Table Of Contents

A - B - C - D - E - F - G - H - I - K - L - M - N - O - P - R - S - T - U - V - W -

Index

A

acceleration

configuring 5-57

configuring globally on ACE 13-9

overview 13-2

traffic policies 13-2

typical configuration flow 13-2

access control, configuring on VLAN interfaces 10-18

account password 1-6

accounts

see also users

user, managing 15-7

ACE

class map

match conditions 12-9

license

details 4-33

parameter maps 8-1

policy map

configuring 12-34

rules and actions 12-36

traffic policies 12-2

viewing license details 4-33

ACE appliance

licenses

configuration 4-33

importing 4-29

managing 4-27

removing 4-32

statistics 4-33

updating 4-31

viewing 4-28

parameter maps 8-1

policy maps 12-34

traffic policies 12-2

ACE Appliance Device Manager

button descriptions

in monitor screens 1-16

in tables 1-11

icon descriptions

in monitor screens 1-16

in tables 1-11

inoperative GUI, verifying 16-10

logging in 1-4

overview 1-6

password, changing 1-6

reloading 16-10

table

buttons 1-16

conventions 1-12

customizing 1-14

icons 1-16

terminology 1-22

verifying GUI operational status 16-10

ACE appliance server

configuring attributes 15-36

polling, enabling 15-36

statistics 15-35

ACE license

details 4-33

ACE network topology

overview 3-9

ACE No Payload Encryption (NPE) software version 1-2

ACE Payload Encryption (PE) software version 1-2

ACL

configuration overview 4-53

configuring

EtherType attributes 4-63

extended ACL attributes 4-57

for VLANs 10-18

object groups 4-66

definition GL-1

deleting 4-65

objects

ICMP service parameters 4-72

IP addresses 4-67

protocols 4-68

subnet objects 4-68

TCP/UDP service parameters 4-69

resequencing 4-62

viewing by context 4-64

ACL object group

configuring 4-66

network objects

IP addresses 4-67

subnet objects 4-68

service objects

ICMP service parameters 4-72

protocols 4-68

TCP/UDP service parameters 4-69

action, setting for policy maps 12-36

action list

application acceleration, configuring 13-3

configuration overview 12-89

header insertion, rewrite, and deletion 12-90

HTTP header modify, configuring 12-89

optimization configuration options 5-60, 13-4

SSL header insert 12-95

SSL URL rewrite 12-93

activate

definition GL-1

real servers 6-10

virtual servers 5-64

adding

domain objects 15-35

domains 15-33

new users 15-8

resource classes 4-37

roles 15-28

SSL

parameter map cipher info 9-21

admin

changing passwords 15-13

logging in for the first time 1-4

menu options 15-2

Admin context, first virtual context 4-2

administrative distance, definition GL-1

Admin user, add to context 4-6

advanced editing mode 1-14

AES, definition GL-1

alias IP address

assigning to a VLAN 1-21

all-match policy map 12-34

All Virtual Contexts table 4-80

ANM

homepage 2-1, 2-2

application acceleration

configuring 5-57

configuring globally on ACE 13-9

monitoring 14-29

overview 13-2

traffic policies 13-2

typical configuration flow 13-2

application protocol inspection

ILS 12-7

limitations 12-6

NAT and PAT support 12-6

SCCP 12-7

SIP 12-7

standards 12-6

supported protocols 12-6

archive

directory structure and filenames 4-46

naming convention of context files 4-45

overview of configuration 4-45

ARP

definition GL-1

attributes

BVI interfaces 10-23

DNS probes 6-47

Echo-TCP probes 6-47

Finger probes 6-48

for sticky group types 7-16

FTP probes 6-49

health monitoring 6-43

high availability 11-9

HTTP content sticky group 7-16

HTTP cookie sticky group 7-17

HTTP header sticky group 7-18

HTTP parameter maps 8-2

HTTP probes 6-49

HTTPS probes 6-52

IMAP probes 6-54

IP netmask sticky group 7-18

Layer 3/Layer 4 management class map match conditions 12-15

Layer 4 payload sticky group 7-19

parameter map

connection 8-5

DNS 8-24, 8-25

generic 8-18

optimization 8-11

RTSP 8-19

SIP 8-20

Skinny 8-22

POP probes 6-54

predictor method 5-45, 6-29

RADIUS

sticky groups 7-20

RADIUS probes 6-55

real servers 6-6

resource classes 4-35

RTSP

header sticky groups 7-20

probes 6-56

scripted probes 6-57

server farms 5-37, 6-19

SIP-TCP probes 6-58

SIP-UDP probes 6-59

SMTP probes 6-60

SNMP 4-19

SNMP probes 6-60

SSL

certificate bulk import 9-10

certificate export 9-17

certificate import 9-9

key export 9-18

key pair bulk import 9-14

key pair import 9-13

parameter map cipher info 9-21

sticky groups 7-20

SSL initiation

for virtual servers 5-53

SSL termination

for virtual servers 5-19

sticky group 7-12

TCP probes 6-61

Telnet probes 6-61

UDP probes 6-62

virtual contexts 4-11

virtual servers 5-8

VLAN interfaces 10-10

VM probes 6-63

audience, intended iii-xv

auth group certificate, configuring for SSL 9-31

auto-synchronization of contexts 4-76

B

backup

archive directory structure and filenames 4-46

configuring device configuration 4-48

defaults 4-47

guidelines and limitations of 4-46

overview of configuration 4-45

bandwidth optimization, configuring 5-58

buddy sticky group 7-6

bulk import

SSL certificate attributes 9-10

SSL key pair attributes 9-14

button descriptions

common buttons 1-9

in monitor screens 1-16

in tables 1-11

BVI, definition GL-1

BVI interfaces

attributes 10-23

configuring 10-23

secondary IP groups for 10-24

viewing by context 10-30

C

caution, when allocating resources 4-37

certificate

exporting for SSL 9-16

importing for SSL 9-8

overview of SSL 9-6

certificate chain, definition GL-1

certificate signing request (CSR), definition GL-2

chain group certificate, configuring for SSL 9-24

chain group parameters, configuring for SSL 9-24

changeto command 15-15

changing

account password 1-6

admin password 15-13

login password 1-6

role rules 15-31

user passwords 15-13

checkpoint, configuration

comparing with running configuration 4-44

creating 4-41

deleting 4-43

displaying 4-44

rolling back to 4-43

Cisco

security guidelines iii-xix

What's New iii-xix

class map

ACE device support 12-9

configuring 12-8

definition GL-2

deleting 12-8, 12-10

match conditions

for deep packet inspection 12-25

for FTP command inspection 12-30

for Layer 7 load balancing 12-16

for management traffic 12-14

for network traffic 12-11

generic server load balancing 12-19

Layer 7 SIP deep packet inspection 12-31

RADIUS server load balancing 12-20

RTSP server load balancing 12-21

SIP server load balancing 12-23

match types 12-11, 12-14, 12-16, 12-25, 12-30

overview 5-1, 6-1, 12-2, 12-3

setting match conditions 12-10

use with real servers 6-3

virtual-address match type attributes 12-11

command inspection class maps, setting match conditions 12-30

configuration

auto-synchronizing 4-76

backup of 4-48

CLI synchronization status 4-76

high-level flow 1-18

overview 1-18

restore of 4-50

synchronizing

for high availability 11-6

virtual context 4-75

task overview 1-18

viewing status 4-76

configuration attributes

extended ACL 4-57

health monitoring 6-43

high availability 11-9

HTTP return code maps 6-36

parameter map

connection 8-5

DNS 8-24, 8-25

generic 8-18

HTTP 8-2

optimization 8-11

RTSP 8-19

SIP 8-20

Skinny 8-22

predictor method 5-45, 6-29

probe

DNS 6-47

Echo-TCP 6-47

Finger 6-48

FTP 6-49

HTTP 6-49

HTTPS 6-52

IMAP 6-54

POP 6-54

RADIUS 6-55

RTSP 6-56

scripted 6-57

SIP-TCP 6-58

SIP-UDP 6-59

SMTP 6-60

SNMP 6-60

TCP 6-61

Telnet 6-61

UDP 6-62

VM 6-63

real server 6-6

server farm 5-37, 6-19

SNMP users 4-22

SSL initiation 5-53

SSL termination 5-19

sticky group 7-12

sticky type 5-50

syslog 4-13

virtual context system options 4-11

virtual server 5-8

configuration checkpoint and rollback service

comparing checkpoint with running configuration 4-44

creating configuration checkpoint 4-41

deleting configuration checkpoint 4-43

displaying checkpoint information 4-44

overview 4-41

rolling back configuration 4-43

configuration synchronization for redundancy 11-5

configuring

acceleration 5-57

ACLs 4-54, 10-19

EtherType 4-63

extended 4-57

object groups 4-66

resequencing 4-62

action lists for application acceleration 13-3

action lists for HTTP header modify 12-89

bandwidth optimization 5-58

BVI interfaces 10-23

class map match conditions

generic server load balancing 12-19

Layer 7 SIP deep packet inspection 12-31

RADIUS server load balancing 12-20

RTSP server load balancing 12-21

SIP server load balancing 12-23

class maps 12-8, 12-11

DHCP relay 10-19

DNS probe expect address 6-64

gigabit Ethernet interfaces 10-5

health monitoring general attributes 6-43

high availability

groups 11-11, 11-14

host tracking 11-20

interface tracking 11-19

peer host probes 11-22

peers 11-8

synchronization 11-5

tracking and failure detection 11-17

host probes for high availability 11-21

HTTP probe headers 6-64

HTTP retcode maps 6-35

HTTPS probe headers 6-64

latency optimization 5-58

Layer 7 default load balancing 5-55

load balancing

for server farms 6-18

on virtual servers 5-30

sticky groups 7-11

management VLAN 4-2

NAT 5-61, 10-31

object groups

ICMP service parameters 4-72

IP addresses 4-67

protocols 4-68

subnet objects 4-68

TCP/UDP service parameters 4-69

OID for SNMP probes 6-66

optimization 5-57

action lists 5-60

traffic policies 13-6

parameter maps

connection 8-5

DNS 8-23

generic 8-17

HTTP 8-2

optimization 8-11, 13-6

RDP 8-24

RTSP 8-19

SIP 8-20

Skinny 8-22

PAT 10-32

policy map rules and actions 12-36

generic server load balancing 12-53

HTTPS server load balancing 12-57

Layer 3/Layer 4 management traffic policy maps 12-45

Layer 3/Layer 4 network traffic policy maps 12-37

Layer 7 deep packet inspection policy maps 12-72

Layer 7 FTP command inspection policy maps 12-78

Layer 7 HTTP optimization policy maps 12-85

Layer 7 server load-balancing traffic policy maps 12-46

Layer 7 SIP deep packet inspection 12-81

Layer 7 Skinny deep packet inspection 12-83

RADIUS server load balancing 12-62

RDP server load balancing 12-70

RTSP server load balancing 12-64

SIP server load balancing 12-67

port channel interfaces 10-2

probe expect status 6-65

protocol inspection 5-20

real servers 6-11

resource classes 4-37

server farm predictor method 6-28

shared objects 5-10

SNMP 4-19

communities 4-20

notification 4-25

on virtual contexts 4-19

trap destination hosts 4-23

users 4-21

SSL

chain group parameters 9-24

CSR parameters 9-25

for virtual servers 5-18

OCSP service 9-29

parameter map 9-19

parameter map cipher attributes 9-21

proxy service 9-27

static routes 10-33

sticky groups 5-50, 7-11

sticky statics 7-21

switch mode 4-6

syslog

logging 4-12

log hosts 4-16

log messages 4-17

log rate limits 4-18

traffic policies 12-1

virtual context 4-1, 4-2, 4-7, 4-80

expert options 4-75

global policies 4-26

policy maps 12-34

primary attributes 4-11

system attributes 4-11

virtual server

configuration overview 5-2

default Layer 7 load balancing 5-55

Layer 7 load balancing 5-30

NAT 5-61

properties 5-10

protocol inspection 5-20

shared objects 5-9

SSL termination service 5-18

VLAN

interface access control 10-18

interface policy maps 10-18

interfaces 10-10

connection parameter map

attributes 8-5

configuring 8-5

TCP options 8-9

using 8-1

contact information, SNMP 4-19

context

archive naming convention for archive 4-45

auto-synchronization of CLI configuration changes 4-76

CLI synchronization state 4-76

configuration options 4-8

configuring 4-7

BVI interfaces 10-23

global policies 4-26

load balancing 5-1

primary attributes 4-11

static routes 10-33

virtual servers 5-1

VLAN interfaces 10-10

creating 4-2

definition GL-6

deleting 4-80

editing 4-80

modifying 4-80

synchronizing configurations, automatic 4-76

synchronizing configurations, manual 4-78

viewing all 4-80

control 10-18

controlling access to CiscoACE appliance 15-3

conventions

in ACE Appliance Device Manager, table 1-12

in this guide iii-xix

radio buttons, dropdown lists 4-7

cookie

client 7-3

sticky client identification 7-3

copying

ACE licenses 4-29

CPU

monitoring ACE usage of 15-36

creating

ACLs 4-54

diagnostic packages 16-1

domains 15-33

user accounts 15-8

user roles 15-28

virtual contexts 4-2

CSR

configuring parameters 9-25

definition GL-2

generating for SSL 9-26

D

Data Center Interconnect (DCI)

VM controller configuration 6-16

Data Encryption Standard (DES), definition GL-2

deep packet inspection

class maps 12-25

policy map options 12-43

SIP

class map match conditions 12-31

policy map rules and actions 12-81

Skinny policy map rules and actions 12-83

default user 15-5

deleting

ACLs 4-65

active users 15-12

class map in use 12-8

domain objects 15-35

domains 15-34

files off the ACE 16-9

high availability groups 11-17

host probes for high availability 11-22

Lifeline packages 16-4

peer host probes 11-23

resource classes 4-40

role rules 15-31

SSL objects 9-2

user accounts 15-10

user roles 15-30

virtual contexts 4-80

DES, definition GL-2

device

using ping 14-36

device management, monitoring 15-2

DFP, definition GL-2

DHCP relay, configuring 10-19

diagnostic tools

file browser 16-6

disk usage, monitoring ACE 15-36

displaying

current user sessions 15-11

list of users 15-8

network domains 15-32

user roles 15-27, 15-28

users who have a selected role 15-28

distinguished name, definition GL-2

DNS

application protocol support 12-6

configuring protocol inspection 5-20

parameter map

attributes 8-24, 8-25

configuring 8-23

DNS probe

attributes 6-47

expect address 6-64

document

intended audience iii-xv

organization iii-xv

documentation

obtaining iii-xix

related iii-xvii

domains

attributes 15-33

creating 15-33

deleting 15-34

displaying 15-32

editing 15-34

guidelines 15-31

managing 15-31

understanding 15-7

downloading, files to ACE 16-7

Dynamic Feedback Protocol (DFP), definition GL-2

Dynamic Workload Scaling

configure

Nexus 7000 6-15

overview 6-14

server farm 5-39, 6-21

E

Echo-TCP probe attributes 6-47

e-commerce

applications, sticky requirements 7-1

using stickiness 7-4

editing

domains 15-34

role rules 15-31

user account info 15-10

user roles 15-30

encryption, password 15-9

error

monitoring, list of polling messages 14-15

Ethernet interfaces, configuring 10-5

EtherType ACL, configuring 4-63

event, definition GL-2

event type, definition GL-2

exception, definition GL-2

expert options for virtual contexts 4-75

exporting

SSL

certificates 9-16

key pair 9-18

extended ACL

configuration options 4-57

resequencing entries 4-62

F

fail action

real server in a server farm 5-37, 6-19

reassign 5-38, 6-20

failover 11-4

fault, definition GL-2

fault tolerance

groups 11-3

task overview 11-8

file browser

deleting files 16-9

downloading files 16-7

renaming files 16-8

tasks 16-6

uploading files 16-7

viewing files 16-9

File Transfer Protocol (FTP), definition GL-2

filtering tables 1-13

Finger probe attributes 6-48

first-match policy map 12-34

forcing logouts 15-12

FTP

application protocol support 12-6

configuring protocol inspection 5-21

definition GL-2

FTP command inspection class map match conditions 12-30

FTP probe attributes 6-49

FTP strict, and RFP standards 12-78

FT VLAN 11-5

G

gateway, default 4-3

generic parameter map

attributes 8-18

configuring 8-17

generic server load balancing

class map match conditions 12-19

policy map rules and actions 12-53

getting started

flowchart 1-18

task overview 1-18

global acceleration and optimization 13-9

global policies, configuring for virtual contexts 4-26

GMT 1-16

graph

icons for 1-16

maximum number of statistics 1-16

viewing results 1-16

graphs

using GMT 1-16

graphs, historical trend and real time 14-31

guided setup

ACE hardware setup 3-3

ACE network topology overview 3-9

application setup 3-10

operating considerations 3-3

overview 3-1

tasks and related topics 3-2

virtual context setup 3-7

guidelines

Lifeline 16-2

guidelines for managing

domains 15-31

user accounts 15-8

user roles 15-14

H

hash load-balancing methods

address 6-2

cookie 6-2

header 6-2

url 6-2

header

insertion 12-47

rewrite 12-47

header insertion

configuring HTTP 12-90

HTTP 12-90

SSL 12-95

health monitoring

configuring 6-39

for real servers 6-40

general attributes 6-43

inband 5-40, 6-22

overview 6-38

probe types 6-41

TCL scripts 6-39

heartbeat packets 11-3

high availability

clearing

links between ACE appliances 11-11

pairs 11-11

configuration attributes 11-9

configuring

groups 11-11

host probes 11-21

host tracking process 11-20

interface tracking process 11-19

overview 11-2

peer host probes 11-22

peers 11-8

deleting

groups 11-17

host probes 11-22

peer host probes 11-23

failover detection 11-17

importance of synchronizing configurations 11-6

modifying groups 11-14

protocol 11-3

switching over a group 11-16

task overview 11-8

tracking status 11-17

historical trend graph 14-31

homepage 2-1

link descriptions 2-1

overview 2-1

pages in ANM 2-2

Hot Standby Router Protocol (HSRP), definition GL-3

HSRP, definition GL-3

HTTP

application protocol support 12-6

configuring

parameter maps 8-2

retcode maps 6-35

content

sticky group attributes 7-16

sticky type 7-3

cookie

sticky group attributes 7-17

sticky type 7-3

header

sticky client identification 7-4

sticky group attributes 7-18

sticky type 7-4

parameter map attributes 8-2

parameter maps 8-1, 8-2

probe

return code map configuration options 6-36

probe attributes 6-49

HTTP compression, enabling 5-52, 5-56

HTTP deep packet inspection class map match conditions 12-25

HTTP header

configuring 12-90

deletion 12-90

insertion 12-47, 12-90

rewrite 12-47, 12-90

HTTP optimization action list, configuring 13-3

HTTP optimization policy map rules 12-86

HTTP probe, configuring headers 6-64

HTTP protocol inspection

class map match conditions 12-26

conditions and options 5-23

policy map rules 12-73

HTTPS probe

attributes 6-52

configuring headers 6-64

HTTPS protocol inspection conditions and options 5-23

HTTPS server load balancing

policy map rules and actions 12-57

I

ICMP

application protocol support 12-6, 12-7

definition GL-3

ICMP service parameters, for object groups 4-72

icon descriptions

in monitor screens 1-16

in tables 1-11

IETF trap

SNMP 4-20

ILS inspection 12-7

IMAP probe attributes 6-54

importing

ACE licenses 4-29

SSL

certificates 9-8

key pair 9-12

inband health monitoring 5-40, 6-22

connection failure count 5-40, 6-22

reset timeout 5-40, 6-22

resume service 5-41, 6-23

installing ACE appliance licenses 4-29

intended audience of this document iii-xv

interface

ACE Appliance Device Manager 1-6

definition GL-3

gigabit Ethernet, configuring 10-5

Internet Control Message Protocol (ICMP), definition GL-3

IP addresses, for object groups 4-67

IP netmask

for sticky client identification 7-4

sticky group attributes 7-18

sticky type 7-4

IPv6 considerations 1-20

IPv6 prefix

for sticky client identification 7-4

sticky type 7-4

K

KAL-AP

configuring secure 6-68

primary server farm out of service 5-15, 12-41

key pair

exporting for SSL 9-18

generating 9-15

importing for SSL 9-12

SSL 9-11

L

latency optimization, configuring 5-58

Layer 3/Layer 4

management traffic

class map match conditions 12-14

policy map rules and actions 12-45

network traffic class maps, setting match conditions 12-11

network traffic policy maps

setting rules and actions 12-37

Layer 4 payload

sticky group attributes 7-19

sticky type 7-4

Layer 7

configuring load balancing for HTTP/HTTPS 5-30

default load balancing on virtual servers 5-55

FTP command inspection class maps, setting match conditions 12-30

FTP command inspection policy maps, setting rules and actions 12-78

HTTP deep packet inspection class maps, setting match conditions 12-25

HTTP deep packet inspection policy maps, setting rules and actions 12-72

HTTP optimization policy maps, setting rules and actions 12-85

load balancing

rule types 5-32

setting match conditions 5-31

load-balancing class maps, setting match conditions 12-16

load-balancing policy maps, setting rules and actions 12-46

SIP deep packet inspection

class map match conditions 12-31

policy map rules and actions 12-81

Skinny deep packet inspection policy map rules and actions 12-83

SLB policy actions

HTTP header insertion 12-47

least bandwidth, load-balancing method 6-3

leastconns, load-balancing method 6-3

least loaded, load-balancing method 6-3

license

viewing ACE license details 4-33

licenses

importing 4-29

installing 4-29

managing for ACE appliances 4-27

removing 4-32

updating 4-31

Lifeline

creating a package from the CLI 16-5

creating a package from the DM GUI 16-3

deleting packages 16-4

downloading a package 16-3

guidelines for use 16-2

maximum packages 16-2

load balancing

configuration overview 5-1

configuring

for real servers 6-5

for server farms 6-18

on virtual servers 5-30

real servers 6-1

server farms 6-1

sticky groups 7-11

with virtual servers 5-2

definition GL-3

hash address 6-2

hash cookie 6-2

hash header 6-2

hash secondary cookie 6-2

hash url 6-2

Layer 7 5-30

least bandwidth 6-3

leastconns 6-3

least loaded 6-3

monitoring on probes 14-27

monitoring on real servers 14-25

monitoring on statistics 14-28

monitoring on virtual servers 14-23

predictors 6-2

response 6-3

roundrobin 6-3

load-balancing class maps

Layer 7 12-16

setting match conditions 12-16

location, SNMP 4-19

logging

SIP packets syslog 8-20

syslog levels 4-12

logging into ACE Appliance Device Manager 1-4

M

Management Information Base (MIB), definition GL-3

management VLAN, adding 4-2

managing

domains 15-31

real servers 6-9

resource classes 4-34

user accounts 15-7

user roles 15-14

virtual contexts 4-75

virtual servers 5-63

match condition

class map

generic server load balancing 12-19

Layer 7 SIP deep packet inspection 12-31

RADIUS server load balancing 12-20

RTSP server load balancing 12-21

setting for 12-10

SIP server load balancing 12-23

match conditions

configuring for class maps 12-11

for Layer 7 load balancing 5-31

for optimization 5-59

for optimization policy maps 12-86

HTTP optimization 12-86

HTTP protocol inspection 12-26, 12-73

Layer 7 load-balancing class maps 12-16

Layer 7 load-balancing traffic policy maps 12-47

network management class maps 12-14

MD5, definition GL-3

memory usage, monitoring ACE 15-36

menus, understanding 1-8

Message Digest 5 (MD5), definition GL-3

MIB, definition GL-3

MIME types, supported 8-25

modifying

domains 15-34

high availability groups 11-14

real servers 6-11

resource classes 4-39

user accounts 15-10

user roles 15-30

virtual contexts 4-80

monitoring

buttons used in graphs 1-16

load balancing 14-23, 14-25, 14-27

load balancing statistics 14-28

prerequisites 14-1

statistics 15-35

traffic 14-21

viewing results, description 1-16

multi-match policy map 12-34

N

Name Address Translation

configuring 10-31

definition GL-3

NAT

application protocol inspection support 12-6

configuring 10-31

configuring on virtual servers 5-61

definition GL-3

network management traffic

class map match conditions 12-14

policy maps, configuring rules and actions 12-45

network object group

configuring 4-66

IP addresses 4-67

subnet objects 4-68

network topology maps 14-34

No Payload Encryption (NPE) software version 1-2

O

object

configuring for virtual servers 5-9

definition GL-4

object group

configuring 4-66

ICMP service parameters 4-72

IP addresses 4-67

protocols 4-68

subnet objects 4-68

TCP/UDP service parameters 4-69

obtaining

documentation iii-xix

support iii-xix

OCSP service, configuring for SSL 9-29

operational states of real servers 6-12

operations privileges 15-6

optimization

configuration overview 13-6

configuring 5-57

action lists 5-60

globally on ACE 13-9

match conditions 5-59

parameter maps 8-11, 13-6

policy map rules and actions 12-85

traffic policies 13-6

functionality overview 13-2

match condition types 12-86

match criteria 5-59

overview 13-2

parameter maps 8-1

traffic policies 13-2

typical configuration flow 13-2

optimization parameter map attributes 8-11

organization of this document iii-xv

overview

ACL configuration 4-53

admin functions 15-1

application acceleration 13-2

class map 12-2

configuration 1-18

configuration tasks 1-18

load-balancing predictors 6-2

optimization 13-2

optimization traffic policies 13-6

parameter maps 8-1

policy map 12-2

protocol inspection 12-5

real server 6-3

resource classes 4-34

server farm 6-3, 6-5

server health monitoring 6-38

SSL 9-1

stickiness 7-1

sticky table 7-11

traffic policies 12-1

using SSL keys and certificates 9-4

virtual contexts 4-2

P

parameter expander functions 8-16

parameter map

ACE device support 8-1

attributes

connection 8-5

DNS 8-24, 8-25

generic 8-18

HTTP 8-2

optimization 8-11

RTSP 8-19

SIP 8-20

Skinny 8-22

configuring

connection 8-5

DNS 8-23

for SSL 9-19

generic 8-17

HTTP 8-2

optimization 8-11, 13-6

RDP 8-24

RTSP 8-19

SIP 8-20

Skinny 8-22

SSL cipher 9-21

overview 8-1

types of 8-1

using with

policy maps 8-1

using with Layer 3/Layer 4 policy maps 8-1, 12-5

viewing list of 8-27

parameter map redirect, configuring for SSL 9-21

parent rows, in screens and tables 1-12

password, encrypting user 15-9

passwords, changing

account 1-6

admin 15-13

in login screen 1-6

PAT

configuring 10-32

definition GL-4

Payload Encryption (PE) software version 1-2

peers, high availability 11-8

PEM, definition GL-4

ping

definition GL-4

testing 14-36

PKCS, definition GL-4

policy map 12-36

all-match 12-34

associating with VLAN interface 10-18

configuring

in virtual contexts 12-34

deep packet inspection options 12-43

first-match 12-34

Layer 3/Layer 4

management traffic, setting rules and actions 12-45

network traffic, setting rules and actions 12-37

Layer 7

FTP command inspection, setting rules and actions 12-78

HTTP deep packet inspection, setting rules and actions 12-72

HTTP optimization, setting rules and actions 12-85

Layer 7 load-balancing traffic

configuring rules and actions 12-46

match condition types 12-47

multi-match 12-34

overview 5-1, 6-1, 12-2, 12-4

rule and action topic reference 12-36

rules and actions

generic server load balancing 12-53

HTTPS server load balancing 12-57

Layer 7 SIP deep packet inspection 12-81

Layer 7 Skinny deep packet inspection 12-83

RADIUS server load balancing 12-62

RDP server load balancing 12-70

RTSP server load balancing 12-64

SIP server load balancing 12-67

setting rules and actions 12-36

polling

enabling 15-36

error states 14-15

failed 14-16

not polled error 14-16

timed out 14-16

unknown error 14-16

POP probe attributes 6-54

port

definition GL-4

number, configuring for probes 6-44

Port Address Translation

configuring 10-32

definition GL-4

port channel interfaces

attributes 10-3

configuring 10-2

predictor

hash address 6-2

hash cookie 6-2

hash header 6-2

hash secondary cookie 6-2

hash url 6-2

least bandwidth 6-3

leastconns 6-3

least loaded 6-3

response 6-3

roundrobin 6-3

predictor method

attributes 5-45, 6-29

configuring for server farms 6-28

prerequisites, monitoring 14-1

primary attributes for virtual contexts 4-11

privileges, understanding 15-6

probe

attribute tables 6-46

configuring expect status 6-65

configuring for health monitoring 6-40

configuring SNMP OIDs 6-66

DNS 6-47

Echo-TCP 6-47

Finger 6-48

FTP 6-49

HTTP 6-49

HTTPS 6-52

IMAP 6-54

POP 6-54

port number 6-44

RADIUS 6-55

RTSP 6-56

scripted 6-57

scripting using TCL 6-39

SIP-TCP 6-58

SIP-UDP 6-59

SMTP 6-60

SNMP 6-60

TCP 6-61

Telnet 6-61

types for real server monitoring 6-41

UDP 6-62

VM 6-63

process, for traffic classification 12-2

process uptime, monitoring ACE 15-36

protocol inspection

configuring for virtual servers 5-20

configuring match criteria 5-21

HTTP/HTTPS conditions and options 5-23

overview 12-5

SIP conditions and options 5-27

protocol names and numbers 4-60

protocols for object groups 4-68

proxy service, configuring for SSL 9-27

R

RADIUS

probe attributes 6-55

server load balancing

class map match conditions 12-20

policy map rules and actions 12-62

sticky group attributes 7-20

sticky type 7-5

RBAC, definition GL-4

RDP

parameter map

configuring 8-24

RDP server load balancing policy map rules and actions 12-70

real server

activating 6-10

adding to server farm 6-25

configuration attributes 6-6

configuring load balancing 6-1, 6-5

definition GL-4

health monitoring 6-38, 6-40

modifying 6-11

operational states 6-12

overview 6-3

suspending 6-10

viewing all 6-12

real time graph 14-31

Real Time Streaming Protocol (RTSP), definition GL-5

redundancy

configuration requirements 11-6

configuration synchronization 11-5

definition GL-5

FT VLAN 11-5

protocol 11-3

task overview 11-8

reloading the Device Manager GUI 16-10

removing

ACE appliance licenses 4-32

domains 15-34

rules from roles 15-31

renaming files on ACE 16-8

resource

allocation constraints 4-35

list of 14-18

resource class

adding 4-37

allocation constraints 4-35

attributes 4-35

configuring 4-37

definition GL-5

deleting 4-40

managing 4-34

modifying 4-39

overview 4-34

viewing use by contexts 4-40

resource usage, viewing 14-17

response load-balancing method 6-3

restore

configuring device configuration 4-50

defaults 4-47

guidelines and limitations of 4-46

overview of configuration 4-45

rewrite

HTTP header 12-90

SSL URL 12-93

role

definition GL-6

deleting 15-30

editing 15-30

options 15-9

understanding 15-5

role-based access control

containment overview 15-4

definition GL-4

users 15-7

roundrobin, load-balancing predictor 6-3

RSA, definition GL-5

RTSP

application protocol support 12-7

definition GL-5

header

sticky group attributes 7-20

sticky type 7-5

parameter map

attributes 8-19

configuring 8-19

probe attributes 6-56

server load balancing

class map match conditions 12-21

policy map rules and actions 12-64

rules

changing 15-31

setting for policy maps 12-36

S

SCCP inspection 12-7

screens, understanding 1-8

scripted probe

attributes 6-57

overview 6-39

secondary IP groups

BVI interfaces 10-24

VLAN interfaces 10-18

secure KAL-AP 6-68

security guidelines, Cisco iii-xix

server

activating

real 6-10

virtual 5-64

managing 6-9

suspending

real 6-10

virtual 5-65

server farm

adding real servers 6-25

configuration attributes 5-37, 6-19

configuring

HTTP return error-code checking 6-35

load balancing 6-1, 6-18

predictor method 6-28

definition GL-5

Dynamic Workload Scaling 5-39, 6-21

fail action for real server in 5-37, 6-19

fail action reassign across VLANs 5-38, 6-20

health monitoring 6-38

inband health monitoring 5-40, 6-22

overview 6-3, 6-5

predictor method attributes 5-45, 6-29

primary out of service to GSS 5-15, 12-41

sticky enabled on backup 7-15

viewing list of 6-37

Server Load Balancer (SLB), definition GL-5

server load balancing

generic class map match conditions 12-19

generic policy map rules and actions 12-53

HTTPS policy map rules and actions 12-57

RADIUS class map match conditions 12-20

RADIUS policy map rules and actions 12-62

RDP policy map rules and actions 12-70

RTSP class map match conditions 12-21

RTSP policy map rules and actions 12-64

SIP class map match conditions 12-23

SIP policy map rules and actions 12-67

service, definition GL-5

service object group

configuring 4-66

ICMP service parameters 4-72

protocols 4-68

TCP/UDP service parameters 4-69

setup sequence for SSL 9-5

shared object

configuring 5-10

configuring for virtual servers 5-9

when deleting virtual servers 5-10

Simple Message Transfer Protocol (SMTP), definition GL-5

SIP

configuring protocol inspection 5-27

deep packet inspection

class map match conditions 12-31

policy map rules and actions 12-81

header sticky type 7-5

logging packets in the syslog 8-20

parameter map

attributes 8-20

configuring 8-20

protocol inspection conditions and options 5-27

server load balancing

class map match conditions 12-23

policy map rules and actions 12-67

SIP inspection 12-7

SIP-TCP probe attributes 6-58

SIP-UDP probe attributes 6-59

Skinny

deep packet inspection policy map rules and actions 12-83

parameter map

attributes 8-22

configuring 8-22

SLB, definition GL-5

SMTP

definition GL-5

probe attributes 6-60

SNMP

configuration attributes 4-19

configuring

communities 4-20

notification 4-25

trap destination hosts 4-23

users 4-21

contact information 4-19

credentials missing 14-15

IETF trap 4-20

location 4-19

probe attributes 6-60

protocol and monitoring 14-2

setting up for monitoring 14-2

trap destination host configuration 4-23

trap source interface 4-20

unmask community 4-19

user configuration attributes 4-22

special characters for matching string expressions 12-88

special configuration file, definition GL-5

SSL

certificate

bulk importing attributes 9-10

exporting attributes 9-17

ignore authentication failure errors 9-20

importing attributes 9-9

overview 9-4

redirect authentication failure 9-21

using 9-6

configuring

auth group certificates 9-31

chain group certificates 9-24

chain group parameters 9-24

CSR parameters 9-25

for virtual servers 5-18

OCSPservice 9-29

parameter map 9-19

parameter map cipher attributes 9-21

parameter map redirect attributes 9-21

proxy service 9-27

editing parameter map cipher info 9-21

exporting

certificates 9-16

key pairs 9-18

keys 9-18

generating

CSR 9-26

key pair 9-15

header insertion, configuring 12-94

importing

certificates 9-8

key pairs 9-12

key pair

bulk importing attributes 9-14

exporting 9-18

generating 9-15

importing 9-12

importing attributes 9-13

overview 9-4

using 9-11

load balancing on SSL cipher or cipher strength 5-34, 12-49

objects, deleting 9-2

overview 9-1

parameter map cipher table 9-21

procedure overview 9-4

sample certificate and key pair 9-7

setup sequence 9-5

sticky group attributes 7-20

URL rewrite, configuring 12-92

SSL certificate, using 9-6

SSL header insertion, configuring 12-94

SSL key, using 9-11

SSL setup sequence, using 9-5

static route

configuring 10-33

viewing by context 10-34

statistics

ACE 15-35

collection 14-33, 15-35

monitoring 15-35

viewing ACE 15-35

status for the ACE appliance 15-35

stickiness

cookie-based 7-3

HTTP content 7-3

HTTP cookie 7-3

HTTP header 7-4

IP netmask 7-4

IPv6 prefix 7-4

Layer 4 payload 7-4

overview 7-1

RADIUS 7-5

RTSP header 7-5

SIP header 7-5

sticky group 7-6

sticky table 7-11

types 7-2

sticky

cookies for client identification 7-3

definition GL-6

e-commerce application requirements 7-1

enabled on backup server farm 7-15

groups 7-6

HTTP header for client identification 7-4

IP netmask for client identification 7-4

IPv6 prefix for client identification 7-4

overview 7-2

table 7-11

types 7-2

sticky group

attributes

HTTP content 7-16

HTTP cookie 7-17

HTTP header 7-18

IP netmask 7-18

Layer 4 payload 7-19

RADIUS 7-20

RTSP header 7-20

SSL 7-20

buddy 7-6

configuration attributes 5-50, 7-12

configuring load balancing 7-11

configuring sticky statics 7-21

overview 7-6

type-specific attributes 7-16

viewing 7-20

sticky statics, configuring for sticky groups 7-21

sticky table overview 7-11

sticky type

IP netmask 7-4

HTTP content 7-3

HTTP cookie 7-3

HTTP header 7-4

IPv6 prefix 7-4

Layer 4 payload 7-4

RADIUS 7-5

RTSP header 7-5

SIP header 7-5

stopping active user sessions 15-12

subnet objects, for object groups 4-68

support

obtaining iii-xix

See Lifeline 16-3, 16-5

suspend

definition GL-6

real servers 6-10

virtual servers 5-65

switch mode, configuring 4-6

switchover 11-4

synchronizing

all configurations 4-79

configurations for high availability 11-6

context configurations and high availability 4-77

contexts created in CLI 5-2

contexts created in CLI (automatically) 5-5

contexts created in CLI (manually) 5-5

individual configurations, manual 4-78

manually synchronizing virtual servers created in CLI 4-79

virtual context configurations 4-75

syslog

configuration attributes 4-13

configuring

logging 4-12

log hosts 4-16

log messages 4-17

log rate limits 4-18

logging levels 4-12

T

table

button descriptions 1-11

conventions 1-12

customizing 1-14

filtering information in 1-13

ICMP type numbers and names 4-61, 4-73

icon descriptions 1-11

parent rows 1-12

probe attributes 6-46

protocol names and numbers 4-60

sticky group attributes 7-16

topic reference for policy map rules and actions 12-36

takeover, forcing in high availability 11-16

task overview, redundancy 11-8

TCL script

health monitoring 6-39

overview 6-39

TCP

definition GL-6

options for connection parameter maps 8-9

probe attributes 6-61

service parameters for object groups 4-69

Telnet probe attributes 6-61

terminating active user sessions 15-12

terminology used in ACE Appliance Device Manager 1-22

threshold, definition GL-6

topic reference for configuring rules and actions 12-36

topology maps 14-34

traceroute, definition GL-6

tracking user actions 14-36

traffic, monitoring 14-21

traffic class components 12-3

traffic classification process 12-2

traffic policy

ACE device support 12-2

components 12-4

configuring 12-1

for application acceleration 13-2

for optimization 13-2

lookup order 12-4

overview 12-1

supported actions 12-2

Transfer Control Protocol (TCP), definition GL-6

trap source interface, SNMP 4-20

troubleshooting

using file browser 16-6

types of users 15-5

U

UDP probe attributes 6-62

UDP service parameters, for object groups 4-69

understanding

domains 15-7

operations privileges 15-6

roles 15-5

unmask community, SNMP 4-19

updating ACE appliance licenses 4-31

uploading

files to ACE 16-7

virtual context configurations 4-79

URL rewrite, configuring 12-92

user roles, definition GL-6

users

active session info 15-11

adding new 15-8

assigned 15-5

default 15-5

default role options 15-9

deleting 15-10

deleting active 15-12

deleting roles 15-30

forcing logoffs 15-12

guidelines for managing 15-8

logging in as 1-5

overview 15-7

types of 15-5

understanding privileges 15-6

using

ACLs 4-53

virtual contexts 4-2

V

verifying GUI operational status 16-10

viewing

ACE appliance licenses 4-28

ACLs by context 4-64

all real servers 6-12

all server farms 6-37

all sticky groups 7-20

all virtual contexts 4-80

all virtual servers 5-65

BVI interfaces by context 10-30

configuration status 4-76

files on the ACE 16-9

license information 4-33

network domains 15-32

parameter maps by context 8-27

polling states in monitoring 14-15

resource class use on contexts 4-40

static routes by context 10-34

virtual servers 5-63

virtual servers by context 5-63

VLAN interfaces by context 10-22

virtual-address match condition attributes 12-11

virtual context

adding Admin user 4-6

allocate interface VLAN 4-3

configuration options 4-7

configuring 4-1, 4-2

BVI interfaces 10-23

class map match conditions 12-10

class maps 12-8

expert options 4-75

global policies 4-26

load balancing services 5-1

management VLAN 4-2

policy map rules and actions 12-36

policy maps 12-34

primary attributes 4-11

static routes 10-33

system attributes 4-11

VLAN interfaces 10-10

creating 4-2

definition GL-6

deleting 4-80

managing 4-75

modifying 4-80

monitoring resource usage 14-17

overview 4-2

synchronizing configurations 4-75, 4-77

using 4-2

viewing

all contexts 4-80

BVI interfaces 10-30

configuration status 4-76

static routes 10-34

VLANS 10-22

Virtual Local Area Network (VLAN), definition GL-6

virtual server

activating 5-64

additional options 5-3

advanced view properties 5-11

and user roles 5-4

basic view properties 5-16

configuration

methods 5-5

recommendations 5-5

configuration subsets 5-8

configuring 5-1, 5-2, 5-7

default Layer 7 load balancing 5-55

in ACE Appliance Device Manager 5-2

in CLI 4-79, 5-2, 5-5

Layer 7 load balancing 5-30

NAT 5-61

optimization 5-57

properties 5-10

protocol inspection 5-20

shared objects 5-9

SSL 5-18

definition GL-6

deleting and shared objects 5-10

managing 5-63

manually synchronizing CLI configurations 4-79

minimum configuration 5-2

RBAC permissions to create, modify, or delete 5-4, 15-27

recommendations for configuring 5-5

shared objects 5-5, 5-9

SSL initiation attributes 5-53

SSL termination attributes 5-19

suspending 5-65

viewing

all 5-65

by context 5-63

servers 5-63

VLAN

allocating interface 4-3

attributes 10-10

configuring 10-10

access control 10-18

ACLs 10-19

DHCP relay 10-19

management VLAN 4-2

NAT 10-31

policy maps 10-18

definition GL-6

FT VLAN for redundancy 11-5

interface

access control 10-19

configuring 10-10

DHCP relay 10-19

NAT pools 10-31

policy maps 10-18

secondary IP groups for 10-18

types of 10-11

viewing 10-22

VLANs

alias IP address, setting 1-21

VLAN Trunking Protocol (VTP), definition GL-7

VM probe attributes 6-63

VTP, definition GL-7

VTP domain, definition GL-7

W

Web server, definition GL-7

weighted roundrobin. See roundrobin