-port

Specify a comma-separated list of destination ports. The default setting is all ports.

dot1q

Specify one of the following to filter dot1q packets:

tagged: Capture only tagged traffic.

untagged: Capture only untagged traffic.

both: Capture all traffic.

Do not use the sip, dip, sport, dport and custom parameters together when using the dot1q both option. Use the tcpdump command instead to capture this information.

For detailed information about dot1q VLAN tunneling, see your networking equipment documentation.

ip6

Specify IPv6 packets for packet capture.

custom custom-param

Specify custom parameters (flags) for packet capture. You need to enclose the customer parameter in quotes if it contains more than one word.

file-size megabytes

Specify the file size of the capture in megabytes.

Usage Guidelines

You can capture and retrieve multiple TCP trace dumps. You can generate trace dumps from multiple interfaces at the same time and you can schedule a specific date and time to generate a trace dump.

Examples

The following example starts a continuous capture for a file named tcpdumpexample with a duration of 120 seconds:

amnesiac (config) # tcpdump-x all-interfaces capture-name tcpdumpexample continuous duration 120

The following example captures untagged traffic on destination port 7850 and ARP packets:

amnesiac (config) # tcpdump-x all-interfaces dot1q untagged dport 7850 custom "and arp"

The following example captures VLAN tagged traffic for host 10.11.0.6 and ARP packets:

amnesiac (config) # tcpdump-x all-interfaces dot1q tagged sip 10.11.0.6 custom "or arp"

The following example captures tagged ARP packets only:

amnesiac (config) # tcpdump-x all-interfaces dot1q tagged custom "and arp"

The following example captures untagged ARP packets only:

amnesiac (config) # tcpdump-x all-interfaces dot1q untagged custom "and arp"

show tcpdump-x, tcpdump

tcpdump-x capture-name stop

Stops the specified TCP dump capture.

Syntax

[no] tcpdump-x capture-name capture-name stop

Parameters

capture-name

Specify the capture name to stop.

Examples

amnesiac (config) # tcpdump-x capture-name example stop

show tcpdump-x, tcpdump

tcpdump-x interfaces

Configures a comma-separated list of interfaces to capture in the background.

Syntax

[no] tcpdump-x interfaces interface-name continuous | duration seconds [schedule-time HH:MM:SS [schedule-date YYYY/MM/DD]] | [rotate-count num-files] | [snaplength snaplength] | [sip src-addr] | [dip dst-addr] | [sport src-port] [dport dst-port] | [dot1q {tagged | untagged | both}] [ip6] | [custom custom-param] | [file-size megabytes]

Parameters

interface-name

Specify a comma-separated list of interfaces: primary, aux, lan0_0, wan0_0

continuous

Start a continuous capture.

duration seconds

Specify the run time for the capture in seconds.

schedule-time HH:MM:SS

Specify a time to initiate the trace dump in the following format: HH:MM:SS

schedule-date YYYY/MM/DD

Specify a date to initiate the trace dump in the following format: YYYY/MM/DD

rotate-count num-files

Specify the number of files to rotate.

snaplength snaplength

Specify the snap length value for the trace dump. The default value is 1518. Specify 0 for a full packet capture (recommended for CIFS, MAPI, and SSL traces).

sip src-addr

Specify the source IP addresses. The default setting is all IP addresses.

dip dst-addr

Specify a comma-separated list of destination IP addresses. The default setting is all IP addresses.

sport src-port

Specify a comma-separated list of source ports. The default setting is all ports.

dport dst-port

Specify a comma-separated list of destination ports. The default setting is all ports.

dot1q

Specify one of the following to filter dot1q packets:

tagged: Capture only tagged traffic.

untagged: Capture only untagged traffic.

both: Capture all traffic.

Do not use the sip, dip, sport, dport and custom parameters together when using the dot1q both option. Use the tcpdump command to capture this information.

For detailed information about dot1q VLAN tunneling, see your networking equipment documentation.

ip6

Specify IPv6 packets for packet capture.

custom custom-param

Specify custom parameters (flags) for packet capture.

file-size megabytes

Specify the file size of the capture in megabytes.

Examples

amnesiac (config) # tcpdump-x interfaces inpath0_0 continuous
amnesiac (config) # tcpdump-x interfaces aux ip6 sip 2003::5

show tcpdump-x, tcpdump

telnet-server enable

Enables you to access the CLI using telnet. This feature is disabled by default.

Syntax

[no] telnet-server enable

Usage Guidelines

You can use telnet to troubleshoot your system. It enables you to access the CLI from another system.

Examples

amnesiac (config) # telnet-server enable

show telnet-server

username disable

Disables the account so that no one can log in.

Syntax

[no] username userid disable

Parameters

userid

Specify the user login: admin or monitor.

Usage Guidelines

The no command option re-enables the specified user account.

Examples

amnesiac (config) # username monitor disable

ssh client generate identity user

username nopassword

Disables password protection for a user.

Syntax

username userid nopassword

Parameters

userid

Specify the user login: admin or monitor.

Examples

amnesiac (config) # username monitor nopassword

ssh client generate identity user

username password

Sets the password for the specified user.

Syntax

username userid password cleartext [old-password cleartext]

Parameters

userid

Specify the user login: admin or monitor.

password cleartext

Specify the new password. The password must be at least 6 characters.

old-password cleartext

Specify the old password.

Usage Guidelines

The password is entered in cleartext format on the command line.

The old-password option allows you to check the minimum character difference between the old and new passwords under account control management.

Examples

amnesiac (config) # username admin password xyzzzZ

ssh client generate identity user

username password 0

Sets the password for the specified user.

Syntax

username userid password 0 cleartext-password

Parameters

userid

Specify the user login: admin or monitor.

cleartext-password

Specify the password. The password must be at least 6 characters.

Usage Guidelines

The password is entered in cleartext format on the command line.

Examples

amnesiac (config) # username admin password 0 xyzzzZ

ssh client generate identity user

username password 7

Sets the password for the specified user using the encrypted format of the password. Use this command if it becomes necessary to restore your appliance configuration, including the password.

Syntax

username userid password 7 encrypted-password

Parameters

userid

Specify the user login: admin or monitor.

encrypted-password

Specify the encrypted password. The password must be at least 6 characters.

Usage Guidelines

Use this command to restore your password using an encrypted version of the password. You can display the encrypted version of the password using the show running configuration command.

For example, executing username monitor password awesomepass results in the following line being added to the running configuration file:

username monitor password 7 $1$f2Azp8N8$n0oy6Y1KhCfuMo93f24ku/

If you need to restore your password in the future, you would paste:

username monitor password 7 $1$f2Azp8N8$n0oy6Y1KhCfuMo93f24ku/

in the CLI, to restore your monitor password to awesomepass.

Examples

amnesiac (config) # username admin password 7 $1$f2Azp8N8$n0oy6Y1KhCfuMo93f24ku/

ssh client generate identity user

web auto-logout

Sets the number of minutes before the Management Console automatically logs out the user.

Syntax

[no] web auto-logout minutes

Parameters

minutes

Specify the number of minutes before the system automatically logs out the user. The default value is 15 minutes.

Usage Guidelines

The no command option disables the automatic log out feature.

Examples

amnesiac (config) # web auto-logout 20

show web

web auto-refresh timeout

Enables session timeouts on auto-refreshing report pages.

Syntax

[no] web auto-refresh timeout

Usage Guidelines

Disabling this feature keeps you logged in indefinitely on a report page that is auto-refreshing. This can be a security risk.

The no command option disables time-out.

Examples

amnesiac (config) # web auto-refresh timeout

show web

web enable

Enables the Management Console.

Syntax

[no] web enable

Usage Guidelines

The Management Console is enabled by default.

The no command option disables the Management Console.

Examples

amnesiac (config) # web enable

show web

web http enable

Enables HTTP access to the Management Console.

Syntax

[no] web http enable

Usage Guidelines

The Management Console is enabled by default.

The no command option disables the Management Console.

Examples

amnesiac (config) # web http enable

show web

web http port

Sets the Web port for HTTP access.

Syntax

[no] web http port port

Parameters

port

Specify the port number. The default value is 80.

Usage Guidelines

The no command option resets the Web port to the default value.

Examples

amnesiac (config) # web http port 8080

show web

web httpd listen enable

Restricts Web interface access to this system (that is, it enables access control and blocks requests on all the interfaces).

Syntax

[no] web httpd listen enable

Usage Guidelines

The no command option disables Web interface restrictions.

Web interface restrictions are not available through the Management Console.

Examples

amnesiac (config) # web httpd listen enable

show web

web httpd listen interface

Adds an interface to the Web server access restriction list.

Syntax

[no] web httpd listen interface interface

Parameters

interface

Specify the interface: primary, aux, inpath0_0, rios_lan0_0, rios_wan0_0

Usage Guidelines

If the list of interfaces is empty, none of the interfaces respond to the queries. If the list of interfaces has at least one entry, then the server listens on that subset of interfaces.

Examples

amnesiac (config) # web httpd listen interface aux

show web

web httpd log-format

Changes the Web server log format (Apache httpd LogFormat).

Syntax

[no] web httpd log-format log-format-for-Apache-httpd

Parameters

log-format-for-Apache-httpd

Specify the log format arguments for Apache LogFormat. For detailed information about the Apache LogFormat arguments, see http://httpd.apache.org/docs.

Usage Guidelines

The no command option disables Web log-format.

Examples

amnesiac (config) # web httpd log-format "%h %l %u %t \"%r\" %>s %b"

show web

web httpd server-header

Changes the Apache Server header line. (Apache httpd LogFormat).

Syntax

[no] web httpd server-header "Server:"-header-line

Parameters

"Server:"-header-line

Specify the log format arguments for Apache LogFormat. For detailed information about the Apache Server header line, see http://httpd.apache.org/docs.

Usage Guidelines

The no command option disables Web log-format.

Examples

amnesiac (config) # web httpd server-header "Server:Example HTTPD Server"

show web

web httpd timeout

Configures the Web server timeout period.

Syntax

[no] web httpd timeout number-of-seconds

Parameters

number-of-seconds

Specify the Web server timeout period in seconds.

Usage Guidelines

The no command option disables Web log-format.

Examples

amnesiac (config) # web httpd log-format "%h %l %u %t \"%r\" %>s %b"

show web

web https enable

Enables HTTPS access to the Web-based management console.

Syntax

[no] web https enable

Usage Guidelines

The no command option disables access to the Web-based management console.

Examples

amnesiac (config) # web https enable

show web

web https port

Sets the HTTPS secure Web port.

Syntax

[no] web https port port

Parameters

port

Specify the port number. The default value is 80.

Usage Guidelines

The no command option disables support on a secure port.

Examples

amnesiac (config) # web https port 8080

show web

web prefs log lines

Sets the number of lines for the system log page.

Syntax

[no] web prefs log lines number

Parameters

number

Specify the number of lines per log page.

Usage Guidelines

The no command option disables the number of log lines.

Examples

amnesiac (config) # web prefs logs lines 10

show web

web proxy host

Sets the HTTP, HTTPS, and FTP proxy.

Syntax

[no] web proxy host ip-addr [port port] [user-cred username username password password [authtype authentication-type]]

Parameters

ip-addr

Specify the IP address for the host.

port port

Specify the port for the host.

user-cred

Optionally, specify the user credentials for the autolicensing feature:

username username: Specify the user name.

password password: Specify the password, in cleartext format.

authtype authentication-type

Optionally, specify the authentication type:

basic: Authenticates user credentials by requesting a valid user name and password. This is the default setting.

digest: Provides the same functionality as basic authentication; however, digest authentication improves security because the system sends the user credentials across the network as a Message Digest 5 (MD5) hash.

ntlm: Authenticates user credentials based on an authentication challenge and response.

Usage Guidelines

Use this command to enable the appliance to use a Web proxy to contact the Ivanti licensing portal and fetch licenses in a secure environment. You can optionally require user credentials to communicate with the Web proxy for use with the autolicensing feature. You can specify the method used to authenticate and negotiate these user credentials.

The no command option resets the Web proxy settings to the default behavior. Web proxy access is disabled by default.

RiOS supports the following proxies: Squid, Blue Coat Proxy SG, Microsoft WebSense, and McAfee Web Gateway.

Examples

amnesiac (config) # web proxy host 10.1.2.1 port 1220

show web

web rest-server enable

Enables the REST (REpresentational State Transfer) server.

Syntax

[no] web rest-server enable

Usage Guidelines

The no command disables the REST server.

Examples

amnesiac (config) # web rest-server enable

show web

web session renewal

Sets the session renewal time. This is the time before the Web session time-out. If a Web request comes in, it automatically renews the session.

Syntax

[no] web session renewal minutes

Parameters

minutes

Specify the number of minutes. The default value is 10 minutes.

Usage Guidelines

The no command option resets the session renewal time to the default value.

Examples

amnesiac (config) # web session renewal 5

show web

web session timeout

Sets the session time-out value. This is the amount of time the cookie is active.

Syntax

[no] web session timeout minutes

Parameters

minutes

Specify the number of minutes. The default value is 60 minutes.

Usage Guidelines

The no command option resets the session time-out to the default value.

Examples

amnesiac (config) # web session timeout 120

show web

web snmp-trap conf-mode enable

Enables SNMP traps in Web configure mode.

Syntax

[no] web snmp-trap conf-mode enable

Usage Guidelines

The no command option disables this setting.

Examples

amnesiac (config) # web snmp-trap conf-mode enable

show web

web soap-server enable

Enables the Simple Object Access Protocol (SOAP) server.

Syntax

[no] web soap-server enable

Usage Guidelines

The no command option disables this setting.

Examples

amnesiac (config) # web soap-server enable

show web

web soap-server port

Enables the Simple Object Access Protocol (SOAP) server port.

Syntax

[no] web soap-server port port

Parameters

port

Specify the port.

Usage Guidelines

The no command option disables this setting.

Examples

amnesiac (config) # web soap-server port 1234

show web

web ssl cert generate

Generates a new SSL key and self-signed certificate.

Syntax

web ssl cert generate | [key-size 512 | 1024 | 2048] | [country string] | [email email-address] | [locality string] | [org string] | [org-unit string] | [state string] | [valid-days integer]

Parameters

key-size

Specify the key size.

country string

Specify the certificate two-letter country code. The country code can be any two-letter code, such as the ISO 3166 Country Codes, as long as the appropriate Certificate Authority can verify the code.

email email-address

Specify the email address of the contact person.

locality string

Specify the city.

org string

Specify the organization.

org-unit string

Specify the organization unit (for example, the company).

state string

Specify the state. You cannot use abbreviations.

valid-days integer

Specify how many days the certificate is valid. If you omit valid-days, the default is 2 years.

Examples

amnesiac (config) # web ssl cert generate

show web ssl cert

web ssl cert generate-csr

Generates a certificate signing request with current private key.

Syntax

web ssl cert generate-csr [common-name name] [country string] [email email-address] [locality string] [org string] [org-unit string] [state string]

Parameters

common-name name

Specify the common name of the certificate authority.

country string

Specify the certificate two-letter country code. The country code can be any two-letter code, such as the ISO 3166 Country Codes, as long as the appropriate Certificate Authority can verify the code.

email email-address

Specify the email address of the contact person.

locality string

Specify the city.

org string

Specify the organization.

org-unit string

Specify the organization unit (for example, the company).

state string

Specify the state. You cannot use abbreviations.

valid-days int

Specify how many days the certificate is valid. If you omit valid-days, the default is 2 years.

Usage Guidelines

This command is available on the Interceptor appliance starting in version 4.0.

Examples

amnesiac (config) # web ssl cert generate-csr

show web ssl cert

web ssl cert import-cert

Imports a certificate, optionally with current private key, in PEM format, and optionally a password.

Syntax

web ssl cert import-cert cert-data import-key key [password password]

Parameters

import-cert cert-data

Specify the text of the certificate file in PEM format.

import-key key

Specify the text of the private key in PEM format.

password password

Optionally, specify a password.

Usage Guidelines

If no key is specified the incoming certificate is matched with the existing private key, and accepted if the two match. A password is required if imported certificate data is encrypted.

Examples

amnesiac (config) # web ssl cert import-cert <cert-text> import-key <key-text>

show web ssl cert

web ssl cert import-cert-key

Imports a certificate with current private key in PEM format.

Syntax

web ssl cert import-cert-key cert-key-data [password password]

Parameters

import-cert-key cert-key-data

Specify the text of the private key and certificate file in PEM format.

[password password]

Optionally, specify a password.

Examples

amnesiac (config) # web ssl cert import-cert-key <key-text>

show web ssl cert

web ssl protocol sslv2

Sets the SSL v2 protocols for Apache to use.

Syntax

[no] web ssl protocol sslv2

Usage Guidelines

The no command option disables this setting.

Examples

amnesiac (config) # web ssl protocol sslv2

show web ssl cert

web ssl protocol sslv3

Sets the SSL v3 protocols for Apache to use.

Syntax

[no] web ssl protocol sslv3

Usage Guidelines

The no command option disables this setting.

Examples

amnesiac (config) # web ssl protocol sslv3

show web ssl cert

web ssl protocol tlsv1

Sets the SSL v1 protocols for Apache to use.

Syntax

[no] web ssl protocol tlsv1

Usage Guidelines

The no command option disables this setting.

Examples

amnesiac (config) # web ssl protocol tlsv1

show web ssl cert

web ssl protocol tlsv1.1

Sets the SSL v1.1 protocols for Apache to use.

Syntax

[no] web ssl protocol tlsv1.1

Usage Guidelines

The no command option disables this setting.

Examples

amnesiac (config) # web ssl protocol tlsv1.1

show web ssl cert

web ssl protocol tlsv1.2

Sets the SSL v1.2 protocols for Apache to use.

Syntax

[no] web ssl protocol tlsv1.2

Usage Guidelines

The no command option disables this setting.

Examples

amnesiac (config) # web ssl protocol tlsv1.2

show web ssl cert

write memory

Saves the current configuration settings to memory.

Syntax

write memory

Examples

amnesiac (config) # write memory

show info

write terminal

Displays commands to recreate current running configuration.

Syntax

write terminal

Examples

amnesiac (config) # write terminal

show info

Config-Mode Commandnds

ssc search-endpoint create

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

ssc search-endpoint delete

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

ssc search-endpoint list

Syntax

Usage Guidelines

Examples

Related Commands

ssc search-endpoint update

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

ssc server rest-port-num

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

ssc service enable

Syntax

Usage Guidelines

Examples

Related Commands

ssc service restart

Syntax

Examples

Related Commands

ssc settings analytics update

Syntax

Parameters

Examples

Related Commands

ssc settings con-lic update exp-warningdays

Syntax

Parameters

Examples

Related Commands

ssc settings con-lic update template-name

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

ssc settings deployment update max-instances

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

ssc settings deployment update template-name

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

ssc settings external-ip

Syntax

Usage Guidelines

Examples

Related Commands

ssc settings fla-check enable

Syntax

Usage Guidelines

Examples

Related Commands

ssc settings licensing update alert-threshold

Syntax

Parameters