Table Of Contents

Configuring Health Monitoring

Configuring Active Health Probes

Defining an Active Probe and Accessing Probe Configuration Mode

Configuring General Probe Attributes

Configuring a Probe Description

Configuring the Destination IP Address

Configuring the Port Number

Configuring the Time Interval Between Probes

Configuring the Retry Count for Failed Probes

Configuring the Wait Period and Threshold for Successful Probes

Configuring the Wait Interval for the Opening of the Connection

Configuring the Timeout Period for a Probe Response

Configuring an ICMP Probe

Configuring a TCP Probe

Configuring the Termination of the TCP Connection

Configuring an Expected String from the Server

Configuring Data that the Probe Sends to the Server Upon Connection

Configuring a UDP Probe

Configuring Echo Probes

Configuring Finger Probes

Configuring an HTTP Probe

Configuring the Credentials for a Probe

Configuring the Header Field for the HTTP Probe

Configuring the HTTP Method for the Probe

Configuring the Status Code from the Destination Server

Configuring an MD5 Hash Value

Configuring an HTTPS Probe

Configuring the Cipher Suite for the HTTPS Probe

Configuring the Supported SSL or TLS Version

Configuring FTP Probes

Configuring the Status Code from the Destination Server

Configuring Telnet Probes

Configuring DNS Probes

Configuring the Domain Name

Configuring the Expected IP Address

Configuring SMTP Probes

Configuring the Status Code from the Destination Server

Configuring an IMAP Probe

Configuring the Username Credentials

Configuring the Mailbox

Configuring the Request Command for the Probe

Configuring a POP3 Probe

Configuring the Credentials for a Probe

Configuring the Request Command for the Probe

Configuring a RADIUS Probe

Configuring the Credentials and Shared Secret for a Probe

Configuring the Network Access Server IP Address

Configuring Scripted Probes

Associating a Script with a Probe

Example of a UDP Probe Load-Balancing Configuration

Displaying Probe Information

Clearing Probe Statistics

Clearing Statistics for Individual Probes

Clearing All Probe Statistics in a Context

Where to Go Next

Configuring Health Monitoring

---

Health monitoring on the ACE tracks the state of a server by sending out probes. Also referred as out-of-band health monitoring, the ACE verifies the server response or checks for any network problems that can prevent a client to reach a server. Based on the server response, the ACE can place the server in or out of service, and can make reliable load-balancing decisions.

You can also use health monitoring to detect failures for a gateway or a host in high-availability configurations. For more information, see the Cisco 4700 Series Application Control Engine Appliance Administration Guide.

The ACE identifies the health of a server in the following categories:

•Passed—The server returns a valid response.

•Failed—The server fails to provide a valid response to the ACE and is unable to reach a server for a specified number of retries.

By configuring the ACE for health monitoring, the ACE sends active probes periodically to determine the server state. The ACE supports 4096 unique probe configurations, which includes ICMP, TCP, HTTP, and other predefined health probes. The ACE allows the opening of 1000 probe sockets simultaneously (without scripts). Note that the ACE can execute only up to 200 concurrent script probes at a time.

You can associate the same probe with multiple real servers or server farms. Each time that you use the same probe again, the ACE counts it as another probe instance. You can allocate a maximum of 16384 probe instances.

This chapter contains the following topics:

•Configuring Active Health Probes

•Example of a UDP Probe Load-Balancing Configuration

•Displaying Probe Information

•Clearing Probe Statistics

•Where to Go Next

Configuring Active Health Probes

By default, no active health probes are configured on the ACE. You can configure health probes on the ACE to actively make connections and explicitly send traffic to servers. The probes determine whether the health status of a server passes or fails by its response.

Configuring active probes is a three-step process:

1. Configure the health probe with a name, type, and attributes.

2. Associate the probe with one of the following:

•A real server.

•A real server and then associate the real server with a server farm. You can associate a single probe or multiple probes to real servers within a server farm.

•A server farm. All servers in the server farm receive probes of the associated probe types.

3. Activate the real server or server farm.

For information on associating a probe with a real server or a server farm, and putting it into service, see Chapter 2, Configuring Real Servers and Server Farms.

You can also configure one or more probes to track a gateway or host. For more information, see the Cisco 4700 Series Application Control Engine Appliance Administration Guide.

Defining an Active Probe and Accessing Probe Configuration Mode

When you initially configure a health probe, you define its type and name. The CLI then enters the probe configuration mode, which allows you to configure the attributes for the probe type.

To define a probe and access its configuration mode, use the probe command in configuration mode. The syntax of this command is as follows:

probe probe_type probe_name

The arguments are as follows:

•probe_type—Probe type that determines what the probe sends to the server. Enter one of the following keywords:

–icmp—Specifies an ICMP probe type and accesses its configuration mode. For configuration details, see the "Configuring an ICMP Probe" section.

–tcp—Specifies a TCP probe type and accesses its configuration mode. For configuration details, see the "Configuring a TCP Probe" section.

–udp—Specifies a UDP probe type and accesses its configuration mode. For configuration details, see the "Configuring a UDP Probe" section.

–echo {tcp | udp}—Specifies an ECHO TCP or UDP probe type and accesses its configuration mode. For configuration details, see the "Configuring Echo Probes" section.

–finger—Specifies a Finger probe type and accesses its configuration mode. For configuration details, see the "Configuring Finger Probes" section.

–http—Specifies an HTTP probe type and accesses its configuration mode. For configuration details, see the "Configuring an HTTP Probe" section.

–https—Specifies an HTTPS probe type for SSL and accesses its configuration mode. For configuration details, see the "Configuring an HTTPS Probe" section.

–ftp —Specifies an FTP probe type and accesses its configuration mode. For configuration details, see the "Configuring FTP Probes" section.

–telnet—Specifies a Telnet probe type and accesses its configuration mode. For configuration details, see the "Configuring Telnet Probes" section.

–dns—Specifies a DNS probe type and accesses its configuration mode. For configuration details, see the "Configuring DNS Probes" section.

–smtp—Specifies an SMTP probe type and accesses its configuration mode. For configuration details, see the "Configuring SMTP Probes" section.

–imap—Specifies an IMAP probe type and accesses its configuration mode. For configuration details, see the "Configuring an IMAP Probe" section.

–pop—Specifies a POP probe type and accesses its configuration mode. For configuration details, see the "Configuring a POP3 Probe" section.

–radius—Specifies a RADIUS probe type and accesses its configuration mode. For configuration details, see the "Configuring a RADIUS Probe" section.

–scripted—Specifies a scripted probe type and accesses its configuration mode. For configuration details, see the "Configuring Scripted Probes" section. For information on scripts, see Appendix A, Using Toolkit Command Language (TCL) Scripts with the ACE.

•probe_name—Name that you want to assign to the probe. Use the probe name to associate the probe to the real server or server farm. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

For example, to define a TCP probe named PROBE1 and access the TCP probe configuration mode, enter:

host1/Admin(config)# probe tcp PROBE1

host1/Admin(config-probe-tcp)#

To delete a TCP probe named PROBE1, enter:

host1/Admin(config)# no probe tcp PROBE1

Some probe attributes and associated commands apply to all probe types. For information on configuring these attributes, see the "Configuring General Probe Attributes" section.

Configuring General Probe Attributes

When you access probe configuration mode to configure the attributes for the probe, the ACE provides a set of commands that you can configure for all probe types, except as indicated. The following topics describe how to configure the general attributes for a probe:

•Configuring a Probe Description

•Configuring the Destination IP Address

•Configuring the Port Number

•Configuring the Time Interval Between Probes

•Configuring the Retry Count for Failed Probes

•Configuring the Wait Period and Threshold for Successful Probes

•Configuring the Wait Interval for the Opening of the Connection

•Configuring the Timeout Period for a Probe Response

Configuring a Probe Description

You can provide a description for a probe by using the description command. This command is available for all probe-type configuration modes. The syntax of this command is as follows:

description text

The text argument is a description of the probe. Enter a text string with a maximum of 240 alphanumeric characters.

For example, to configure a description THIS PROBE IS FOR TCP SERVERS, enter:

host1/Admin(config-probe-type)# description THIS PROBE IS FOR TCP 
SERVERS

To remove the description for the probe, use the no description command. For example, enter:

host1/Admin(config-probe-type)# no description

Configuring the Destination IP Address

By default, the probe uses the IP address from the real server or server farm configuration for the destination IP address. You can configure the destination address that the probe uses by using the ip address command. This command is available for all probe-type configuration modes except scripted. The syntax of this command is as follows:

ip address ip_address [routed]

The argument and option are as follows:

•ip_address—Destination IP address. Enter a unique IPv4 address in dotted-decimal notation (for example, 192.8.12.15).

•routed—(Optional) Specifies that the ACE will route the address according to the ACE internal routing table.

For example, to configure an IP address of 192.8.12.15, enter:

host1/Admin(config-probe-type)# ip address 192.8.12.15

To reset the default behavior of the probe using the IP address from the real server or server farm configuration, use the no ip address command. For example, enter:

host1/Admin(config-probe-type)# no ip address

Configuring the Port Number

By default, the probe uses the port number based on its type. Table 4-1 lists the default port numbers for each probe type.

Table 4-1 Default Port Numbers for Probe Types 

Probe Type	Default Port Number
ICMP	Not applicable
TCP	80
UDP	53
HTTP	80
HTTPS	443
FTP	21
Telnet	23
Echo	7
Finger	79
IMAP	143
POP3	110
SMTP	25
DNS	53
RADIUS	1812

To configure the port number that the probe uses, use the port command. This command is available for all probe-type configuration modes except ICMP. The syntax of this command is as follows:

port number

The number argument is the number of the port. Enter a number from 1 to 65535.

For example, to configure a port number of 88 for an HTTP probe, enter:

host1/Admin(config-probe-http)# port 88

To reset the port number to its default value, use the no port command. For example, to remove an HTTP probe port number of 88 and reset an HTTP probe port number to its default setting of 80, enter:

host1/Admin(config-probe-http)# no port

Configuring the Time Interval Between Probes

The time interval between probes is the frequency that the ACE sends probes to the server marked as passed. You can change the time interval between probes by using the interval command. This command is available for all probe-type configuration modes. The syntax of this command is as follows:

interval seconds

The seconds argument is the time interval in seconds. Enter a number from 2 to 65535. By default, the time interval is 120.

For example, to configure a time interval of 50 seconds, enter:

host1/Admin(config-probe-type)# interval 50

To reset the time interval to the default setting of 120, use the no interval command. For example, enter:

host1/Admin(config-probe-type)# no interval

Configuring the Retry Count for Failed Probes

Before the ACE marks a server as failed, it must detect that probes have failed a consecutive number of times. By default, when three consecutive probes have failed, the ACE marks the server as failed. You can configure this number of failed probes by using the faildetect command. This command is available for all probe-type configuration modes. The syntax of this command is as follows:

faildetect retry_count

The retry_count argument is the consecutive number of failed probes before marking the server as failed. Enter a number from 1 to 65535. By default, the count is 3.

For example, to configure the number of failed probes at 5 before declaring the server as failed, enter:

host1/Admin(config-probe-type)# faildetect 5

To reset the number of probe failures to the default setting of 3, use the no faildetect command. For example, enter:

host1/Admin(config-probe-type)# no faildetect

Configuring the Wait Period and Threshold for Successful Probes

After the ACE marks a server as failed, it waits a period of time and then sends a probe to the failed server. When the ACE receives a number of consecutive successful probes, it marks the server as passed. By default, the ACE waits 300 seconds before sending out a probe to a failed server and marks a server as passed if it receives 3 consecutive successful responses.

To configure the time interval after which the ACE sends a probe to a failed server and the number of consecutive successful probes required to mark the server as passed, use the passdetect command. This command is available for all probe-type configuration modes. The syntax of this command is as follows:

passdetect {interval seconds | count number}

The arguments are as follows:

•interval seconds—Specifies the wait time interval in seconds. Enter a number from 2 to 65535. The default is 300.

•count number—Specifies the number of successful probe responses from the server. Enter a number from 1 to 65535. The default is 3.

For example, to configure wait interval at 10 seconds, enter:

host1/Admin(config-probe-type)# passdetect interval 10

For example, to configure five success probe responses from the server before declaring it as passed, enter:

host1/Admin(config-probe-type)# passdetect count 5

To reset the wait interval to its default setting, use the no passdetect interval command. For example, enter:

host1/Admin(config-probe-type)# no passdetect interval

To reset the successful probe responses to its default setting, use the no passdetect count command. For example, enter:

host1/Admin(config-probe-type)# no passdetect count

Configuring the Wait Interval for the Opening of the Connection

When the ACE sends a probe, it waits for the SYN-ACK after sending a SYN to open and then send an ACK to establish the connection with the server. You can configure the time interval for a connection to be established by using the open command. This command is available in Echo TCP, Finger, FTP, HTTP, HTTPS, IMAP, POP, scripted, SMTP, TCP, and Telnet probe configuration mode (all TCP-based probes). The syntax of this command is as follows:

open timeout

The timeout argument is the time to wait in seconds to open a connection with a server. Enter an integer from 1 to 65535. The default wait interval is 10 seconds.

For example, to configure the wait time interval to 25 seconds, enter:

host1/Admin(config-probe-type)# open 25 

To reset the time interval to its default setting of 10 seconds, use the no open command. For example, enter:

host1/Admin(config-probe-type)# no open

Configuring the Timeout Period for a Probe Response

By default, when the ACE sends a probe, it expects a response within a time period of 10 seconds. For example, for an HTTP probe, the timeout period is the number of seconds to receive an HTTP reply for a GET or HEAD request. If the server fails to respond to the probe, the ACE marks the server as failed.

You can configure this time period to receive a server response to the probe by using the receive command. This command is available for all probe-type configuration modes. The syntax of this command is as follows:

receive timeout

The timeout argument is the timeout period in seconds. Enter a number from 1 to 65535. By default, the timeout period is 10.

For example, to configure the timeout period for a response at 5 seconds, enter:

host1/Admin(config-probe-type)# receive 5

To reset the time period to receive a response from the server to its default setting of 10 seconds, use the no receive command. For example, enter:

host1/Admin(config-probe-type)# no receive

Configuring an ICMP Probe

An ICMP probe sends an ICMP echo request and listens for a response. If a server returns a response, the ACE marks the server as passed. If the server does not send a response causing the probe to time out, or if the server sends an unexpected ICMP echo response type, the ACE marks the probe as failed.

You can create an ICMP probe and access its configuration mode by using the probe icmp name command in configuration mode.

For example, to define an ICMP probe named PROBE3 and access its mode, enter:

host1/Admin(config)# probe icmp PROBE3

host1/Admin(config-probe-icmp)#

After you create an ICMP probe, you can configure the attributes in the "Configuring General Probe Attributes" section.

Configuring a TCP Probe

A TCP probe initiates a TCP 3-way handshake and expects the server to send a response. By default, a successful response causes the probe to mark the server as passed. The probe then sends a FIN to end the session. If the response is not valid or if there is no response, the probe marks the server as failed.

Optionally, you can configure the probe to send an RST or specific data, and to expect a specific response in order to mark the server as passed. You can also configure the probe to send specific data and receive a specific response from the server. If the response is not valid or there is no response, the probe marks the server as failed.

You can create a TCP probe and access its configuration mode by using the probe tcp name command in configuration mode.

For example, to define a TCP probe named PROBE1 and access its mode, enter:

host1/Admin(config)# probe tcp PROBE1

host1/Admin(config-probe-tcp)#

You can configure attributes for a TCP probe, as described in the following topics:

•Configuring the Termination of the TCP Connection

•Configuring an Expected String from the Server

•Configuring Data that the Probe Sends to the Server Upon Connection

You can also configure the attributes described in the "Configuring General Probe Attributes" section.

Configuring the Termination of the TCP Connection

A TCP probe makes a connection, and if the connection through a 3-way handshake (SYN, SYN-ACK, and ACK) is successful, the server is marked as passed. By default, the ACE terminates a TCP connection gracefully by sending a FIN to the server.

If a probe is configured for the default graceful connection termination (FIN) and the target server does not send the expected data, the probe terminates the TCP connection to the server with a reset (RST). The probe will continue to send a RST to terminate the server connection as long as the returned data is not the expected data. When the server responds with the correct data again, the probe reverts to terminating the connection with a FIN.

To configure the ACE to terminate a TCP connection by sending an RST, use the connection term command. This command is available for TCP-based connection-oriented probes (ECHO TCP, Finger, FTP, HTTP, HTTPS, IMAP, POP, SMTP, TCP, and Telnet probe configuration modes). The syntax of this command is as follows:

connection term forced

For example, enter:

host1/Admin(config-probe-tcp)# connection term forced 

To reset the method to terminate a connection gracefully, use the no connection term command. For example, enter:

host1/Admin(config-probe-tcp)# no connection term forced

Configuring an Expected String from the Server

When you configure a probe to expect a string from a server, it searches the response for a configured string. If the ACE finds the expected string, the server is marked as passed. If you do not configure an expected string, the ACE ignores the server response.

You can configure what the ACE expects as a response string from the probe destination server by using the expect regex command. This command is available in Finger, HTTP, HTTPS, TCP, and UDP probe configuration modes. The syntax of this command is as follows:

expect regex string [offset number]

The argument and option are as follows:

•string—Expected response string from the probe destination. Enter an unquoted text string with no spaces. If the string includes spaces, enclose the string in quotes. The string can be a maximum of 255 alphanumeric characters.

•offset number—(Optional) Sets the number of characters into the received message or buffer where the ACE starts searching for the defined expression. Enter a number from 1 to 4000.

---

Note If you configure the expect regex command for TCP probes, you must configure the send-data command. Otherwise, the probe opens and closes the connection without checking the response from the server.

---

For example, to configure the ACE to expect a response string of ack, enter:

host1/Admin(config-probe-tcp)# expect regex ack

To remove the expectation of a response string for TCP and UDP probes, use the no expect command. For example, enter:

host1/Admin(config-probe-tcp)# no expect

To remove the expectation of a response string for HTTP and HTTPS probes, use the no expect regex command. For example, enter:

host1/Admin(config-probe-http)# no expect regex

Configuring Data that the Probe Sends to the Server Upon Connection

You can configure the ASCII data that the probe sends when the ACE connects to the server by using the send-data command. This command is available in Echo, Finger, TCP, and UDP probe configuration modes. The syntax of this command is as follows:

send-data expression

The expression argument is the data that the probe sends. Enter an unquoted text string with a maximum of 255 alphanumeric characters including spaces.

---

Note If you do not configure the send-data command for a UDP probe, the probe sends one byte, 0x00.

---

For example, to configure the probe to send TEST as the data, enter:

host1/Admin(config-probe-tcp)# send-data test

To remove the data, use the no send-data command. For example, enter:

host1/Admin(config-probe-tcp)# no send-data

Configuring a UDP Probe

---

Note When configuring a UDP probe, you must configure a management-based policy. For more information on policies, see the Cisco 4700 Series Application Control Engine Appliance Administration Guide.

---

By default, the UDP probe sends a UDP packet to a server and marks the server as failed only if the server returns an ICMP Port Unreachable message. If the ACE does not receive any ICMP errors for the UDP request that was sent, the server is marked as passed. Optionally, you can configure this probe to send specific data and expect a specific response to mark the server as passed.

If the IP interface of the server is down or disconnected, the UDP probe by itself would not know that the UDP application is not reachable.

To create a UDP probe and access its configuration mode, use the probe udp name command.

For example, to define a UDP probe named PROBE2 and access its mode, enter:

host1/Admin(config)# probe udp PROBE2

host1/Admin(config-probe-udp)#

You can configure the following attributes for a UDP probe:

•To configure what the ACE expects as a response from the probe destination server, use the expect regex command. For more details about this command, see the "Configuring an Expected String from the Server" section.

•To configure the data sent on the connection for a UDP probe, use the send-data expression command. For more details about this command, see the "Configuring Data that the Probe Sends to the Server Upon Connection" section.

You can also configure the attributes described in the "Configuring General Probe Attributes" section.

Configuring Echo Probes

The Echo probe sends a specified string to the server and compares the response with the original string. You must configure the string that needs to be echoed. If the response string matches the original string, the server is marked as passed. If you do not configure a string, the probe behaves like a TCP or UDP probe (see the "Configuring a TCP Probe" section or the "Configuring a UDP Probe" section).

You can create an Echo probe and access its configuration mode by using the probe echo command. The syntax of this command is as follows:

probe echo {tcp | udp} name

The keywords and argument are as follows:

•name—Identifier of the probe. Enter an unquoted text string with a maximum of 64 alphanumeric characters.

•tcp—Configures the probe for a TCP connection.

•udp—Configures the probe for a UDP connection.

For example, to define a TCP Echo probe named PROBE and access its mode, enter:

host1/Admin(config)# probe echo tcp PROBE

host1/Admin(config-probe-echo-tcp)#

For example, to define a UDP Echo probe named PROBE17 and access its mode, enter:

host1/Admin(config)# probe echo udp PROBE17

host1/Admin(config-probe-echo-udp)#

For Echo TCP and Echo UDP probes, you can configure the attributes described in the "Configuring General Probe Attributes" section.

For an Echo TCP probe (configured using the tcp keyword), you can also configure the attributes described in the "Configuring a TCP Probe" section.

For an Echo UDP probe (configured using the udp keyword), you can also configure the attributes described in the "Configuring a UDP Probe" section.

Configuring Finger Probes

The Finger probe uses a Finger query to a server for an expected response string. The ACE searches the response for the configured string. If the ACE finds the expected response string, the server is marked as passed. If you do not configure an expected response string, the ACE ignores the server response.

You can create a Finger probe and access its configuration mode by using the probe finger command. The syntax of this command is as follows:

probe finger name

The name argument is the identifier of the probe. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

For example, to define a Finger probe named PROBE8 and access its mode, enter:

host1/Admin(config)# probe finger PROBE8

host1/Admin(config-probe-finger)#

To configure the attributes for a Finger probe, see the "Configuring General Probe Attributes" and "Configuring a TCP Probe" sections.

Configuring an HTTP Probe

An HTTP probe establishes a TCP connection and issues an HTTP request to the server for an expected string and status code. The ACE can compare the received response with configured codes, looking for a configured string in the received HTTP page, or verifying hash for the HTTP page. If any of these checks fail, the server is marked as failed.

For example, if you configure an expected string and status code and the ACE finds them both in the server response, the server is marked as passed. However, if the ACE does not receive either the server response string or the expected status code, it marks the server as failed.

---

Note If you do not configure an expected status code, any response from the server is marked as failed.

---

You can create an HTTP probe and access its configuration mode by using the probe http name command. For example, to define an HTTP probe named PROBE4 and access its mode, enter:

host1/Admin(config)# probe http PROBE4

host1/Admin(config-probe-http)#

To configure attributes for an HTTP probe, see the following topics:

•Configuring the Credentials for a Probe

•Configuring the Header Field for the HTTP Probe

•Configuring the HTTP Method for the Probe

•Configuring the Status Code from the Destination Server

•Configuring an MD5 Hash Value

After you create an HTTP probe, you can configure the general probe attributes described in the "Configuring General Probe Attributes" section. You can also configure the TCP probe attributes, including an expected response string, described in the "Configuring a TCP Probe" section.

Configuring the Credentials for a Probe

The credentials for a probe are the username and password used for authentication on the server. You can configure the credentials for the probe by using the credentials command. The syntax of this command is as follows:

credentials username [password]

The arguments are as follows:

•username—User identifier used for authentication. Enter an unquoted text string with a maximum of 64 alphanumeric characters.

•password—(Optional) Password used for authentication. Enter an unquoted text string with a maximum of 64 alphanumeric characters.

For example, to configure the username ENG1 and a password TEST, enter:

host1/Admin(config-probe-http)# credentials ENG1 TEST 

To delete the credentials for the probe, use the no credentials command. For example, enter:

host1/Admin(config-probe-http)# no credentials

Configuring the Header Field for the HTTP Probe

You can configure an HTTP header or multiple header fields for the HTTP probe by using the header command. The syntax of this command is as follows:

header field_name header-value value

The arguments are as follows:

•field_name—Identifier for a standard header field. Enter a text string with a maximum of 64 alphanumeric characters. If the header field includes spaces, enclose its string with quotes. You can also enter one of the following header keywords:

–Accept—Accept request header

–Accept-Charset—Accept-Charset request header

–Accept-Encoding—Accept-Encoding request header

–Accept-Language—Accept-Language request header

–Authorization—Authorization request header

–Cache-Control—Cache-Control general header

–Connection—Connection general header

–Content-MD5—Content-MD5 entity header

–Expect—Expect request header

–From—From request header

–Host—Host request header

–If-Match—If-Match request header

–Pragma—Pragma general header

–Referer—Referer request header

–Transfer-Encoding—Transfer-Encoding general header

–User-Agent—User-Agent request header

–Via—Via general header

•header-value field_value—Specifies the value assigned to the header field. Enter a text string with a maximum of 255 alphanumeric characters. If the value string includes spaces, enclose the string with quotes.

For example, to configure the Accept-Encoding HTTP header with a field value of IDENTITY, enter:

host1/Admin(config-probe-http)# header Accept-Encoding header-value 
IDENTITY

To remove the header configuration for the probe, use the no form of the header command. For example, to remove a header with the Accept-Encoding field name, enter:

host1/Admin(config-probe-http)# no header Accept-Encoding

Configuring the HTTP Method for the Probe

By default, the HTTP request method is a GET with the URL "/". If you do not configure a URL, the probe functions as a TCP probe.

You can configure the HTTP method and URL used by the probe by using the request method command. The syntax of this command is as follows:

request method {get | head} url path

The keywords and arguments are as follows:

•get | head—Configures the HTTP request method. The keywords are as follows:

–get —The HTTP GET request method directs the server to get the page. This method is the default.

–head —The HTTP HEAD request method directs the server to get only the header for the page.

•url path—Specifies the URL path. The path argument is a character string of up to 255 alphanumeric characters. The default path is "/".

For example, to configure the HEAD HTTP method and the /digital/media/graphics.html URL used by an HTTP probe, enter:

host1/Admin(config-probe-http)# request method head url 
/digital/media/graphics.html 

To reset the HTTP method for the probe to GET, use the no request method command. For example, enter:

host1/Admin(config-probe-http)# no request method head url 
/digital/media/graphics.html 

Configuring the Status Code from the Destination Server

When the ACE receives a response from the server, it expects a status code to mark a server as passed. By default, no status codes are configured on the ACE. If you do not configure a status code, any response code from the server is marked as failed.

You can configure a single status code or a range of code responses that the ACE expects from the probe destination by using the expect status command. You can specify multiple status code ranges with this command by entering the command with different ranges separately. The syntax of this command is as follows:

expect status min_number max_number

The arguments and options are as follows:

•min_number—Single status code or the lower limit of a range of status codes. Enter an integer from 0 to 999.

•max_number—Upper limit of a range of status codes. Enter an integer from 0 to 999. When configuring a single code, reenter the min_number value.

For example, to configure an expected status code of 200 that indicates that the HTTP request was successful, enter:

host1/Admin(config-probe-http)# expect status 200 200

To configure a range of expected status codes from 200 to 210, enter:

host1/Admin(config-probe-http)# expect status 200 210

To configure multiple ranges of expected status codes from 200 to 202 and 204 to 205, you must configure each range separately. For example, enter:

host1/Admin(config-probe-http)# expect status 200 202

host1/Admin(config-probe-http)# expect status 204 205

To remove a single expected status code, use the no expect status command. For example, to remove the expected status code of 200, enter:

host1/Admin(config-probe-http)# no expect status 200 200 

To remove a range of expected status codes, enter the range when using the no expect status command. For example, to remove a range of 200 to 202 from a range of 200 to 210, enter:

host1/Admin(config-probe-http)# no expect status 200 202

To remove multiple ranges of expected status codes, you must remove each range separately. For example, if you have set two different ranges (200 to 202 and 204 to 205), enter:

host1/Admin(config-probe-http)# no expect status 200 202

host1/Admin(config-probe-http)# no expect status 204 205

Configuring an MD5 Hash Value

By default, no MD5 hash value is configured on the ACE. To configure the ACE to dynamically generate the hash value or manually configure the value, use the hash command. If you do not use this command to configure the hash value, the ACE does not calculate a hash value on the HTTP data returned by the probe. The syntax of this command is:

hash [value]

When you enter this command with no argument, the ACE generates the hash on the HTTP data returned by the first successful probe. If subsequent HTTP server hash responses match the generated hash value, the ACE marks the server as passed.

If a mismatch occurs due to changes to the HTTP data, the probe fails and the show probe ... detail command displays an MD5 mismatch error in the Last disconnect error field. To clear the reference hash and have the ACE recalculate the hash value at the next successful probe, change the URL or method by using the request method command. For more information, see the "Configuring the HTTP Method for the Probe" section.

The optional value argument is the MD5 hash value that you want to manually configure. Enter the MD5 hash value as a hexadecimal string with exactly 32 characters (16 bytes).

---

Note The server response must include the Content-Length header for the hash command to function. Otherwise, the probe does not attempt to parse the hash value.

You can configure the hash command on a probe using the HEAD method, however there is no data to hash and has no effect causing the probe to always succeed.

---

For example, to configure the ACE to generate the hash on the HTTP data returned by the first successful probe, enter:

host1/Admin(config-probe-http)# hash

To manually configure a hash value, enter:

host1/Admin(config-probe-http)# hash 0123456789abcdef0123456789abcdef

To configure the ACE to no longer compare the referenced hash value to the computed hash value, enter:

host1/Admin(config-probe-http)# no hash

Configuring an HTTPS Probe

An HTTPS probe is similar to an HTTP probe except that it uses SSL to generate encrypted data. You can create an HTTPS probe and access its configuration mode by using the probe https command. The syntax of this command is as follows:

probe https name

For the name argument, enter an identifier for the HTTPS probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

For example, to define an HTTPS probe named PROBE5 and access its mode, enter:

host1/Admin(config)# probe https PROBE5

host1/Admin(config-probe-https)#

To configure attributes for an HTTPS probe, see the following topics:

•Configuring the Cipher Suite for the HTTPS Probe

•Configuring the Supported SSL or TLS Version

After you create an HTTPS probe, you can configure the general probe attributes described in the "Configuring General Probe Attributes" section. You can also configure the HTTP probe attributes described in the "Configuring an HTTP Probe" section.

Configuring the Cipher Suite for the HTTPS Probe

By default, the HTTPS probe accepts any of the RSA configured cipher suites. You can configure the probe to expect a specific type of RSA cipher suite from the back-end server by using the ssl cipher command. The syntax of this command is as follows:

ssl cipher RSA_ANY | cipher_suite

The keyword and variable are as follows:

•RSA_ANY—Specifies that any of the RSA cipher suites from those allowed on the ACE is accepted from the server. This is the default setting.

•cipher_suite—RSA cipher suite that the probe expects from the back-end server. Enter one of the following keywords:

–RSA_WITH_RC4_128_MD5

–RSA_WITH_RC4_128_SHA

–RSA_WITH_DES_CBC_SHA

–RSA_WITH_3DES_EDE_CBC_SHA

–RSA_EXPORT_WITH_RC4_40_MD5

–RSA_EXPORT_WITH_DES40_CBC_SHA

–RSA_EXPORT1024_WITH_RC4_56_MD5

–RSA_EXPORT1024_WITH_DES_CBC_SHA

–RSA_EXPORT1024_WITH_RC4_56_SHA

–RSA_WITH_AES_128_CBC_SHA

–RSA_WITH_AES_256_CBC_SHA

For example, to configure the HTTPS probes with the RSA_WITH_RC4_128_SHA cipher suite, enter:

host1/Admin(config-probe-https)# ssl cipher RSA_WITH_RC4_128_SHA

To reset the default behavior of the HTTPs probes accepting any RSA cipher suite, enter:

host1/Admin(config-probe-https)# ssl cipher RSA_ANY

You can also use the no ssl cipher command to reset the default behavior. Enter:

host1/Admin(config-probe-https)# no ssl cipher

Configuring the Supported SSL or TLS Version

The version in the ClientHello message sent to the server indicates the highest supported version. By default, the probe supports SSL version 3. You can configure the version of SSL that the probe supports by using the ssl version command. The syntax of this command is as follows:

ssl version SSLv2 | SSLv3 | TLSv1

The keywords are as follows:

•SSLv2—Specifies SSL version 2.

•SSLv3—Specifies SSL version 3 (default).

•TLSv1—Specifies TLS version 1.

For example, to configure TLS version 1, enter:

host1/Admin(config-probe-https)# ssl version TLSv1

To reset the default setting, enter:

host1/Admin(config-probe-https)# no ssl version

Configuring FTP Probes

An FTP probe establishes a TCP connection to the server and then issues a quit command. You can create an FTP probe and access its configuration mode by using the probe ftp command. The syntax of this command is as follows:

probe ftp name

For the name argument, enter the identifier of the FTP probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

For example, to define an FTP probe named PROBE8 and access its mode, enter:

host1/Admin(config)# probe ftp PROBE8

host1/Admin(config-probe-ftp)#

The "Configuring the Status Code from the Destination Server" section describes how to configure status codes for the probe.

You can also configure the attributes described in the "Configuring General Probe Attributes" and "Configuring a TCP Probe" sections.

Configuring the Status Code from the Destination Server

When the ACE receives a response from the server, it expects a status code to mark a server as passed. By default, no status codes are configured on the ACE. If you do not configure a status code, any response code from the server is marked as failed.

You can configure a single status code or a range of code responses that the ACE expects from the probe destination by using the expect status command. You can specify multiple status code ranges with this command by entering the command with different ranges separately. The syntax of this command is as follows:

expect status min_number max_number

The arguments and options are as follows:

•min_number—Single status code or the lower limit of a range of status codes. Enter an integer from 0 to 999.

•max_number—Upper limit of a range of status codes. Enter an integer from 0 to 999. When configuring a single code, reenter the min_number value.

For example, to configure an expected status code of 200 that indicates that the request was successful, enter:

host1/Admin(config-probe-ftp)# expect status 200 200

To configure a range of expected status codes from 200 to 201, enter:

host1/Admin(config-probe-ftp)# expect status 200 201

To configure multiple ranges of expected status codes from 200 to 201 and 230 to 250, you must configure each range separately. For example, enter:

host1/Admin(config-probe-ftp)# expect status 200 201

host1/Admin(config-probe-ftp)# expect status 230 250

To remove a single expected status code, use the no expect status command. For example, to remove the expected status code of 200, enter:

host1/Admin(config-probe-ftp)# no expect status 200 200

To remove a range of expected status codes, enter the range when using the no expect status command. For example, to remove a range of 200 to 201, enter:

host1/Admin(config-probe-ftp)# no expect status 200 201

To remove multiple ranges of expected status codes, you must remove each range separately. For example, if you have set two different ranges (200 to 201 and 230 to 250), enter:

host1/Admin(config-probe-ftp)# no expect status 200 201

host1/Admin(config-probe-ftp)# no expect status 230 250

Configuring Telnet Probes

A Telnet probe establishes a connection to the server and verifies that a greeting from the application was received. You can create a Telnet probe and access its configuration mode by using the probe telnet command. The syntax of this command is as follows:

probe telnet name

For the name argument, enter an identifier for the Telnet probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

For example, to define a Telnet probe named PROBE6 and access its mode, enter:

host1/Admin(config)# probe telnet PROBE6

host1/Admin(config-probe-telnet)#

You can also configure the attributes described in the "Configuring General Probe Attributes" and "Configuring a TCP Probe" sections.

Configuring DNS Probes

A DNS probe sends a request to a DNS server giving it a configured domain (by default, the domain is www.cisco.com). To determine if the server is up, the ACE must receive one of the configured IP addresses for that domain. You can create a DNS probe and access its configuration mode by using the probe dns command. The syntax of this command is as follows:

probe dns name

For the name argument, enter an identifier for the DNS probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

For example, to define a DNS probe named PROBE7 and access its mode, enter:

host1/Admin(config)# probe dns PROBE7

host1/Admin(config-probe-dns)#

To configure attributes for a DNS probe, see the following topics:

•Configuring the Domain Name

•Configuring the Expected IP Address

You can also configure the attributes described in the "Configuring General Probe Attributes" section.

Configuring the Domain Name

The DNS probe sends a domain name for the DNS server to resolve. By default, the probe uses the www.cisco.com domain. You can configure the domain name that the probe sends to the server by using the domain command. The syntax of this command is as follows:

domain name

The name argument is the domain that the probe sends to the DNS server. Enter an unquoted text string with a maximum of 255 alphanumeric characters.

For example, to configure the domain name of support.cisco.com, enter:

host1/Admin(config-probe-dns)# domain support.cisco.com

To reset the domain to www.cisco.com, use the no domain command. For example, enter:

host1/Admin(config-probe-dns)# no domain

Configuring the Expected IP Address

When a DNS probe sends a domain name resolve request to the server, it verifies the returned IP address by matching the received IP address with the configured addresses. You can configure the IP address that the ACE expects as a server response to a DNS request by using the expect address command. The syntax of this command is as follows:

expect address ip_address

The ip_address argument is the expected returned IP address. Enter a unique IPv4 address in dotted-decimal notation (for example, 192.8.12.15).

You can specify multiple IP addresses with this command by entering the command with a different address separately. For example, to configure an expected IP address of 192.8.12.15 and 192.8.12.23, enter:

host1/Admin(config-probe-dns)# expect address 192.8.12.15

host1/Admin(config-probe-dns)# expect address 192.8.12.23

To remove an IP address, use the no expect address command. For example, enter:

host1/Admin(config-probe-dns)# no expect address 192.8.12.15

Configuring SMTP Probes

SMTP probes initiates an SMTP session by logging into the server, sends a HELLO message, and then disconnects from the server. You can create an SMTP probe and access its configuration mode by using the probe smtp command. The syntax of this command is as follows:

probe smtp name

For the name argument, enter the identifier of the SMTP probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

For example, to define a SMTP probe named PROBE10 and access its mode, enter:

host1/Admin(config)# probe smtp PROBE10

host1/Admin(config-probe-smtp)#

Then, you can configure the status codes in the "Configuring the Status Code from the Destination Server" section.

You can also configure the attributes described in the "Configuring General Probe Attributes" section, and configure connection termination as described in the "Configuring the Termination of the TCP Connection" section.

Configuring the Status Code from the Destination Server

When the ACE receives a response from the server, it expects a status code to mark a server as passed. By default, no status codes are configured on the ACE. If you do not configure a status code, any response code from the server is marked as failed.

You can configure a single status code or a range of code responses that the ACE expects from the probe destination by using the expect status command. You can specify multiple status code ranges with this command by entering the command with different ranges separately. The syntax of this command is as follows:

expect status min_number max_number

The arguments and options are as follows:

•min_number—Single status code or the lower limit of a range of status codes. Enter an integer from 0 to 999.

•max_number—Upper limit of a range of status codes. Enter an integer from 0 to 999. When configuring a single code, reenter the min_number value.

For example, to configure a single expected status code of 211, enter:

host1/Admin(config-probe-smtp)# expect status 211 211

To configure a range of expected status codes from 211 to 250, enter:

host1/Admin(config-probe-smtp)# expect status 211 250

To configure multiple ranges of expected status codes from 211 and 250 and 252 to 254, you must configure each range separately. Enter:

host1/Admin(config-probe-smtp)# expect status 211 250

host1/Admin(config-probe-smtp)# expect status 252 254

To remove a single expected status code, use the no expect status command. For example, to remove the expected status code of 211, enter:

host1/Admin(config-probe-smtp)# no expect status 211 211

To remove a range of expected status codes, enter the range when using the no expect status command. For example, to remove a range of 211 to 250, enter:

host1/Admin(config-probe-smtp)# no expect status 211 250

To remove multiple ranges of expected status codes, you must remove each range separately. For example, if you have set two different ranges (211 and 250 and 252 to 254), enter:

host1/Admin(config-probe-smtp)# no expect status 211 250

host1/Admin(config-probe-smtp)# no expect status 252 254

Configuring an IMAP Probe

An Internet Message Access Protocol (IMAP) probe makes a server connection and sends user credential (login, password, and mailbox) information. The ACE can send a configured command. Based on the server response, the ACE marks the probe as passed or failed.

You can create an IMAP probe and access its configuration mode by using the probe imap command. The syntax of this command is as follows:

probe imap name

For the name argument, enter the identifier of the IMAP probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

For example, to define an IMAP probe named PROBE11 and access its mode, enter:

host1/Admin(config)# probe imap PROBE11

host1/Admin(config-probe-imap)#

You can configure attributes for an IMAP probe, as described in the following topics:

•Configuring the Username Credentials

•Configuring the Mailbox

•Configuring the Request Command for the Probe

You can also configure the general attributes described in the "Configuring General Probe Attributes" section and configure connection termination as described in the "Configuring the Termination of the TCP Connection" section.

Configuring the Username Credentials

The credentials for an IMAP probe are the username and password used for authentication on the server. You can configure the credentials for the probe by using the credentials username command. The syntax of this command is as follows:

credentials username password

The arguments are as follows:

•username—User identifier used for authentication. Enter an unquoted text string with a maximum of 64 alphanumeric characters.

•password—Password used for authentication. Enter an unquoted text string with a maximum of 64 alphanumeric characters.

For example, to configure the username ENG1 and a password TEST, enter:

host1/Admin(config-probe-imap)# credentials ENG1 TEST 

To delete the username credentials for the probe, use the no credentials username command. For example, to delete the username ENG1, enter:

host1/Admin(config-probe-imap)# no credentials ENG1

Configuring the Mailbox

You can configure the name of the mailbox from which the probe retrieves e-mail by using the credentials mailbox command. The syntax of this command is as follows:

credentials mailbox name

The mailbox name keyword and argument specifies the user mailbox name from which to retrieve e-mail for an IMAP probe. Enter an unquoted text string with a maximum of 64 alphanumeric characters.

For example, to configure the user mailbox LETTERS, enter:

host1/Admin(config-probe-imap)# credentials mailbox LETTERS

To delete the mailbox for the probe, use the no credentials mailbox command. For example, enter:

host1/Admin(config-probe-imap)# no credentials mailbox

Configuring the Request Command for the Probe

You can configure the method used by an IMAP probe by using the request command command. The syntax of this command is as follows:

request command command

The command argument is the request command for the probe. Enter a text string with a maximum of 32 alphanumeric characters with no spaces.

For example, to configure the last request command for an IMAP probe, enter:

host1/Admin(config-probe-imap)# request command last

To remove the request command for the probe, use the no request command. For example, enter:

host1/Admin(config-probe-imap)# no request

Configuring a POP3 Probe

Post Office Protocol 3 (POP3) probes initiates a session and sends the configured credentials. The ACE can send a configured command. Based on the server response, the ACE marks the probe as passed or failed.

You can create a POP probe and access its configuration mode by using the probe pop command. The syntax of this command is as follows:

probe pop name

For the name argument, enter the identifier for the POP probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

For example, to define a POP probe named PROBE12 and access its mode, enter:

host1/Admin(config)# probe pop PROBE12

host1/Admin(config-probe-pop)#

To configure attributes for a POP probe, see the following topics:

•Configuring the Credentials for a Probe

•Configuring the Request Command for the Probe

You can also configure the general attributes described in the "Configuring General Probe Attributes" section and configure connection termination as described in the "Configuring the Termination of the TCP Connection" section.

Configuring the Credentials for a Probe

The credentials for a probe are the username and password used for authentication on the server. You can configure the credentials for the probe by using the credentials command. The syntax of this command is as follows:

credentials username [password]

The arguments are as follows:

•username—User identifier used for authentication. Enter an unquoted text string with a maximum of 64 alphanumeric characters.

•password—(Optional) Password used for authentication. Enter an unquoted text string with a maximum of 64 alphanumeric characters.

For example, to configure the username ENG1 and a password TEST, enter:

host1/Admin(config-probe-pop)# credentials ENG1 TEST 

To delete the credentials for the probe, use the no credentials command. For example, enter:

host1/Admin(config-probe-pop)# no credentials

Configuring the Request Command for the Probe

You can configure the request command used by a POP probe by using the request command command. The syntax of this command is as follows:

request command command

The command argument is the request command for the probe. Enter a text string with a maximum of 32 alphanumeric characters with no spaces.

For example, to configure the last request command for a POP probe, enter:

host1/Admin(config-probe-pop)# request command last

To remove the request command for the probe, use the no request command. For example, enter:

host1/Admin(config-probe-pop)# no request 

Configuring a RADIUS Probe

A RADIUS probe sends a query using a configured username, password and shared secret to a RADIUS server. If the server is up, it is marked as passed. If you configure a Network Access Server (NAS) address, the ACE uses it in the outgoing packet. Otherwise, the ACE uses the IP address associated with the outgoing interface as the NAS address.

You can create the RADIUS probe and access its configuration mode by using the probe radius command. The syntax of this command is as follows:

probe radius name

For the name argument, enter the identifier of the RADIUS probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

For example, to define a RADIUS probe named PROBE and access its mode, enter:

host1/Admin(config)# probe radius PROBE

host1/Admin(config-probe-radius)#

To configure probe attributes for a RADIUS probe, see the following topics:

•Configuring the Credentials and Shared Secret for a Probe

•Configuring the Network Access Server IP Address

You can also configure the general attributes described in the "Configuring General Probe Attributes" section.

Configuring the Credentials and Shared Secret for a Probe

The credentials for a probe are the username and password used for authentication on the server and an optional shared secret to allow probe access to the RADIUS server. You can configure the credentials for the probe by using the credentials command. The syntax of this command is as follows:

credentials username password [secret shared_secret]

The arguments are as follows:

•username—User identifier used for authentication. Enter an unquoted text string with a maximum of 64 alphanumeric characters.

•password—Password used for authentication. Enter an unquoted text string with a maximum of 64 alphanumeric characters.

•secret shared_secret—(Optional) Specifies the shared secret. Enter the shared secret as a case-sensitive string with no spaces and a maximum of 64 alphanumeric characters.

For example, to configure the username ENG1 and a password TEST, enter:

host1/Admin(config-probe-radius)# credentials ENG1 TEST

To delete the credentials for the probe, use the no credentials command. For example, enter:

host1/Admin(config-probe-radius)# no credentials

Configuring the Network Access Server IP Address

If a Network Access Server (NAS) address is not configured for the RADIUS probe, the ACE uses the IP address associated with the outgoing interface as the NAS address. You can configure an NAS address by using the nas ip address command. The syntax of this command is as follows:

nas ip address ip_address

The ip_address argument is the NAS IP address. Enter a unique IPv4 address in dotted-decimal notation (for example, 192.8.12.15).

For example, to configure a NAS address of 192.8.12.15, enter:

host1/Admin(config-probe-radius)# nas ip address 192.8.12.15

To remove the NAS IP address, use the no nas ip address command. For example, enter:

host1/Admin(config-probe-radius)# no nas ip address 

Configuring Scripted Probes

Scripted probes allow you to run a script to execute the probe that you created for health monitoring. In this way, you can author specific scripts with features not present in standard health probes. To configure a scripted probe, you need to do the following:

•Copy the script file to the ACE disk0: file system

•Load the script file

•Associate the script to the scripted probe

The ACE allows the configuration of 256 unique script files. For information on copying and loading a script file on the ACE, see Appendix A, Using Toolkit Command Language (TCL) Scripts with the ACE.

You can create a scripted probe and access the scripted probe configuration mode by using the probe scripted command. The syntax of this command is as follows:

probe scripted name

For the name argument, enter the identifier of the scripted probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

---

Note The ACE can simultaneously execute only 200 scripted probe instances. When this limit is exceeded, the show probe detail command displays the "Out-of Resource: Max. script-instance limit reached" error message in the Last disconnect err field and the out-of-sockets counter increments.

---

For example, to define a scripted probe named PROBE19 and access its mode, enter:

host1/Admin(config)# probe scripted PROBE19

host1/Admin(config-probe-scrptd)#

To configure the scripted probe attributes, see the "Associating a Script with a Probe" section.

You can also configure the general commands described in the "Configuring General Probe Attributes" section.

Associating a Script with a Probe

Scripted probes run probes from a configured script to perform health probing. You can also configure arguments that are passed to the script. Before you can associate a script file with a probe, you must copy and load the script on the ACE. For information on copying and loading a script, see Appendix A, Using Toolkit Command Language (TCL) Scripts with the ACE.

You can specify the name of the script file and the arguments to be passed to the script by using the script command. The syntax of this command is as follows:

script script_name [script_arguments]

The arguments are as follows:

•script_name—Name of the script. Enter an unquoted text string with no spaces and a maximum of 255 alphanumeric characters.

•script_arguments—(Optional) Data sent to the script. Enter a text string with a maximum of 255 alphanumeric characters including spaces and quotes. Separate each argument by a space. If a single argument contains spaces, enclose the argument string in quotes.

For example, to configure the script name of PROBE-SCRIPT and arguments of ??, enter:

host1/Admin(config-probe-scrptd)# script PROBE-SCRIPT ??

To remove the script and its arguments from the configuration, use the no script command. For example, enter:

host1/Admin(config-probe-scrptd)# no script

Example of a UDP Probe Load-Balancing Configuration

The following example illustrates a running configuration that load balances DNS traffic across multiple real servers, and transmits and receives UDP data that spans multiple packets. The configuration uses a UDP health probe. The UDP probe configuration appears in bold in the example.

access-list ACL1 line 10 extended permit ip any any

probe udp UDP

  interval 5

  passdetect interval 10

  description THIS PROBE IS INTENDED FOR LOAD BALANCING DNS TRAFFIC

  port 53

  send-data UDP_TEST

rserver host SERVER1

  ip address 192.168.252.245

  inservice

rserver host SERVER2

  ip address 192.168.252.246

  inservice

rserver host SERVER3

  ip address 192.168.252.247

  inservice

serverfarm host SFARM1

  probe UDP

  rserver SERVER1

    inservice

  rserver SERVER2

    inservice

  rserver SERVER3

    inservice

class-map match-all L4UDP-VIP_114:UDP_CLASS

   2 match virtual-address 192.168.120.114 udp eq 53

policy-map type loadbalance first-match L7PLBSF_UDP_POLICY

  class class-default

    serverfarm SFARM1

policy-map multi-match L4SH-Gold-VIPs_POLICY

    class L4UDP-VIP_114:UDP_CLASS

    loadbalance vip inservice

    loadbalance policy L7PLBSF_UDP_POLICY

    loadbalance vip icmp-reply

    nat dynamic 1 vlan 120

    connection advanced-options 1SECOND-IDLE

interface vlan 120

  description Upstream VLAN_120 - Clients and VIPs

  ip address 192.168.120.1 255.255.255.0

  fragment chain 20

  fragment min-mtu 68

  access-group input ACL1

  nat-pool 1 192.168.120.70 192.168.120.70 netmask 255.255.255.0 pat

  service-policy input L4SH-Gold-VIPs_POLICY

  no shutdown

ip route 10.1.0.0 255.255.255.0 192.168.120.254

Displaying Probe Information

You can display configuration information and statistics for a probe by using the show probe command in Exec mode. The syntax of this command is as follows:

show probe [probe_name] [detail]

The argument and option are as follows:

•probe_name—(Optional) Information for the specified probe name.

•detail—(Optional) Displays detailed probe configuration and statistic information.

If you do not enter a probe name, this command shows a summary of information for all configured probes. For example, enter:

host1/Admin# show probe

You can also display configuration information for all probes by using the show running-config probe command.

For example, enter:

host1/Admin# show running-config probe

Table 4-2 describes the fields in the show probe command output including additional output provided by the detail option.

Table 4-2 Field Descriptions for the show probe Command 

Field	Description
Probe	Name of the probe.
Type	Probe type.
State	Whether the probe is active or inactive.
Description	Configured description for the probe (detail option output).
Port	Port number that the probe uses. By default, the probe uses the port number based on its type.
Address	Destination address for the probe.
Addr type	Address type.
Interval	Time interval in seconds that the ACE sends probes to a server marked as passed.
Pass intvl	Time period in seconds to send a probe to a failed server.
Pass count	Consecutive number of passed probes before marking the server as passed.
Fail count	Consecutive number of failed probes before marking the server as failed.
Recv timeout	Time period in seconds to receive a server response to the probe.
DNS domain	Domain name configured for the probe (detail option output for a DNS probe).
HTTP method	HTTP method and URL used by the probe, GET or HEAD (detail option output for HTTP and HTTPS probes).
HTTP URL	URL used by the probe with the HTTP method (detail option output for HTTP and HTTPS probes).
IMAP mailbox	Mailbox username where the probe retrieves e-mail (detail option output for IMAP probes).
IMAP/POP command	Request method command for the probe (detail option output for IMAP and POP probes).
NAS address	Network Access Server (NAS) address for the RADIUS server (detail option output for RADIUS probes).
Script filename	Filename for the script (detail option output for scripted probes).
Conn termination	TCP connection termination type, GRACEFUL or FORCED (detail option output for ECHO TCP, Finger, FTP, HTTP, HTTPS, IMAP, POP, SMTP, TCP, and Telnet probes).
Expect offset	Number of characters into the received message or buffer to start searching for the expect regex expression (detail option output for HTTP, HTTPS, TCP, and UDP probes).
Expect regex	Configured expected response data from the probe destination (detail option output for HTTP, HTTPS, TCP, and UDP probes).
Open timeout	Time interval in seconds that the probe waits to open and establish the connection with the server (detail option output for Finger, FTP, HTTP, HTTPS, IMAP, POP, scripted, SMTP, TCP, and Telnet probe).
Send data	ASCII data that the probe sends (detail option output for ECHO, Finger, TCP, and UDP probes).
probe results
probe association	Real server association for the probe.
probed-address	Destination or source address for the probe.
probes	Total number of probes.
failed	Total number of failed probes.
passed	Total number of passed probes.
health	Health of the probe. Possible values are PASSED or FAILED.
Additional detail option output for scripted probes:
Socket state	Socket state.
No. Passed states	Number of passed states.
No. Failed states	Number of failed states.
No. Probes skipped	Number of skipped probes. A skipped probe occurs when the ACE does not send out a probe because the scheduled interval to send a probe is shorter than it takes to complete the execution of the probe; mainly due to the send interval being shorter than the open timeout or receive timeout interval.
Last status code	Last exit code (see Table A-7).
Last disconnect err	Message for the exit code for a scripted probe (see Table A-7) or an internal error.
Last probe time	Time stamp for the last probe.
Last fail time	Time stamp for the last failed probe.
Last active time	Time stamp for the last active time.
Internal error	Counter for the number of internal errors encountered.

Table 4-3 list the possible disconnect errors that can appear in the show probe output. For a list of disconnect messages for scripted probes, see Table A-7.

Table 4-3 ACE Probe Disconnect Errors 

Probe Type	Error Message
All probe types	Unrecognized or invalid probe request.
	Connect error.
	Connection reset by server.
	Connection refused by server.
	Authentication failed.
	Unrecognized or invalid response.
	Out of memory, packets discarded.
	Server open timeout (no SYN ACK).
	Server reply timeout (no reply).
	Graceful disconnect timeout (no FIN ACK).
	Received Out-Of-Band data.
	User defined Reg-Exp was not found in host response.
	Expect status code mismatch.
	Received invalid status code.
ICMP	ICMP Internal error.
	ICMP Internal error: Write failure.
	ICMP Internal error: Received bad FD.
	Host Unreachable, no route found to destination.
	ARP not resolved for dest-ip (destination IP address).
	Network down.
	Egress interface has no ip addr (IP address).
	ICMP Internal error: Data entry being modified.
	ICMP Internal error: No space, transmit path is full.
	ICMP Host unreachable.
	ICMP Dest unreachable.
	ICMP Time exceeded.
	ICMP Redirect.
	Received ICMP Echo Request.
	Received ICMP Stale pkt.
	Unexpected ICMP pkt type received.
	ICMP Pkt received is too short.
	ICMP Pkt received is too long.
HTTP/HTTPS	MD5 mismatch.
HTTPS	Failed to create SSL context.
	Internal error: Failed to create SSL session.
	Invalid server greeting.
	Internal error: Failed to build a server query.

To display the global statistics for a probe type, use the show stats probe type command in Exec mode. The syntax of this command is as follows:

show stats probe type probe_type

To view a list of probe types, enter:

host1/Admin# show stats probe type ?

For example, to view the global statistics for all DNS probes, enter:

host1/Admin# show stats probe type dns

Table 4-4 describes the fields in the show stats probe type command output.

Table 4-4 Field Descriptions for the show stats probe type command 

Field	Description
Total probes sent	Total number of probes sent.
Total send failures	Total number of send failures. These failures are due to internal errors.
Total probes passed	Total number of passed probes.
Total probes failed	Total number of failed probes.
Total connect errors	Total number of connection errors.
Total conns refused	Total number of connections refused.
Total RST received	Total number of resets received.
Total open timeouts	Total number of open timeouts for the specified probe type.
Total receive timeouts	Total number of timeouts received.

Clearing Probe Statistics

This section describes the commands that you use to clear probe statistics, either for individual probes or for all probes in a context. It contains the following topics:

•Clearing Statistics for Individual Probes

•Clearing All Probe Statistics in a Context

Clearing Statistics for Individual Probes

You can clear the statistics displayed through the show probe command for a specific probe by using the clear probe command in Exec mode. The syntax of this command is as follows:

clear probe name

The name argument is the name of a configured probe.

For example, to clear the statistics for the DNS1 probe, enter:

host1/Admin# clear probe DNS1

---

Note If you have redundancy configured, then you need to explicitly clear load-balancing statistics on both the active and the standby ACEs. Clearing statistics on the active appliance only will leave the standby appliance's statistics at the old values.

---

Clearing All Probe Statistics in a Context

You can clear all probe statistics in the current context by using the clear stats probe command in Exec mode. The syntax of this command is as follows:

clear stats probe

For example, enter:

host1/Admin# clear stats probe

---

Note If you have redundancy configured, then you need to explicitly clear load-balancing statistics on both the active and the standby ACEs. Clearing statistics on the active appliance only will leave the standby appliance's statistics at the old values.

---

Where to Go Next

To learn how to use the Toolkit Command Language (TCL) to write probe scripts, see Appendix A, Using Toolkit Command Language (TCL) Scripts with the ACE. To configure stickiness (session persistence), see Chapter 5, Configuring Stickiness. To configure firewall load balancing (FWLB), see Chapter 6, Configuring Firewall Load Balancing