Configuration-Mode Commands

Entering configuration mode

You can perform configuration tasks while in configuration mode. Only administrator users can perform configuration mode and enable mode commands. All commands available in user mode and enable mode are also available in configuration mode. Monitor users cannot perform configuration tasks.

To enter configuration-mode:

Connect to the CLI and enter the following commands:

login as: admin
Services Director
Last login: Wed Jan 20 13:02:09 2010 from 10.0.1.1
amnesiac > enable
amnesiac # configure terminal
amnesiac (config) #

You are now in configuration mode.

To exit configuration mode, enter exit. For information about the exit command, see ping

For an alphabetical list of Configuration-Mode commands, see the Contents page of this book.

Configuration-Mode Commands

The following section contains the Services Director commands.

For an alphabetical list of Configuration-Mode commands, see the Table of Contents for this guide.

access enable

Enables secure access to an appliance using an internal management Access Control List (ACL).

Syntax

[no] access enable
Usage Guidelines

Appliances are subject to the network policies defined by corporate security policy, particularly in large networks. Using an internal management ACL you can:

restrict access to certain interfaces or protocols of an appliance.

restrict inbound IP access to an appliance, protecting it from access by hosts that do not have permission without using a separate device (such as a router or firewall).

specify which hosts or groups of hosts can access and manage an appliance by IP address, simplifying the integration of appliances into your network. You can also restrict access to certain interfaces or protocols.

This feature provides the following safeguards to prevent accidental disconnection from the appliance.

It detects the IP address you are connecting from and displays a warning if you add a rule that denies connections to that address.

It always allows the default appliance ports 7800, 7801, 7810, 7820, and 7850.

It always allows a previously-connected appliance to connect and tracks any changes to the IP address of the CMC to prevent disconnection.

It converts well-known port and protocol combinations such as SSH, Telnet, HTTP, HTTPS, SNMP, and SOAP into their default management service and protects these services from disconnection. For example, if you specify protocol 6 (TCP) and port 22, the management ACL converts this port and protocol combination into SSH and protects it from denial.

It tracks changes to default service ports and automatically updates any references to changed ports in the access rules.

You can also change the standard port for HTTPS (443) to match your management standards using web prefs log lines and web httpd listen enable.

Examples

amnesiac (config) # access enable

show access status, show access inbound rules

access inbound rule add

Adds a secure access inbound rule.

Syntax

[no] access inbound rule add [allow | deny] protocol protocol-number service service dstport port srcaddr ip-addr interface interface rulenum rulenum | [log [on | off] ] | [override]

Parameters

allow | deny
Specify the action on the rule:

allow: Allows a matching packet access to the appliance. This is the default action.

deny: Denies access to any matching packets.

protocol protocol-number
Specify all, icmp, tcp, udp, or protocol number (1, 6, 17) in IP packet header. The default setting is all.
service service
Optionally, specify the service name: http, https, snmp, ssh, soap, telnet
dstport port
Optionally, specify the destination port of the inbound packet.
You can also specify port ranges: 1000-30000
srcaddr ip-addr
Optionally, specify the source subnet of the inbound packet; for example, 1.2.3.0/24
interface interface
Optionally, specify an interface name: primary, aux, inpath0_0.
rulenum rulenum
Optionally, specify a rule number from 1 to N, start, or end.

The appliances evaluate rules in numerical order starting with rule 1. If the conditions set in the rule match, then the rule is applied, and the system moves on to the next packet. If the conditions set in the rule do not match, the system consults the next rule. For example, if the conditions of rule 1 do not match, rule 2 is consulted. If rule 2 matches the conditions, it is applied, and no further rules are consulted.

description

Optionally, specify a description to facilitate communication about network administration.

log [on | off]

Optionally, specify to track denied packets in the log. By default, packet logging is enabled.

override

Specify to ignore the warning and force the rule modification. If you add, delete, edit, or move a rule that could disconnect you from the appliance, a warning message appears. You can specify override to ignore the warning and force the rule modification. Use caution when you override a disconnect warning.

Usage Guidelines

The management ACL contains rules that define a match condition for an inbound IP packet. You set a rule to allow or deny access to a matching inbound IP packet. When you add a rule on the appliance, the destination specifies the appliance itself, and the source specifies a remote host.

The ACL rules list contains default rules that allow you to use the management ACL with the RiOS features PFS, DNS caching, and RSP. These default rules allow access to certain ports required by these features. The list also includes a default rule that allows access to the CMC. If you delete the default ACL rules for one of these features and need to restore it.

Examples

amnesiac (config) # access inbound rule add allow protocol tcp/udp
dstport 1234 srcaddr 10.0.0.1/16 interface primary rulenum 2

show access inbound rules, show access status

access inbound rule edit rulenum

Modifies a secure access inbound rule.

Syntax

[no] access inbound rule edit rulenum rulenum action [allow | deny] [protocol protocol-number service service dstport port | srcaddr subnet | interface interface |] | log [on | off] | [override]

Parameters

rulenum rulenum

Optionally, specify a rule number from 1 to N, start, or end.

appliances evaluate rules in numerical order starting with rule 1. If the conditions set in the rule match, then the rule is applied, and the system moves on to the next packet. If the conditions set in the rule do not match, the system consults the next rule. For example, if the conditions of rule 1 do not match, rule 2 is consulted. If rule 2 matches the conditions, it is applied, and no further rules are consulted.

action [allow | deny]

Specify the action on the rule:

allow

Allows a matching packet access to the appliance. This is the default action.

deny

Denies access to and logs any matching packets.

protocol protocol-number

Specify all, icmp, tcp, udp, or protocol number (1, 6, 17) in IP packet header. The default setting is all.

service service

Optionally, specify the service name: http, https, snmp, ssh, telnet

dstport port

Specify the destination port.

You can also specify port ranges: 1000-30000

srcaddr subnet

Specify the source subnet.

For the subnet address, use the format XXX.XXX.XXX.XXX/XX.

interface interface

Specify the interface: primary, aux, inpath0_0

description

Optionally, specify a description to facilitate communication about network administration.

log [on | off]

Optionally, specify to enable or disable log in on this command.

override

Examples

amnesiac (config) # access inbound rule edit action allow dstport 1234 srcaddr 10.0.0.1/16 service http interface primary rulenum 2

ssh client generate identity user, show access inbound rules, show access status

access inbound rule move

Moves a secure access inbound rule.

Syntax

[no] access inbound rule move rulenum to rulenum [override]

Parameters

rulenum rulenum

Specify a rule number from 1 to N, start, or end.

Appliances evaluate rules in numerical order starting with rule 1. If the conditions set in the rule match, then the rule is applied, and the system moves on to the next packet. If the conditions set in the rule do not match, the system consults the next rule. For example, if the conditions of rule 1 do not match, rule 2 is consulted. If rule 2 matches the conditions, it is applied, and no further rules are consulted.

override

Examples

amnesiac (config) # access inbound rule move 2 to 4

ssh client generate identity user, show access inbound rules, show access status

alarm clear

Clears the specified alarm type.

Syntax

alarm type clear

Parameters

type

See alarm enable for a complete listing and description of alarm types.

Usage Guidelines

Use this command to clear the status of the specified alarm type. If you clear an alarm and the error condition still exists, the alarm might be triggered again immediately. If you need to clear an alarm permanently, use the no alarm enable command.

Examples

amnesiac (config) # alarm secure_vault_unlocked clear

show alarm, show alarms

alarm clear-threshold

Sets the threshold to clear the specified alarm type.

Syntax

[no] alarm type clear-threshold threshold-level

Parameters

type

See alarm enable for a complete listing and description of alarm types.

threshold-level

Specify the threshold level. The threshold level depends on the alarm type, as do the possible values.

Usage Guidelines

Use this command to set the threshold at which the alarm is cleared.

Examples

amnesiac (config) # alarm cpu_util_indiv clear-threshold 70

show alarm, show alarms

alarm enable

Enables the specified alarm.

Syntax

[no] alarm type enable

Parameters

type

The alarm type:

autolicense_error: This alarm triggers on a virtual appliance when the Ivanti Licensing Portal cannot respond to a license request with valid licenses.

autolicense_info: This alarm triggers if the Ivanti Licensing Portal has information regarding licenses for a virtual appliance.

backup_generate_fail: This alarm triggers when the generation of a Services Director backup fails.

backup_transfer_fail: This alarm triggers when the transfer of a generated Services Director backup fails.

cpu_util_indiv: This alarm indicates whether the system has reached the CPU threshold for any of the CPUs in the system. If the system has reached the CPU threshold, check your settings. If your alarm thresholds are correct, reboot the appliance.

flash_error: This alarm indicates that the system has detected an error with the flash drive hardware. At times, the USB flash drive that holds the system images might become unresponsive; the appliance continues to function normally. When this error triggers you cannot perform a software upgrade, as the appliance is unable to write a new upgrade image to the flash drive without first power cycling the system. To reboot the appliance, enter the reload command to automatically power cycle the appliance and restore the flash drive to its proper function.

fs_mnt: This alarm indicates that one of the mounted partitions is full or almost full. The alarm is triggered when only 7% of free space is remaining.

hardware: This alarm indicates the overall health of the hardware.

ipmi: This alarm indicates that the system has detected an Intelligent Platform Management (IPMI) event. This alarm is not supported on all appliance models.

license_expired: This alarm triggers if any feature has at least one license installed, but all of them are expired.

license_expiring: This alarm triggers if one or more features is going to expire within two weeks. The license expiring and license expired alarms are triggered per feature; for example, if you install two license keys for a feature, LK1-FOOxxx (expired) and LK1-FOO-yyy (not expired), the alarms do not trigger, because the feature has one valid license.

licensing: This alarm is the parent licensing alarm and triggers if any of the appliance_unlicensed alarms are active.

link_duplex: This alarm is triggered when an interface was not configured for half-duplex negotiation but has negotiated half-duplex mode. Half-duplex significantly limits the optimization service results. This alarm is enabled by default.

link_io_errors: This alarm is triggered when the link error rate exceeds 0.1% while either sending or receiving packets. This threshold is based on the observation that even a small link error rate reduces TCP throughput significantly. A properly configured LAN connection should experience very few errors. The alarm clears when the rate drops below 0.05%. This alarm is enabled by default.

link_state:aux:half_duplex: Interface aux Half-Duplex.

link_state:aux:io_errors: Interface aux Errors.

link_state:aux:link_error: Interface aux Down.

link_state:primary:half_duplex: Interface primary Half-Duplex.

link_state:primary:io_errors: Interface primary Errors.

link_state:primary:link_error: Interface primary Down.

linkstate: This alarm indicates that the system has detected a link that is down. The system notifies you through SNMP traps, email, and alarm status. By default, this alarm is not enabled. The no alarm linkstate enable command disables the link state alarm.

local_db_fail: Local Database Failure.

local_ssc_fail: Local SSC Failure.

master_password_fail: This alarm triggers when the Services Director is not running because the master password is corrupt/unavailable/waiting for user input.

paging: This alarm indicates whether the system has reached the memory paging threshold. If 100 pages are swapped approximately every two hours the appliance is functioning properly. If thousands of pages are swapped every few minutes, then reboot the system. If rebooting does not solve the problem, contact Ivanti Support.

peer_ssc_fail: Peer SSC Connectivity Failure.

secure_vault: This alarm indicates a general secure vault error.

secure_vault_unlocked: This alarm indicates whether the secure vault is unlocked. When the vault is unlocked, SSL traffic is not optimized and you cannot encrypt a data store.

ssc_ha_event: hwCluster errors.

ssl: This alarm indicates whether the system has detected an SSL error.

sticky_staging_dir: This alarm indicates that the system has detected an error while trying to create a process dump.

upgrade: This alarm indicates the status of an upgrade.

Usage Guidelines

Enabling alarms is optional.

The no command option disables all statistical alarms. The no alarm <type>enable command disables specific statistical alarms.

Examples

amnesiac # alarm hardware enable

show alarm, show alarms

alarm error-threshold

Sets a threshold to trigger an alarm.

Syntax

[no] alarm type error-threshold threshold-level

Parameters

type

See alarm enable for a complete listing and description of alarm types.

threshold-level

Specify the threshold level. The threshold level and possible values depend on the alarm type.

Usage Guidelines

The no version of the command resets the threshold to the default level.

Examples

amnesiac (config) # alarm cpu_util_indiv error-threshold 80

show alarm, show alarms

alarm rate-limit

Sets the alarm rate-limit values.

Syntax

alarm type rate-limit [email | snmp] term {long | medium | short} {count value | window duration-seconds}

Parameters

type

See alarm enable for a complete listing and description of alarm types.

email

Sets rules for email.

snmp

Sets rules for SNMP.

term

Sets the alarm event rate-limit term value. Valid choices are:

long

medium

short

count value

Sets the count value. The default values are 50 (long), 20 (medium), and 5 (short).

window duration-seconds

Sets the duration of time, in seconds, that the window remains open. The default values are 604,800 (long), 86,400 (medium), and 3600 (short).

Usage Guidelines

There are three term values--long, medium, and short. Each has a window, which is a number of seconds, and a maximum count. If, for any term value, the number of alarm events exceeds the maximum count during the window, the corresponding email/SNMP notifications are not sent.

Examples

amnesiac (config) # alarm cpu_util_indiv rate-limit email term short window 30

show alarm, show alarms

alarms reset-all

Globally sets all alarms to their default settings.

Syntax

alarms reset-all

Usage Guidelines

Use this command to reset all the alarms to their default settings.

Examples

amnesiac (config) # alarms reset-all
All alarms reset to default settings

show alarm, show alarms

arp

Creates static ARP entries in the ARP table.

Syntax

[no] arp ip-addr MAC-addr

Parameters

ip-addr

Specify the IP address of the appliance.

MAC-addr

Specify the MAC address.

Usage Guidelines

The no command option disables ARP static entries.

Examples

amnesiac (config) # arp 10.0.0.1 00:07:E9:55:10:09

show arp

authentication policy enable

Enables the authentication policy for account control.

Syntax

[no] authentication policy enable

Usage Guidelines

An authentication policy enables you to define a set of policies to enforce user login behavior and password strength. Passwords are mandatory when account control is enabled.

After you enable the authentication policy, the current passwords for all users expire. At the next login, each user is prompted to change their password, placing the new password under the account control authentication policy.

When account control is enabled and an administrator uses the username password 7 command, the password automatically expires. Because the encrypted password cannot be checked against the configured password policy, the user is prompted to change their password at login.

Examples

amnesiac (config) # authentication policy enable

show alarmusername password 7

authentication policy login max-failures

Sets the maximum number of unsuccessful login attempts before temporarily locking the user’s access to the appliance.

Syntax

[no] authentication policy login max-failures count [unlock-time seconds]

Parameters

count

Specify the maximum number of unsuccessful login attempts before a temporary account lockout.

unlock-time seconds

Specify the number of seconds the system waits before the user can log in again after an account lockout. If this optional parameter is not specified, the unlock time defaults to 300 seconds.

Usage Guidelines

The no authentication policy login max-failures command resets the maximum number of unsuccessful login attempts allowed to the default value, which is zero, indicating that the account lockout is disabled. This command takes no parameters.

Examples

amnesiac (config) # authentication policy login max-failures 3

show alarm

authentication policy password

Configures the authentication policy password settings for account control.

Syntax

[no] authentication policy password {change-days days | dictionary enable | difference count | expire days [warn] | length length | lock days | lower-case count | numeric count | repeat count | reuse-interval count | special count | upper-case count}

Parameters

change-days days

Specify the minimum number of days before which passwords cannot be changed.

dictionary enable

Prevents the use of any word found in the dictionary as a password.

difference count

Specify the minimum number of characters that must change between an old and new password. The default for the strong security template is 4.

If the authentication policy password difference <count> value is set to a value greater than zero, a non-administrator must specify the new and old passwords by entering the username password [old-password] command. Administrators are never required to enter an old password when changing an account password.

expire days

Specify the number of days the current password stays in effect. To set the password expiration to 24 hours, specify 0. To set the password expiration to 48 hours, specify 1. Specify a negative number to turn off password expiration.

length length

Specify the minimum password length. The default setting for the strong security template is 14 alphanumeric characters.

lock days

Specify the number of days before an account with an expired password locks.

lower-case count

Specify the minimum number of lowercase letters required in the password. The default for the strong security template is 1.

numeric count

Specify the minimum number of numeric characters required in the password. The default for the strong security template is 1.

repeat count

Specify the maximum number of times a character can occur consecutively.

reuse-interval count

Specify the number of password changes allowed before a password can be reused. The default for the strong security template is 5.

special count

Specify the minimum number of special characters required in the password. The default for the strong security template is 1.

upper-case count

Specify the minimum number of uppercase letters required in the password. The default for the strong security template is 1.

Usage Guidelines

Passwords are mandatory when account control is enabled. Passwords for all users expire as soon as account control is enabled. This behavior forces the user to create a new password that follows the password characteristics defined in the password policy.

Empty passwords are not allowed when account control is enabled.

Examples

amnesiac (config) # authentication policy password expire 60 warn 3

authentication policy template, username password, username password 7, show alarm

authentication policy template

Specify the authentication policy template for password policy configuration.

Syntax

authentication policy template {strong | basic}

Parameters

strong

Specifies the strong security policy template.

basic

Specifies the basic security policy template.

Usage Guidelines

The authentication policy template strong command sets the password policy to more stringent enforcement settings. Selecting this template automatically pre-populates the password policy with stricter settings commonly required by higher security standards, such as for the Department of Defense.

To remove the strong security template and return to the basic password policy, use the authentication policy template basic command.

When account control is enabled for the first time, the password policy is set to the basic template.

Examples

amnesiac (config) # authentication policy template strong

amnesiac # show authentication policy
Authentication policy enabled: yes
Maximum unsuccessful logins before account lockout: 3
Wait before account unlock: 300 Seconds
Minimum password length: 14
Minimum upper case characters in password: 1
Minimum lower case characters in password: 1
Minimum numerical characters in password: 1
Minimum special characters in password: 1
Minimum interval for password reuse: 5
Minimum characters diff for password change: 4
Prevent dictionary words in password: yes
User passwords expire: 60 days
Warn user of an expiring password: 7 days before
User accounts with expired passwords lock: 305 days

amnesiac (config) # authentication policy template basic
amnesiac # show authentication policy
Authentication policy enabled: yes
Maximum unsuccessful logins before account lockout: none
Wait before account unlock: 300 Seconds
Minimum password length: 6
Minimum upper case characters in password: 0
Minimum lower case characters in password: 0
Minimum numerical characters in password: 0
Minimum special characters in password: 0
Minimum interval for password reuse: 0
Minimum characters diff for password change: 0
Prevent dictionary words in password: yes
User passwords expire: never
Warn user of an expiring password: 7 days before
User accounts with expired passwords lock: never

show alarm

authentication policy user lock never

Configures the user account lock settings for account control management.

Syntax

[no] authentication policy user username lock never

Parameters

username

Specify the user login: admin, monitor, or shark.

Usage Guidelines

The authentication policy user lock never command prevents the user’s account from being locked after the password expires. This command is available only when account control is enabled.

The no authentication policy user lock never command allows the user account to be locked after the password expires.

Examples

amnesiac (config) # authentication policy user admin lock never

show alarm

authentication policy user login-failures reset

Resets a user account so the user can log in again.

Syntax

[no] authentication policy user username login-failures reset

Parameters

username

Specify the user login: admin, monitor, or shark.

Usage Guidelines

If a user account is locked because of a failed login count exceeding the configured value, the authentication policy user login-failures reset command resets the account so the user can log in again. This command resets the login count to zero, which is the default value.

Examples

amnesiac (config) # authentication policy user admin login-failures reset
Login failures cleared for user admin

show alarm

banner login

Creates the system log in banner.

Syntax

[no] banner login message-string

Parameters

message-string

Specify the login banner message. Enclose the message in quotation marks.

Usage Guidelines

The no command option disables the login banner.

Examples

amnesiac (config) # banner login "reminder: meeting today"

show bootvar

banner motd

Creates the system Message of the Day banner.

Syntax

[no] banner motd message-string

Parameters

message-string

Specify the login Message of the Day. Enclose the message in quotation marks.

Usage Guidelines

The no command option disables the system Message of the Day banner.

Examples

amnesiac (config) # banner motd "customer visit today"

show bootvar

boot bootloader password

Sets the password for the bootloader.

Syntax

boot bootloader password { password | 0 password | 7 password }

Parameters

password

Specify a bootloader password in clear text. The password must be at least 6 characters. This option functions the same as the 0 <password> parameter and is provided for backward compatibility.

0 password

Specify a bootloader password in clear text.

7 password

Specify a bootloader password with an encrypted string. The encrypted string is the hash of the clear text password and is 35 bytes long. The first 3 bytes indicate the hash algorithm and the next 32 bytes are the hash values.

Examples

amnesiac (config) # boot bootloader password 0 182roy
amnesiac (config) # boot bootloader password 7 $1$qyP/PKii$2v9FOFcXB5a3emuvLKO3M

show images

boot system

Boots the specified partition the next time the system is rebooted.

Syntax

boot system partition

Parameters

partition

Specify the partition to boot: 1 or 2

Examples

amnesiac (config) # boot system 1

show images

cli clear-history

Clears the command history for the current user.

Syntax

cli clear-history

Examples

amnesiac (config) # cli clear-history

show cli

cli default auto-logout

Sets the keyboard inactivity time for automatic log out.

Syntax

[no] cli default auto-logout minutes

Parameters

minutes

Specify the number of minutes before log out occurs.

Usage Guidelines

To disable timeout:

cli default auto-logout 0

The no command option disables the automatic logout feature.

Examples

amnesiac (config) # cli default auto-logout 25

show cli

cli default paging enable

Sets the ability to view text one screen at a time.

Syntax

[no] cli default paging enable

Usage Guidelines

The no command option disables paging.

Examples

amnesiac (config) # cli default paging enable

show cli

cli session

Sets CLI options for the current session only.

Syntax

[no] cli session {auto-logout minutes | paging enable | terminal length lines | terminal type terminal_type | terminal width number-of-characters}

Parameters

auto-logout minutes

Sets the number of minutes before the CLI automatically logs out the user. The default value is 15 minutes. The no command option disables the automatic logout feature.

paging enable

Sets paging. With paging enabled, if there is too much text to fit on the page, the CLI prompts you for the next page of text. The no command option disables paging.

terminal length lines

Sets the terminal length. The no command option disables the terminal length.

terminal type terminal_type

Sets the terminal type. The no command option disables the terminal type.

terminal width number-of-characters

Sets the terminal width. The no command option disables the terminal width.

Usage Guidelines

The no command option disables CLI option settings.

Examples

amnesiac (config) # cli session auto-logout 20

show cli

clock timezone

Sets the current time zone.

Syntax

clock timezone zone

Parameters

zone

Specify the time zone name: Africa, America, Antarctica, Arctic, Asia, Atlantic_Ocean, Australia, Europe, GMT-offset, Indian_Ocean, Pacific_Ocean, UTC.

Usage Guidelines

The default value is GMT-offset.

Examples

amnesiac (config) # clock timezone Africa

show clock

configuration copy

Copies a configuration file.

Syntax

configuration copy sourcename new-filename

Parameters

sourcename

Specify the name of the source file.

new-filename

Specify the name of the destination file.

Examples

amnesiac (config) # configuration copy westcoast eastcoast

show info

configuration delete

Deletes a configuration file.

Syntax

configuration delete filename

Parameters

filename

Specify the name of the configuration file to delete.

Examples

amnesiac (config) # configuration delete westcoast

show info

configuration factory

Creates a new configuration file.

Syntax

configuration factory filename

Parameters

filename

Specify the name of the destination file.

Examples

amnesiac (config) # configuration factory eastcoast

show info

configuration fetch

Downloads a configuration file over the network.

Syntax

configuration fetch URL,-scp://, or -ftp://username:password@hostname/path/filename | filename

Parameters

URL,-scp://, or -ftp://username:password@hostname/path/filename

Specify the location of the configuration file to download in URL, scp://, or ftp:// format.

filename

Create a new name for the configuration file.

Usage Guidelines

To copy one configuration file to another appliance:

Fetch the configuration time from the remote:

configuration fetch <url-to-remote-config> <new-config-name>

Activate the newly-fetched configuration

configuration switch-to <new-config-name>

Examples

amnesiac (config) # configuration fetch http://domain.com/westcoast newconfig
amnesiac (config) # configuration switch-to newconfig

show info

configuration jump-start

Restarts a simple configuration wizard.

Syntax

configuration jump-start

Usage Guidelines

The configuration wizard lets you set five basic configuration parameters with a single command. Press Enter to accept the value displayed or enter a new value.

For a Services Director on the AWS platform, you can only set the hostname using the wizard.

Examples

*** Services Director on VMware and KVM ***
amnesiac (config) # configuration jump-start
Services Director configuration wizard.

Step 1: Hostname? [host-1234]
Step 2: Use DHCP on primary interface? [no]
Step 3: Primary IP address? [10.62.165.135]
Step 4: Netmask? [255.255.192.0]
Step 5: Default gateway? [10.62.128.1]

You have entered the following information:
1. Hostname: host-1234
2. Use DHCP on primary interface: no
3. Primary IP address: 10.62.165.135
4. Netmask: 255.255.192.0
5. Default gateway: 10.62.128.1

To change an answer, enter the step number to return to.
Otherwise hit <enter> to save changes and exit.
To continue setup, navigate your web browser to the address configured above
*** Services Director on AWS ***
amnesiac (config) # configuration jump-start
Services Director configuration wizard.

Step 1: Hostname? [host-5678]

You have entered the following information:
1. Hostname: host-5678

To change an answer, enter the step number to return to.
Otherwise hit <enter> to save changes and exit.
To continue setup, navigate your web browser to the address configured above

show info

configuration merge

Merges common configuration settings from one system to another.

Syntax

configuration merge filename new-config-name

Parameters

filename

Name of file from which to merge settings.

new-config-name

Specify the new configuration name.

Usage Guidelines

Use the configuration merge command to deploy a network of appliances. Set up a template for your appliance and merge the template with each appliance in the network.

The following configuration settings are not merged when you run the configuration merge command: failover settings, SNMP SysContact and SysLocation, alarm settings, CLI settings, and all network settings (for example, hostname, auxiliary interface, DNS settings, defined hosts, static routing, and in-path routing).

The following configuration settings are merged when you run the configuration merge command: in-path, out-of-path, log settings, protocols, statistics, email, NTP and time, Web, and SNMP.

To merge a configuration file, run the following set of commands:

configuration write to <new-config-name>
;; this saves the current config to the new name and activates
;; the new configuration
configuration fetch <url-to-remote-config> <temp-config-name>
;; this fetches the configuration from the remote
configuration merge <temp-config-name>
;; this merges the fetched config into the active configuration
;; which is the newly named/created one in step 1 above
configuration delete <temp-config-name>
;; this deletes the fetched configuration as it is no longer
;; needed since you merged it into the active configuration

Examples

amnesiac (config) # configuration merge tempconfig

show info

configuration move

Moves and renames a configuration file.

Syntax

configuration move sourcename destname

Parameters

sourcename

Specify the name of the source configuration file.

destname

Specify the name of the new configuration file.

Examples

amnesiac (config) # configuration move westcoast eastcoast

show info

configuration new

Creates a new, blank configuration file.

Syntax

configuration new new-filename | [keep licenses]

Parameters

new-filename

Specify the name of the new configuration file.

keep licenses

Creates a new configuration file with default settings and active licenses.

Usage Guidelines

Ivanti recommends that you use the keep licenses command option. If you do not keep licenses, your new configuration will not have a valid license key.

Examples

amnesiac (config) # configuration new westcoast keep licenses

show info

configuration revert keep-local

Reverts to the initial configuration but maintains some appliance-specific settings.

Syntax

configuration revert keep-local

Examples

amnesiac (config) # configuration revert keep-local

show info

configuration revert saved

Reverts the active configuration to the last saved configuration.

Syntax

configuration revert saved

Examples

amnesiac (config) # configuration revert saved

show info

configuration switch-to

Loads a new configuration file and makes it the active configuration.

Syntax

configuration switch-to filename

Parameters

filename

Specify the filename. The default filenames are:

initial: Specify the initial configuration.

initial.bak: Specify the initial backup configuration.

cold: Specify the configuration file before SDR has occurred.

working: Specify the current configuration.

Examples

amnesiac (config) # configuration switch-to westcoast

show info

configuration upload

Uploads the configuration file.

Syntax

configuration upload filename http,-ftp,-or-scp-URL-(e.g.-scp://username:password@host/path) | [active]

Parameters

filename

Specify the configuration filename.

http,-ftp,-or-scp-URL-(e.g.-scp://username:password@host/path)

Specify the HTTP, FTP, or scp URL.

active

Sets the uploaded file to the active configuration file.

Examples

amnesiac (config) # configuration upload initial scp://test:MyPassword@example/tmp/

show info

configuration write

Writes the current, active configuration file to memory.

Syntax

configuration write [to filename]

Parameters

to filename

Save the running configuration to a file.

Examples

amnesiac (config) # configuration write

show info

debug generate dump

Generates a report you can use to diagnose misconfiguration in deployments.

Syntax

debug generate dump [full | brief | rsp | stats | all-logs | blockstore | blockstore-fifo] [upload url] ]

Parameters

full

Generate a full system dump.

brief

Generates a brief system dump.

rsp

Generate a full system dump, including VMware Server data.

stats

Generates a full system dump including .dat files.

all-logs

Generate a full system dump with .dat files and all logs.

blockstore

Generate a full system dump with .dat files, all logs, and blockstore phash.

blockstore-fifo

Generate a full system dump with .dat files, all logs, blockstore phash, and fifo.

upload url

Generate a full system dump upload to the specified URL.

Usage Guidelines

If the upload URL points to a directory on the upload server, you must specify the trailing slash "/". For example, "ftp://ftp.xxxxxxxx.com/incoming/" rather than "ftp://ftp.xxxxxxxx.com/incoming". The file name as it exists on the appliance is renamed to the file name specified in the URL.

After the dump generation, the upload is done in the background so you can exit the command-line interface without interrupting the upload process.

Examples

amnesiac (config) # debug generate dump brief
amnesiac (config) # debug generate dump upload ftp://ftp.xxxxxxxxx.com/incoming/

email autosupport enable

Enables automatic email notification of significant alarms and events to Ivanti Support.

Syntax

[no] email autosupport enable

Usage Guidelines

The no command option disables automatic email notification.

Examples

amnesiac (config) # email autosupport enable

show email

email domain

Sets the domain for email notifications.

Syntax

[no] email domain hostname-or-ip-addr

Parameters

hostname-or-ip-addr

Specify the domain for email notifications (only if the email address does not contain it).

Usage Guidelines

Use the email domain command only if the email address does not contain the domain.

The no command option disables the email domain.

Examples

amnesiac (config) # email domain example.com

show email

email from-address

Sets the address from which email messages appear to come.

Syntax

[no] email from-address email-addr

Parameters

email-addr

Specify the full user name and domain to appear in the email "From:" address.

Usage Guidelines

Use the email from-address command to override the default email address used in outgoing email messages, do-not-reply@[hostname].[domainname].

The no command option disables the email address configured and returns to the default email address.

Examples

amnesiac (config) # email from-address [email protected]

show email

email mailhub

Sets the SMTP server for email notifications.

Syntax

[no] email mailhub hostname-or-ip-addr

Parameters

hostname-or-ip-addr

Specify the SMTP server for email notifications.

Usage Guidelines

The no command option disables the SMTP server.

Examples

amnesiac (config) # email mailhub mail-server.example.com

show email

email mailhub-port

Sets the email port for email notifications.

Syntax

[no] email mailhub-port port

Parameters

port

Specify the email port for email notifications.

Usage Guidelines

The no command option disables the email port.

Examples

amnesiac (config) # email mailhub-port 135

show email

email notify events enable

Enables email notification for events.

Syntax

[no] email notify events enable

Usage Guidelines

The no command option disables email notification.

Examples

amnesiac (config) # email notify events enable

show email

email notify events recipient

Sets the email address for notification of events.

Syntax

[no] email notify events recipient email-addr

Parameters

email-addr

Specify the email address of the user to receive notification of events.

Usage Guidelines

The no command option disables email address for notification.

Examples

amnesiac (config) # email notify events recipient [email protected]
amnesiac (config) # email notify events recipient [email protected]

show info

email notify failures enable

Enables email notification of system failures, such as core dumps.

Syntax

[no] email notify failures enable

Usage Guidelines

The no command option disables email notification.

Examples

amnesiac (config) # email notify failures enable

show email

email notify failures recipient

Enables email notification of system failures, such as core dumps.

Syntax

[no] email notify failures recipient email-addr

Parameters

recipient email-addr

Specify the email address of the user to receive notification of failures.

Usage Guidelines

The no command option disables email notification.

You must enter separate commands for each email address. Each command line accepts only one email address.

Examples

amnesiac (config) # email notify failures recipient [email protected]

show email

email send-test

Sends a test email to all configured event and failure recipients.

Syntax

email send-test

Usage Guidelines

You can also access this command from enable mode.

Examples

amnesiac (config) # email send-test

show email

events max-age

Sets the maximum age for keeping history events.

Syntax

events max-age period

Parameters

period

Specify the time period to keep events:

minute: Specifies one minute.

hour: Specifies one hour.

day: Specifies one day.

week: Specifies one week.

month: Specifies one month.

year: Specifies one year.

decade: Specifies ten years.

Examples

amnesiac (config) # events max-age month

show files events config

events reset

Resets the history daemon and drop-event history tables.

Syntax

events reset

Examples

amnesiac (config) # events reset

show files events config

file debug-dump delete

Deletes the specified debug dump file.

Syntax

file debug-dump delete filename

Parameters

filename

Specify the filename.

Examples

amnesiac (config) # file debug-dump delete mydumpfile.txt

show files events config

file debug-dump email

Sends a debug dump file in email to pre-configured recipients.

Syntax

file debug-dump email filename

Parameters

filename

Specify the filename.

Examples

amnesiac (config) # file debug-dump email mydumpfile.txt

show files events config

file debug-dump upload

Uploads the specified debug dump file.

Syntax

file debug-dump upload filename {ftp,-or-scp://username:password@host/path}

Parameters

filename

Specify the filename.

ftp, or scp URL (e.g.scp://username:password@host/path)

Specify the FTP or scp URL.

Examples

amnesiac (config) # file debug-dump upload mydebug.txt
scp://me:[email protected]/mypath

show files events config

file process-dump delete

Deletes the specified crash dump file.

Syntax

file process-dump delete filename

Parameters

filename

Specify the filename.

Examples

amnesiac (config) # file process-dump delete mycrash.txt

show files events config

file process-dump upload

Uploads the specified crash dump file.

Syntax

file process-dump upload filename {https,-http,-ftp,-or-scp-URL:-scp://username:password@hostname/path/filename | case-number}

Parameters

filename

Specify the filename.

https,-http,-ftp, or -scp URL: scp://username:password@hostname/path/filename

Specify the URL.

case-number

Specify the customer case number. The case number is a convenient and intuitive method to upload a crash dump file to Ivanti Technical Support without using a URL. Ivanti Technical Support recommends using a case number. The case number is a numeric string.

Examples

amnesiac (config) # file process-dump
upload mycrash.txt scp://mylogin:mypassword@myhostname/path/filename
amnesiac (config) # file process-dump upload mycrash.txt 194170

show files events config

fips enable

Enables FIPS mode.

Syntax

[no] fips enable

Usage Guidelines

FIPS is a publicly announced set of validation standards developed by the United States National Institute of Standards and Technology (NIST) for use by government agencies and by government contractors.

FIPS 140-3 is a technical and worldwide standard for the implementation of cryptographic modules. FIPS validation makes the appliance more suitable for use with government agencies that have formal policies requiring use of FIPS 140-3 validated cryptographic software.

Ivanti Services Director uses FIPS-capable OpenSSL cryptographic libraries and ensures that cryptographic operations use FIPS-approved providers and algorithms when FIPS mode is enabled. A valid FIPS license must be installed before enabling FIPS mode.Examples

amnesiac (config) # fips enable
amnesiac (config) # write memory
amnesiac (config) # reload

show fips status

hardware watchdog enable

Enables the hardware watchdog, which monitors the system for hardware errors.

Syntax

[no] hardware watchdog enable

Examples

amnesiac (config) # hardware watchdog enable

show hardware error-log

hardware watchdog shutdown

Shuts down the hardware watchdog.

Syntax

hardware watchdog shutdown

Examples

amnesiac (config) # hardware watchdog shutdown

show hardware error-log

host-label

Configures host label settings.

Syntax

[no] host-label name {hostname hostname [subnet X.X.X.X/XX] | subnet X.X.X.X/XX [hostname hostname]}

Parameters

name

Specify the name of the host label.

Host labels are case sensitive and can be any string consisting of letters, the underscore ( _ ), or the hyphen ( - ). There cannot be spaces in host labels. There is no limit on the number of host labels you can configure.

To avoid confusion, do not use a number for a host label.

Host labels that are used in QoS rules cannot be deleted.

Host label changes (that is, adding and removing hostnames inside a label) are applied immediately by the rules that use the host labels that you have modified.

hostname hostname,-.-.-.

Specify a hostname or a comma-separated list of hostnames.

Hostnames are case insensitive.

You can configure a maximum of 100 unique hostnames across all host labels.

A maximum of 64 subnets and hostnames per host label is allowed.

subnet X.X.X.X/XX,. . .

Specify an IPv4 subnet for the specified host label or a comma-separated list of IPv4 subnets. Use the format X.X.X.X/XX.

Usage Guidelines

Host labels are names given to lists of hosts (IP addresses, IP subnets, and hostnames) that you can specify to match the source and destination network when configuring QoS rules. For example, you can specify host labels to define a set of hosts for which QoS classification and QoS marking rules apply. You can configure a mixture of subnets and hostnames for each label. A maximum of 64 subnets and hostnames per host label is allowed. You can configure a maximum of 100 unique hostnames across all host labels.

Hostnames referenced in a host label are automatically resolved through a DNS. The system resolves them immediately after you add a new host label or after you edit an existing host label. The system also automatically re-resolves hostnames daily. If you want to resolve a hostname immediately, use the resolve host-labels command.

Examples

amnesiac (config) # host-label test hostname xxxxxxxx.com,example.com subnet 192.168.0.1/32, 192.168.0.2/32,10.0.0.0/8
amnesiac (config) # qos basic classification global-app add global-app-name MyGlobalApp class-name Realtime vlan 1 traffic all srcport 123 srcnet test

show images, show host-label

hostname

Sets the hostname for this system.

Syntax

[no] hostname hostname

Parameters

hostname

Specify the hostname. Do not include the domain name.

Usage Guidelines

You cannot change the IP address of a Services Director when:

the Services Director VA is running the Setup Wizard.

the Services Director is already part of an HA pair.

The no command option removes the hostname for this appliance.

Examples

amnesiac (config) # hostname park

show hosts

image boot

Boots the specified system image by default.

Syntax

image boot partition

Parameters

partition

Specify the partition to boot: 1 or 2.

Examples

amnesiac (config) # image boot 1

show version

interface

Configures system interfaces.

Syntax

[no] interface interfacename options

Parameters

interfacename

Specify the interface name: lo, aux, lan0_0, wan0_0, primary, in-path0_0. The interface name varies according to the Ivanti product your are configuring. For example: primary, aux. For details, see the CLI online help.

options

Each interface has the following configuration options:

arp: Adds static entries to the ARP cache - Configure the string of this interface.

dhcp renew: Enables DHCP on the interface or renews DHCP. Setting DHCP on the auxiliary interface only provides an IP lease, and does not update the gateway, routes, and DNS settings.

dhcp dynamicdns: Enables DHCP hostname registration with dynamic DNS.

duplex speed: Specify the duplex speed: auto, full, half. The default value is auto.

ip address ipaddr netmask: Specify the IP address and netmask for the interface.

ipv6 address ipv6addr prefix-length: Specify the IPv6 address and prefix length for the interface. Your appliance can have both an IPv4 address and an IPv6 address. You can only configure one IPv6 address per in-path interface. For example: amnesiac (config) # interface primary ipv6 address 2001:38dc:52::e9a4:c5:6282 64

mtu speed: Specify the MTU. The MTU is set on the in-path interface; it propagates automatically to the LAN and the WAN. The no command option disables the MTU setting. The default value is 1500.

shutdown: Shuts down the interface.

speed speed: Specify the speed for the interface: auto, 10, 100, 1000. The default value is 100.

Usage Guidelines

You cannot change the IP address of a Services Director when:

the Services Director VA is running the Setup Wizard.

the Services Director is already part of an HA pair.

The no command option disables the interface settings.

Examples

amnesiac (config) # no interface inpath0_0 fail-to-bypass enable

show interfaces

ip default-gateway

Sets the default gateway for the appliance.

Syntax

[no] ip default-gateway ip-addr

Parameters

ip-addr

Specify the IP address of the management interface.

Usage Guidelines

This command is used to set the default gateway for the entire appliance. It is primarily used for the primary or auxiliary (aux) interfaces for management, but can also be used for out-of-path optimization configurations as well as PFS.

The no command option disables the default gateway IP address.

Examples

amnesiac (config) # ip default-gateway 10.0.0.12

show interfaces, ipv6 default-gateway

ip domain-list

Adds a domain name to the domain list for resolving hostnames.

Syntax

[no] ip domain list domain

Parameters

domain

Specify the domain name.

Usage Guidelines

The no command option removes a domain from the domain list.

Examples

amnesiac (config) # ip domain-list example.com

show hosts

ip host

Adds an entry to the static host table.

Syntax

[no] ip host hostname ip-addr

Parameters

hostname

Specify the hostname.

ip-addr

Specify the IP address.

Usage Guidelines

The no command option removes an entry from the static host table.

Examples

amnesiac (config) # ip host park 10.10.10.1

show hosts

ipv6 default-gateway

Configures a default IPv6 route.

Syntax

[no] ipv6 default-gateway ipv6-address

Parameters

ipv6-address

Specify the IPv6 address.

Usage Guidelines

Support for IPv6 is enabled by default. The no command option removes the default gateway for IPv6 routing.

Examples

amnesiac (config) # ipv6 default-gateway 2001:38dc:52::e9a4:c5:6282

show email, ipv6 route

ipv6 in-path-gateway

Configures an in-path IPv6 default gateway.

Syntax

[no] ipv6 in-path-gateway interface ipv6-address

Parameters

interface

Specify the interface.

ipv6-address

Specify the IPv6 address of the in-path gateway.

Usage Guidelines

Support for IPv6 is enabled by default. The no command option deletes the in-path default gateway for IPv6 routing.

Examples

amnesiac (config) # ipv6 in-path-gateway inpath0_0 2001:38dc:52::e9a4:c5:6282

ipv6 route, ipv6 default-gateway

ipv6 route

Adds IPv6 routes in addition to the default gateway, if needed.

Syntax

[no] ipv6 route IPv6-destination prefix-length gateway

Parameters

IPv6-destination

Specify the IPv6 address.

prefix-length

Specify the IPv6 prefix length.

gateway

Specify the IPv6 address of the gateway.

Usage Guidelines

Support for IPv6 is enabled by default. The no command option removes the specified IPv6 route.

Examples

amnesiac (config) # ipv6 route 2001:38dc:52::e9a4:c5:6282 64 2001:38dc:52::1

show email, ipv6 default-gateway

ip name-server

Adds a DNS name server.

Syntax

[no] ip name-server ip-addr

Parameters

ip-addr

Specify the name server IP address.

Usage Guidelines

The no command option removes a DNS name server.

Examples

amnesiac (config) # ip name-server 10.10.10.1

show hosts

ip route

Adds a static route.

Syntax

[no] ip route network-prefix netmask netmask-length next-hop-ip-addr

Parameters

network-prefix

Specify the network prefix.

netmask

Specify the netmask. For example: 255.255.255.0

netmask-length

Specify the netmask length. For example: /24

next-hop-ip-addr

Specify the next hop IP address.

Usage Guidelines

The no command option disables the static route. If no ip route is run with only a network prefix and mask, it deletes all routes for that prefix.

Examples

amnesiac (config) # ip route 192 193.166.0/24 10.10.10.1

show logging

job command

Schedules CLI command execution for a specified time in the future.

Syntax

[no] job job-id command sequence-# "cli-command"

Parameters

job-id

Specify the job identification number.

sequence-#

Specify the sequence number for job execution. The sequence number is an integer that controls the order in which a CLI command is executed. CLI commands are executed from the smallest to the largest sequence number.

"cli-command"

Specify the CLI command. Enclose the command in double-quotes.

Usage Guidelines

A job includes a set of CLI commands and a time when the job runs. Jobs are run one time only, but they can be reused.

Any number of CLI commands can be specified with a job and are executed in an order specified by sequence numbers. If a CLI command in the sequence fails, no further commands in the job are executed. A job can have an empty set of CLI commands.

The output of all commands executed are viewable after job execution by running the show job <job-id> command. The output of each job is only available for the last run; it is re-written upon each execution.

The job output and any error messages are saved. Jobs can be canceled and rescheduled.

The no job <job-id> command <sequence #> command option deletes the CLI command from the job.

The no job <job-id> command option removes all statistics associated with the specified job. If the job has not executed, the timer event is canceled. If the job was executed, the results are deleted along with the job statistics.

Examples

amnesiac (config) # job 10 command 1 "show info"
amnesiac (config) # job 10 command 2 "show connections"
amnesiac (config) # job 10 command 3 "show version"

show job, show jobs

job comment

Adds a comment to the job for display when show jobs is run.

Syntax

[no] job job-id comment "<comment>"

Parameters

job-id

Specify the job identification number.

comment "<comment>"

Specify the comment for the job. Enclose the description in double-quotes.

Usage Guidelines

The no command option deletes the comment.

Examples

amnesiac (config) # job 10 "comment this is a test"

show job, show jobs

job date-time

Sets the date and time for the job to execute.

Syntax

[no] job job-id date-time hh: mm: ss | yyyy/ mm/ dd

Parameters

job-id

Specify the job identification number.

hh: mm: ss

Specify the time for the job to execute.

yyyy/ mm/ dd

Specify the date for the job to execute.

Usage Guidelines

If the time specified is in the past, the job does not execute and is in the inactive state.

The no command option disables the date and time settings.

Examples

amnesiac (config) # job 10 date-time 04:30:23

show job, show jobs

job enable

Enables a CLI command job to execute at the date and time specified in the job.

Syntax

[no] job job-id enable

Parameters

job-id

Specify the job identification number.

Usage Guidelines

The no command option disables jobs.

Examples

amnesiac (config) # job 10 enable

show job, show jobs

job execute

Forces an immediate execution of a job. The timer (if set) is canceled, and the job is moved to the completed state.

Syntax

job job-id execute

Parameters

job-id

Specify the job identification number.

Usage Guidelines

You can also access this command from enable mode.

Examples

amnesiac (config) # job 10 execute

show job, show jobs

job fail-continue

Executes all commands in a job even if a command in the sequence fails.

Syntax

[no] job job-id fail-continue

Parameters

job-id

Specify the job identification number.

Usage Guidelines

The no command option disables this command.

Examples

amnesiac (config) # job 10 fail-continue

show job, show jobs

job name

Sets the name for the job.

Syntax

[no] job job-id name friendly-name

Parameters

job-id

Specify the job identification number.

friendly-name

Specify a name for the job.

Usage Guidelines

The no command option deletes the job name.

Examples

amnesiac (config) # job 10 name myjob

show job, show jobs

job recurring

Sets the frequency with which to recurrently execute this job.

Syntax

[no] job job-id recurring seconds

Parameters

job-id

Specify the job identification number.

seconds

Specify how frequently the recurring job should execute.

Examples

amnesiac (config) # job 10 recurring 36000

show job, show jobs

license client fetch

Forces the license client to update immediately.

Syntax

license client fetch

Usage Guidelines

If there is a change in your account (such as if Ivanti has given you an extra license), and the change will be updated whenever the license client runs next, but you want to force it to run immediately, then you can use the license client fetch command.

Examples

amnesiac # license client fetch

license client init

Initializes the license client.

Syntax

license client init license-number

Parameters

license-number

Specify the license number.

Usage Guidelines

The license client communicates with the license server. It has two main functions:

It periodically contacts the license server and checks out and renews the license or lease.

It enables you to query available features, licenses and other metadata such as serial number.

You can configure the license client to communicate with the license server at the company headquarters or the local license server.

The no command option deletes the one-time token or license.

Examples

amnesiac (config) # license client init 4

show licenses

license delete

Deletes the specified license key.

Syntax

license delete license-number

Parameters

license-number

Specify the license number.

Examples

amnesiac (config) # license delete 4

show licenses

license install

Installs a new software license key.

Syntax

[no] license install license-key

Parameters

license-key

Specify the license key.

Usage Guidelines

The no command option disables this command.

Examples

amnesiac (config) # license install SH10_B-0000-1-7F14-FC1F

show licenses

license server

Adds a license server.

Syntax

[no] license server hostname [port number] [priority number]

Parameters

hostname

Specify the hostname of the computer that contains the license server.

port number

Optionally, specify the port number on which the license server is listening. The default is port 80.

priority number

Specify the order in which the license server is added. 0 is the highest priority and 9 is the lowest priority. The default priority is 9.

Usage Guidelines

The license server provides licenses to Services Director.

The no command option deletes the license server specified.

The default license server is the server hosted at Ivanti headquarters.

The no license server <hostname> priority command resets the priority in which the specified license server is added to the default value (9 is the lowest priority).

The no license server <hostname> port command resets the license server port to the default port.

Examples

*** create license server, no feedback ***
amnesiac (config) # license server MyLicenseServer port 88 priority 1
*** list license servers to confirm creation***
amnesiac (config) # show license-servers
Server Name Port Priority
--------------- --------------- ---------------
MyLicenseServer 88 1

show licenses

logging

Adds a remote system log (syslog) server to the system.

Syntax

[no] logging ip-addr | [trap log-level]

Parameters

ip-addr

Specify the IP address for the syslog server.

trap log-level

Specify the trap log level of the syslog server:

emerg: Emergency, the system is unusable.

alert: Action must be taken immediately.

critical: Critical conditions.

err: Error conditions.

warning: Warning conditions.

notice: Normal but significant conditions, such as a configuration change. This is the default setting.

info: Informational messages.

Usage Guidelines

If you have set different log levels for each remote syslog server, this option changes all remote syslog servers to have a single log level.

The no command option removes a remote syslog server from the system.

Examples

amnesiac (config) # logging 10.0.0.2

show logging

logging files delete

Deletes the oldest log file or a specified number of the oldest log files.

Syntax

logging files delete oldest number

Parameters

oldest number

Specify the number of old log files to delete. The range is 1-10.

Usage Guidelines

You can also access this command from enable mode.

Examples

amnesiac (config) # logging files delete oldest 10

show logging

logging files rotation criteria frequency

Sets the frequency of log rotation.

Syntax

logging files rotation criteria frequency rotation-frequency

Parameters

rotation-frequency

Specify how often log rotation occurs: monthly, weekly or daily. The size of the log file is checked every 10 minutes.

Usage Guidelines

The size of the log file is checked every 10 minutes. If there is an unusually large amount of logging activity, it is possible for a log file to grow larger than the set limit in that period of time.

Examples

amnesiac (config) # logging files rotation criteria frequency weekly

show logging

logging files rotation criteria size

Sets the size, in MB, of the log file before rotation occurs.

Syntax

logging files rotation criteria size size

Parameters

size

Specify the size of the log file to save in MB. The default value is 0 (unlimited).

Usage Guidelines

Examples

amnesiac (config) # logging files rotation criteria size 100

show logging

logging files rotation force

Rotates logs immediately.

Syntax

logging files rotation force

Usage Guidelines

Examples

amnesiac (config) # logging files rotation force

show logging

logging files rotation max-num

Sets the maximum number of log files to keep locally.

Syntax

logging files rotation max-num number

Parameters

number

Specify the number of log files to keep locally. The range is 1-100. The default value is 10.

Usage Guidelines

Examples

amnesiac (config) # logging files rotation max-num 10

show logging

logging filter

Sets the minimal level of messages arriving from the specified process to the local subsystem.

Syntax

logging filter process level

Parameters

process

Specify the application process:

alarmd: Alarm control and management.

cli: Command-Line Interface.

mgmtd: Device control and management, which directs the entire device management system. It handles message passing between various management daemons, managing system configuration and general application of system configuration on the hardware underneath through the hald.

hald: Hardware Abstraction Daemon, which handles access to the hardware.

pm: Process Manager, which handles launching of internal system daemons and keeps them up and running.

sched: Process Scheduler, which handles one-time scheduled events.

rscored: REST Core Services.

rstild: REST Translation Interface.

ssc: Stingray Services Director.

statsd: Statistics Collector, which handles queries and storage of system statistics.

wdt: Watchdog Timer, the motherboard watchdog daemon.

webasd: Web Application Process, which handles the Web user interface.

level

Specify the trap log level:

emerg: Emergency, the system is unusable.

alert: Action must be taken immediately.

critical: Critical conditions.

err: Error conditions.

warning: Warning conditions.

notice: (Default) Normal but significant conditions, such as a configuration change.

info: Informational messages.

If you have set different log levels for each remote syslog server, this option changes all remote syslog servers to have a single log level.

Usage Guidelines

Use this command to capture data when a appliance is not able to sustain the flow of logging data that is being committed to disk.

This command overrides the logging local command. This command creates a global setting that controls all output, including remote hosts.

All CIFS protocol related messages are logged at level debug, and the remainder at the level notice.

All remote logging hosts (if defined) also log at logging trap setting and at the logging filter process.

The no logging filter all command deletes all filters.

Examples

amnesiac (config) # logging filter cli alert

show logging

logging local

Sets the minimum severity of log messages saved on the local syslog servers.

Syntax

[no] logging local log-level

Parameters

log-level

Specify the logging severity level. The follow severity levels are supported:

emerg: Emergency, the system is unusable.

alert: Action must be taken immediately.

crit: Critical conditions.

err: Error conditions.

warning: Warning conditions.

notice: (Default) Normal but significant conditions, such as a configuration change.

info: Informational messages.

The default value is notice.

Usage Guidelines

The no command option sets the severity level for logging to none (no logs are sent).

Examples

amnesiac (config) # logging local notice

show logging

logging trap

Sets the minimum severity for messages sent to the remote syslog servers.

Syntax

[no] logging trap log-level

Parameters

log-level

Specify the logging severity level. The follow severity levels are supported:

emerg: Emergency, the system is unusable.

alert: Action must be taken immediately.

crit: Critical conditions.

err: Error conditions.

warning: Warning conditions.

notice: (Default) Normal but significant conditions, such as a configuration change.

info: Informational messages.

Usage Guidelines

The no command option sets the severity level for logging to none.

Examples

amnesiac (config) # logging trap notice

show logging

ntp authentication

Configures the Network Time Protocol (NTP) authentication settings to authenticate NTP servers and peers.

Syntax

[no] ntp authentication key key-id secret {plaintext | 0 plaintext | 7 encrypted-string}

Parameters

key key-id

Specify the key identifier. The key ID values must be in the range 1 - 65534.

secret {plaintext | 0 plaintext | 7 encrypted-string}

Specify the shared secret parameter. Choose one of the following:

plaintext: Specify a shared secret in plain text. This option is the same as the 0 <plaintext> option and is provided for backward compatibility.

0 plaintext: Specify a shared secret in plain text.

7 encryptedstring: Specify a shared secret with an encrypted string.

Usage Guidelines

The no version of the command removes NTP authentication settings.

NTP authentication involves three steps that you can perform in any order:

Configure a key ID using the ntp authentication command.

Add the configured key ID to the trusted keys list using the ntp authentication trusted-keys command.

Configure the NTP server or peer with the key ID using the ntp server key or ntp peer key command.

Examples

amnesiac (config) # ntp authentication key 56732 secret zza419

ntp authentication trusted keys, ntp peer key, ntp server key, show ntp, show ntp authentication

ntp authentication trusted keys

Adds a configured key ID to the trusted keys list.

Syntax

[no] ntp authentication trustedkeys key-id [key id, ...]

Parameters

key key-id [key id, ...]

Specify the key identifier. The key ID values must be in the range 1 - 65534. You can specify multiple key IDs in the same list, separated by commas. When specifying multiple key IDs separated by commas, you must enclose them in quotes.

Usage Guidelines

Use this command to add the configured key ID to the trusted keys list.

The no command removes a key from the trusted key list.

NTP authentication involves three steps that you can perform in any order:

Configure a key ID using the ntp authentication command.

Add the configured key ID to the trusted keys list using the ntp authentication trusted-keys command.

Configure the NTP server or peer with the key ID using the ntp server key or ntp peer key command.

Examples

amnesiac (config) # ntp authenticatication trustedkeys 56732

ntp authentication, ntp peer key, ntp server key, show ntp, show ntp authentication

ntp disable

Disables NTP support.

Syntax

[no] ntp disable

Usage Guidelines

The no command option enables NTP support.

Examples

amnesiac (config) # ntp disable

show ntp

ntp enable

Enables NTP support.

Syntax

[no] ntp enable

Usage Guidelines

The no command option disables NTP support.

Examples

amnesiac (config) # ntp enable

show ntp

ntp peer

Enables an NTP peer.

Syntax

[no] ntp peer hostname | ip-addr [ version number ]

Parameters

hostname | ip-addr

Specify the NTP peer hostname or IP address.

version number

Specify the NTP version number. You do not need to specify the version number for the no ntp server command.

Usage Guidelines

The no command option disables an NTP peer.

Examples

amnesiac (config) # ntp peer 10.10.10.1

show ntp, show ntp active-peers

Configuration-Mode Commands

Entering configuration mode

Configuration-Mode Commands

access enable

Syntax

Examples

Related Commands

access inbound rule add

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

access inbound rule edit rulenum

Syntax

Parameters

Examples

Related Commands

access inbound rule move

Syntax

Parameters

Examples

Related Commands

alarm clear

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

alarm clear-threshold

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

alarm enable

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

alarm error-threshold

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

alarm rate-limit

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

alarms reset-all

Syntax

Usage Guidelines

Examples

Related Commands

arp

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

authentication policy enable

Syntax

Usage Guidelines

Examples

Related Commands

authentication policy login max-failures

Syntax

Parameters

Usage Guidelines

Examples

Related Commands

authentication policy password

Syntax

Parameters

Usage Guidelines

Examples