-
CSS Advanced Configuration Guide (Software Version 5.00)
-
Content Services Switch Advanced Configuration Guide Index (Software Version 5.00)
-
About This Guide
-
Configuring Sticky Parameters for Content Rules
-
Configuring HTTP Header Load Balancing
-
Configuring Source Groups, ACLs, EQLs, URQLs, NQLs, and DQLs
-
Configuring VIP and Virtual IP Interface Redundancy
-
Configuring Redundant Content Services Switches
-
Configuring Caching
-
Configuring the CSS Domain Name Service
-
Configuring Content Replication
-
Configuring Firewall Load Balancing
-
Configuring Network Proximity
-
Configuring OSPF
-
Using the CSS Scripting Language
-
Table Of Contents
Configuring Source Groups, ACLs, EQLs, URQLs, NQLs, and DQLs
Source Group Configuration Quick Start
Configuring a Source Group for FTP Connections
Configuring Source Groups to Allow Servers to Internet-Resolve Domain Names
Configuring an Access Control List
Applying an ACL to a Circuit or DNS Queries
Removing an ACL from a Circuit or DNS Queries
Setting the Show ACL Counters to Zero
Configuring Extension Qualifier Lists
Specifying an Extension Qualifier List in a Uniform Resource Locator
Showing EQL Extensions and Descriptions
Configuring Uniform Resource Locator Qualifier Lists
Designating the Domain Name of URLs in a URQL
Adding a URQL to a Content Rule
URQL Configuration in a Startup-Config File
Configuring Network Qualifier Lists
Adding an NQL to an ACL Clause
Configuring Domain Qualifier Lists (DQL)
Adding a DQL to a Content Rule
Removing a DQL from a Content Rule
Configuring Virtual Web Hosting
Configuring Source Groups, ACLs, EQLs, URQLs, NQLs, and DQLs
This chapter describes how to configure source groups, Access Control Lists (ACLS), Extension Qualifier Lists (EQLs), Uniform Resource Locator Qualifier Lists (URQLs), Network Qualifier Lists (NQLs), and Domain Qualifier Lists (DQLs). Information in this chapter applies to all CSS models, except where noted.
This chapter contains the following sections:
•
Configuring Source Groups to Allow Servers to Internet-Resolve Domain Names
•
•
•
•
•
Configuring Source Groups
Group configuration mode allows you to configure a maximum of 255 source groups on a CSS. A source group is a collection of local servers that initiate flows from within the local web farm. The CSS enables you to treat a source group as a virtual server with its own source IP address.
For example, if you configure several streaming audio transmitters as a group, the CSS will process flows from the group members and give them all the same source IP address.
To access group configuration mode, use the group command from any mode except ACL and boot configuration modes. The prompt changes to (config-group) groupname. You can also use this command from within group mode to access another group.
For example:
(config)# group ftpgroup (config-group[ftpgroup])#To remove a source group, enter:
(config)# no group ftpgroup
Note
The following commands are available in group mode:
•
•
If your topology consists of a CSS 11800 using ECMP to the servers and server port NAT configured on the services, to ensure the correct processing of packets either:
–
–
•
–
–
•
•
•
•
–
To reset the starting SFP port number to its default value of 8192, use the
no portmap base-port command.–
Note
To reset the number of ports per SFP to the default value, use the
no portmap number-of-ports command.•
Source Group Configuration Quick Start
Use the procedure in Table 3-1 to configure a source group for TCP/UDP traffic. To configure a source group for FTP traffic, refer to the next section. Note that each source group requires a content rule that contains the same services and VIP as the source group.
Configuring a Source Group for FTP Connections
To use source groups to support FTP sessions to a VIP that is load balanced across multiple services, configure a content rule for the VIP and then a source group.
Note
To configure FTP sessions to a VIP:
1.
content ftp_rule vip address 192.168.3.6 protocol tcp port 21 application ftp-control add service serv1 add service serv2 add service serv3 active2.
group ftp_group vip address 192.168.3.6 add service serv1 add service serv2 add service serv3 activeConfiguring Source Groups to Allow Servers to Internet-Resolve Domain Names
The CSS provides support to enable servers to resolve domain names using the Internet. If you are using private IP addresses for your servers and wish to have the servers resolve domain names using domain name servers that are located on the Internet, you must configure a content rule and source group. The content rule and source group are required to specify a public Internet-routable IP address (VIP address) for the servers to allow them to resolve domain names.
To configure a server to resolve domain names:
1.
The following example creates Server1 and configures it with a private IP address 10.0.3.251 and activates it.
(config)# service Server1 (config-service[Server1])# ip address 10.0.3.251 (config-service[Server1])# active2.
The following example creates content rule dns1 with a public VIP 192.200.200.200 and adds server Server1.
(config-owner[arrowpoint.com])# content dns1 (config-owner-content[arrowpoint.com-dns1])# vip address 192.200.200.200 (config-owner-content[arrowpoint.com-dns1])# add service Server1 (config-owner-content[arrowpoint.com-dns1])# active3.
To prevent server source port collisions, the CSS NATs the server's source IP address and port by translating the:
•
•
The following example creates source group dns1 with public VIP address 192.200.200.200 and adds server Server1.
(config)# group dns1 (config-group[dns1])# vip address 192.200.200.200 (config-group[dns1])# add service Server1 (config-group[dns1])# activeShowing Source Groups
To display source group configuration information, use the show group commands in SuperUser, User, Global Configuration, and Group modes. The options are:
•
•
•
For example:
(config)# show groupTable 3-2 describes the fields in the show group output.
Access Control List Overview
A CSS provides traffic filtering capabilities with Access Control Lists (ACLs). ACLs filter inbound network traffic by controlling whether packets are forwarded or blocked at the CSS interfaces. You can configure ACLs for routed network protocols, filtering the protocol packets as the packets pass through the CSS.
An ACL consists of clauses that you define. The CSS uses these clauses to determine how to handle each packet it processes. When the CSS examines each packet, it either forwards or blocks the packet based on whether or not the packet matches a clause in the ACL.
ACLs provide a basic level of security for accessing your network. If you do not configure ACLs on the CSS, all packets passing through the CSS could be allowed onto the entire network. For example, you may want to permit all email traffic, but block Telnet traffic. You can also use ACLs to allow one client to access a part of the network and prevent another client from accessing the same area.
Caution
Cisco recommends that you configure either a permit all or a deny all clause depending on your ACL configuration. For example, you could first configure a permit all clause and then configure deny clauses for only the traffic you wish to deny. Or, use the default deny all clause and configure permit clauses only for the traffic you wish to permit.
Configuring an Access Control List
The steps below describe how to configure an ACL. Each step includes the CLI command required to complete the task. For a complete description of each feature, refer to the sections following this procedure.
To configure an ACL:
1.
1 to 99.(config)# acl 7 (config-acl[7])#2.
clause number permit|deny|bypass protocol [source_info {source_port}] dest [dest_info {dest_port}] {log} {prefer servicename} {sourcegroup name}
For example:
(config-acl[7])# clause 1 deny udp any eq 3 dest any eq 3 log prefer serv73.
(config-acl[7])# apply circuit-(VLAN1)4.
(config)# acl enable
Caution
The following sections describe how to configure an ACL:
•
•
Creating ACLs
To create an ACL and access ACL mode, use the acl index number command. The index number defines the ACL and can range from 1 to 99. To display a list of existing ACLs, enter acl ?.
(config)# acl 7When you access this mode, the prompt changes to the ACL mode of the index number you created. For example:
(config-acl[7])#Deleting an ACL
To delete an ACL, enter the no acl command followed by the index number you wish to delete. For example:
(config)# no acl 2Configuring Clauses
To control traffic on a circuit, the CSS enables you to enter clauses in a specific ACL. When implementing an ACL, the number assigned to each clause is very important. The CSS looks at the ACL starting from clause 1 and sequentially progresses through the rest of the clauses. Assign the lowest clause numbers to clauses with the most specific matches. Then, assign higher clause numbers to clauses with less specific matches.
You do not need to enter the clauses sequentially. The CSS automatically inserts the clause in the appropriate order in the ACL. For example, if you enter clauses 10 and 24, and then clause 15, the CSS inserts the clauses in the correct sequence.
Clause number is the number you want to assign to the clause. Enter a number from 1 to 254. To create a clause to permit, deny, or bypass traffic on a circuit, use the clause command.
The syntax for the clause command is:
•
clause number bypass protocol [source_info {source_port}]
dest [dest_info {dest_port}] {sourcegroup name} {prefer servicename}The bypass option bypasses traffic only on a content rule, thus does not cause NATing to occur. Do not use the bypass option in an ACL clause with a source group. Since this option does not bypass traffic that does not match a rule, it does not effect NATing on a source group in an ACL clause.
•
clause number deny protocol [source_info {source_port}]
dest [dest_info {dest_port}] {sourcegroup name} {prefer servicename}•
clause number permit protocol [source_info {source_port}]
dest [dest_info {dest_port}] {sourcegroup name} {prefer servicename}
Note
Table 3-3 provides variables and options for the clause command. Bolded syntax defines keywords that you enter on the command line. Italics define variables where you enter a value such as an IP address or host name.
Note
clause 14 permit any any destination content Layer5/L5 eq 80 (original clause) clause 15 permit tcp any destination 200.200.200.200 eq 80 (This is an additional clause to handle the SYN, where the destination IP address is the IP address configured in the Layer 5 content rule. Note that this clause number must be greater than the destination content clause number.)
Deleting a Clause
To delete a clause, use the no clause command. For example:
(config-acl[7]) no clause 6Logging ACL Activity
When you configure the CSS to log ACL activity, it logs the event of the packet matching the clause and ACL. The CSS sends log information to the location you specified in the logging command. For information on the logging command, refer to the Content Services Switch Basic Configuration Guide.
Note
Because the CSS does not save the clause log enable command in the running-config, you must reenable logging if the CSS reboots.To configure logging for an ACL clause:
1.
(config)# acl 7 (config-acl[7])#2.
(config-acl[7]) remove circuit-(VLAN1)3.
(config-acl[7])# clause 1 log enable4.
(config-acl[7])# apply circuit-(VLAN1)To disable ACL logging for a specific clause, enter:
(config-acl[7])# clause 1 log disableTo globally disable logging for all ACL clauses, enter:
(config)# no logging subsystem aclApplying an ACL to a Circuit or DNS Queries
Once you configure the ACL, use the apply command to assign an ACL to all circuits, an individual circuit, or to DNS queries.
Note
To add a new clause to an existing and applied ACL, reapply the ACL to the circuit with the apply circuit command.
To apply any changes to an existing clause on an existing and applied ACL, you must remove the ACL from the circuit with the (config-acl) remove command, and then reapply the ACL to the circuit.
To remove a clause currently in use, you must remove its applied ACL from the circuit, delete the clause, and then reapply the ACL to the circuit.
The syntax and options for this ACL mode command are:
•
•
•
For example, to apply acl 7 to circuit VLAN1:
(config-acl[7])# apply circuit-(VLAN1)To display a list of circuits, enter apply ?.
Note
Removing an ACL from a Circuit or DNS Queries
Use the remove command to remove an ACL from all circuits, an individual circuit, or from DNS queries.
Note
The syntax and options for this ACL mode command are:
•
•
•
For example:
(config-acl[7])# remove circuit-(VLAN1)(config-acl[7])# remove dnsGlobally Enabling ACLs
Global ACL commands allow you to enable or disable all ACLs simultaneously. Global commands are advantageous when managing your network.
Note
To globally enable all ACLs, enter:
(config)# acl enableTo globally disable all ACLs on the CSS, enter:
(config)# acl disableShowing ACLs
Use the show acl commands to display access control lists and clauses. The show acl commands are available in all modes. The syntax is:
•
–
–
•
(valid numbers are 1 to 99). When you show an ACL clause that is applied to DNS queries, the display includes a DNS hit counter, which counts DNS lookups.When you show an ACL clause that is applied to a circuit, the display includes:
–
–
•
For example:
(config)# show acl 2Table 3-4 describes the fields in the show acl output.
Setting the Show ACL Counters to Zero
Use the zero counts command to set the content and DNS hit counters in the
show acl command screen to zero for a specific ACL. You must be in an ACL to issue this command. The CSS only clears counters for that ACL.The syntax and options for this command are:
(config-acl[7])# zero countsACL Example
The following ACL provides security for a CSS, Server1, and Server2 on one VLAN (VLAN1). The ACL:
•
•
•
The individual clauses provide the following security.
•
(IP address 172.16.107.15).•
(IP address 172.16.107.16).•
•
•
!**************************** ACL *************************** acl 1 clause 20 permit any 172.16.107.0 255.255.255.0 destination 172.16.107.15 clause 30 permit any 172.16.107.0 255.255.255.0 destination 172.16.107.16 clause 50 permit ICMP any destination any clause 60 permit udp any eq 520 destination any clause 70 deny any any destination any apply circuit-(VLAN1)Configuring Extension Qualifier Lists
An Extension Qualifier List (EQL) is a collection of file extensions that enable you to match a content rule based on extensions. You activate an EQL by associating it as part of a URL in a Layer 5 content rule. Use the eql command to access EQL configuration mode and configure an extension qualifier list. Enter a name that identifies the extension list you want to create. Enter an unquoted text string with no spaces and a length of 1 to 31 characters.
For example:
(config)# eql graphics (config-eql[graphics])#To remove an existing EQL, use the no eql command from config mode. For example:
(config)# no eql graphicsOnce you create an EQL, you can configure the following attributes for it:
•
(config-eql[graphics])# description "This EQL specifies graphic file extensions"•
For example:
(config-eql[graphics])# extension pcxOptionally, you may provide a description of the extension type. Enter a quoted text string with a maximum length of 64 characters. For example:
(config-eql[graphics])# extension gif "This is a graphics file"To remove an extension from an EQL, use the no extension command. For example:
(config-eql[graphics])# no extension gifSpecifying an Extension Qualifier List in a Uniform Resource Locator
Server selections are based on the Uniform Resource Locator (URL) specified in the owner content rule. To enable the CSS to access a service when a request for content matches the extensions contained in a previously defined Extension Qualifier List (EQL), specify the URL and EQL name for the content.
Specify a URL as a quoted text string with a maximum of 256 characters followed by eql and the EQL name.
Note
For example:
(config-owner-content[arrowpoint.com-products.html])# url "/*" eql graphicsThe following example enables the CSS to direct all requests to the correct service for content that matches:
•
•
(config-owner-content[arrowpoint.com-products.html])# url "/customers/products/*" eql graphicsTo display a content rule EQL, enter show rule.
To display an EQL name and extensions configured for a content rule, enter the show rule command.
For details on the show rule command and its output, refer to the Content Services Switch Basic Configuration Guide, Chapter 7, Configuring Content Rules.
Showing EQL Extensions and Descriptions
To display a list of existing EQLs names, enter eql ?.
For example:
(config)# eql ?To display the extensions configured for a specific EQL including any descriptions, enter the show eql command and the EQL name.
(config)# show eql graphicsTable 3-5 describes the fields in the show eql output.
Configuring Uniform Resource Locator Qualifier Lists
URQL configuration mode allows you to configure a Uniform Resource Locator Qualifier List (URQL). A URQL is a group of URLs for content that you associate with one or more content rules. The CSS uses this list to identify which requests to send to a service.
For example, you want all streaming video requests to be handled by your powerful servers. Create a URQL that contains the URLs for the content, and then associate the URQL to a content rule. The CSS will direct all requests for the streaming video URLs to the powerful servers specified in the content rule. Creating a URQL to group the URLs saves you from having to create a separate content rule for each URL.
Note
Creating a URQL
To access URQL configuration mode, use the urql command. The prompt changes to (config-urql [name]). You can also use this command from URQL mode to access another URQL.
Enter the URQL name you want to create or enter an existing URQL. Enter the name as an unquoted text string with no spaces and a maximum of 31 characters. When you create a URQL, it remains suspended until you activate it using the activate command in urql mode. To display a list of existing URQL names, enter:
(config)# urql ?For example:
(config)# urql videos (config-urql[videos)#To remove an existing URQL, enter the following command in global configuration mode:
(config) no urql videosOnce you create a URQL:
1.
a.
b.
c.
2.
3.
4.
The following sections describe how to complete these tasks.
Configuring a URL in a URQL
Use the url command to include the URL for content requests you want as part of this URQL, and optionally provide a description. Configuring an URL in a URQL includes:
Note
Specifying the URL Entry
To specify a URL entry in a URQL, enter a URL number from 1 to 1000. For example:
(config-urql[videos])# url 10To remove a URL entry from a URQL, use the no url command. For example:
(config-urql[videos])# no url 10To specify additional URL entries in the URQL, reenter the url command. For example:
(config-urql[videos])# url 20 (config-urql[videos])# url 30 (config-urql[videos])# url 40Defining the URL
To define an URL for the entry, use the url command. Enter the URL as a quoted text string with a maximum of 251 characters. Wildcards are not allowed in a URQL URL. For example:
(config-urql[videos])# url 10 url "/cooking/cookies.avi"To remove an URL from an entry, use the no url number url command. Use this command to remove a previously assigned URL before you redefine the URL for an entry. For example:
(config-urql[videos])# no url 10 urlTo define additional URL for the entries, reenter the url entry url command. For example:
(config-urql[videos])# url 20 url "/cooking/fudge.avi" (config-urql[videos])# url 30 url "/cooking/pie.avi" (config-urql[videos])# url 40 url "/cooking/cake.avi"Describing the URL
You may optionally enter a description for the URL. Enter a quoted text string with a maximum length of 64 characters. For example:
(config-urql[videos])# url 10 description "making cookies"To remove a description about the URL, enter:
(config-urql[videos])# no url 10 descriptionDesignating the Domain Name of URLs in a URQL
Use the domain command to designate the domain name or IP address of the URLs to a URQL. Enter the domain name in mnemonic host-name format (for example, www.arrowpoint.com) from 1 to 63 characters. Enter the IP address as a valid address for the domain name (for example, 192.168.11.1).
Note
For example:
(config-urql[videos])# domain "www.arrowpoint.com"or
(config-urql[videos])# domain "192.168.11.1"Adding a URQL to a Content Rule
Once you create and configure a URQL, use the url urql command to add it to a previously configured content rule. You can only assign one URQL per rule. Also, a content rule may contain either a URL or a URQL.
Note
For example:
(config-owner-content[chefsbest-recipes])# url urql videosTo see a list of URQLs, enter: urql ?. To remove a URQL from an URL, enter:
(config-owner-content[chefsbest-recipes])# no url urqlTo display a URL for a content rule, enter the show rule command for the content rule.
For details on the show rule command and its output, refer to the Content Services Switch Basic Configuration Guide, Chapter 7, Configuring Content Rules.
Describing the URQL
Use the description command to provide a description for a URQL. Enter the description an a quoted text string with a maximum of 64 characters.
For example:
(config-urql[videos])# description "cooking streaming video"To clear a description for the URQL, enter:
(config-urql[videos])# no descriptionActivating a URQL
Use the active command to activate a suspended URQL. When you create a URQL, it is suspended until you use the active command to activate it.
Note
For example:
(config-urql[videos])# activeSuspending a URQL
Use the suspend command to deactivate a URQL on all currently assigned content rules. For example:
(config-urql[videos])# suspendTo reactivate the URQL, use the (config-urql) active command.
URQL Configuration in a Startup-Config File
The following example shows a URQL configuration in a startup-config file.
!**************************** URQL **************************urql excellence1 url 10 url 30 url 30 url "/arrowpoint.gif" domain "192.168.128.109" url 10 url "/"urql excellence2 url 10 url 10 url "/poweredby.gif" domain "192.168.128.109"Showing URQLs
To display a list of URQLs, enter:
(config)# urql ?To display all configured URQLs, enter:
(config)# show urqlTo display a specific URQL, enter:
(config)# show urql videosTable 3-6 describes the fields in the show urql output.
Table 3-7 describes the additional fields when you display a specified URQL.
Configuring Network Qualifier Lists
NQL configuration mode allows you to configure a Network Qualifier List (NQL). An NQL is a list of networks or specific services, identified by IP address and subnet mask, that you assign to an ACL clause as a source or destination. By grouping networks into an NQL and assigning the NQL to an ACL clause, you have to create only one clause instead of a separate clause for each network.
The CSS enables you to configure a maximum of 512:
•
•
This functionality is useful, for example, in a caching environment where you have a network you want to bypass and send content requests directly to the origin servers (servers containing the content). You can also use an NQL for users who prefer a service based on a specific network.
To access NQL configuration mode, use the nql command. The prompt changes to (config-nql [name]). You can also use this command from NQL mode to access another NQL.
Refer to the following sections to configure an NQL:
•
Creating an NQL
Enter the name of the new NQL you want to create or an existing NQL. Enter the name as an unquoted text string with no spaces and a maximum of 31 characters. You can create a maximum of 512 NQLs per CSS.
For example:
(config)# nql bypass_nql(config-nql[bypass_nql])#To display a list of existing NQLs, enter nql ?. If no NQLs currently exist, the CSS prompts you to enter a new name.
To remove an existing NQL, use the no nql command. For example:
(config)# no nql bypass_nqlDescribing an NQL
Use the description command in NQL mode to provide a description for an NQL. Enter the NQL description as a quoted text string with a maximum length of
63 characters.For example:
(config-nql[bypass_nql])# description "Bypass services"Adding Networks to an NQL
Use the ip address command to add a maximum of 512 networks or services to an NQL. Enter an IP address with either a subnet prefix or a subnet address. You may also add an optional description for the IP address and turn on logging.
The syntax and options are:
ip address ip_address[/subnet_prefix| subnet_address] {"description"}{log}
The variables and options are:
•
•
•
•
•
For example, to add two networks to the NQL bypass_nql, enter:
(config-nql[bypass_nql])# ip address 192.168.0.0/16 "Network of dynamic mail content" log(config-nql[bypass_nql])# ip address 123.123.123.0/24To log events occurring on a network, you must also enable global NQL logging. For example:
(config)# logging subsystem nql level debug-7
Note
To remove an IP address from an NQL, use the no ip address command. For example:
(config-nql[bypass_nql])# no ip address 192.168.0.0/16Adding an NQL to an ACL Clause
To add an NQL to an ACL clause:
1.
(config)# acl 102.
This clause example bypasses content rules for any traffic from any source going to the destination networks defined in NQL bypass_nql on port 80.
(config-acl[10])# clause 1 bypass any any destination nql bypass_nql eq 80Showing NQL Configurations
Use the show nql command to display NQL configuration information. The syntax for this command is:
•
•
For example:
(config-nql[bypass_nql])# show nqlTable 3-8 describes the fields in the show nql output.
Configuring Domain Qualifier Lists (DQL)
When you have a requirement for a content rule to match on multiple domain names, you can associate a Domain Qualifier List (DQL) to the rule. A DQL is a list of domain names that you configure and assign to a content rule, instead of creating a content rule for each domain. Assigning multiple domain names to a DQL enables you to have many domain names match on one content rule.
You can use a DQL on a rule to specify that content requests for each domain in the list will match on the rule. You can determine the order that the domain names are listed in the DQL. You can arrange the names in a DQL by assigning an index number as you add the name to the list.
DQLs exist independently of any range mapping. You can use them as a matching criteria to balance across servers that do not have VIP or port ranges. If you want to use range mapping when using range services, you need to consider the index of any domain name in the DQL. If you are not using service ranges with DQLs, you do not need to configure any index and the default index is 1.
For example, you could configure a DQL named Woodworker.
(config)# dql WoodworkerThe domain names you could add as part of the DQL include www.wood.com, www.woodworker.com, www.maple.com, www.oak.com. You could configure www.wood.com and www.woodworker.com to have the same mapping index. You can enter indexes from 1 to 1000 and provide an optional quoted description for each index.
For example:
(config-dql[Woodworker]# domain www.wood.com index 1 "This is the same as the woodworker domain"(config-dql[Woodworker]# domain www.woodworker.com index 1(config-dql[Woodworker]# domain www.maple.com index 2(config-dql[Woodworker]# domain www.oak.com index 3If you specify a DQL as a matching criteria for content rule WoodSites, and there are two services, S1 and S2, associated with the rule, the CSS checks the services at mapping time for ranges. To add a DQL to a content rule, use the url command as shown:
(config-owner-content[WoodSites])# url "/*" dql WoodworkerFor example, if the CSS receives a request for www.oak.com along with other criteria, a match on the WoodSites rule occurs on DQL index 3. If the rule has roundrobin balance method, the CSS examines a service (S2 for this example) to determine the backend connection mapping parameters. If you configured S2 with a VIP address of 10.0.0.1 with a range of 5, the addresses include 10.0.0.1 through 10.0.0.5. Because this service has a range of address and any as its port, the DQL index of 3 matches the service VIP range index of 3, which is address 10.0.0.3.
To access DQL configuration mode, use the dql command from any configuration mode except boot, group, RMON alarm, RMON event, and RMON history configuration modes. The prompt changes to (config-dql [name]). You can also use this command from DQL mode to access another DQL.
Refer to the following sections to configure a DQL:
•
•
Creating a DQL
To create a new DQL, enter the name of the DQL you want to create as an unquoted text string with no spaces and a maximum of 31 characters. To access an existing DQL, enter the DQL name.
For example, to configure a DQL:
(config)# dql pet_domains (config-dql[pet_domains])#To display a list of existing DQL names, enter dql ? .
Describing a DQL
Use the description command to provide a description for a Domain Qualifier List (DQL). Enter the description as a quoted text string with a maximum of
63 characters, including spaces.For example:
(config-dql[pet_domains])# description "pet supplies"Adding a Domain to a DQL
Use the domain command to add a domain to the list of domains supported by a DQL. The syntax is:
domain name index number {"description"}
The variables and option are:
•
•
If a domain has more than one domain name, you can assign the same index number to its different names.•
For example:
(config-dql[pet_domains])# domain www.birds.com index 1 "idaho-based"(config-dql[pet_domains])# domain www.cats.com index 2 "worldwide"(config-dql[pet_domains])# domain www.horses.com index 3 "florida-based"To add or delete a domain name from a DQL that is assigned to a content rule, you must first suspend the content rule using the suspend command. You cannot make changes to a DQL currently in use by a content rule.
For example, to remove a domain from the example DQL, enter:
(config-dql[pet_domains])# no domain www.birds.comAdding a DQL to a Content Rule
Once you have configured a DQL, use the url command to add it to a content rule. You cannot use wildcards in a DQL entry.
For example:
(config-owner-content[pets.com-rule1])# url "/*" dql pet_domainsRemoving a DQL from a Content Rule
To remove a DQL that is assigned to a content rule, you must first suspend the content rule using the suspend command. You cannot remove a DQL currently in use by a content rule. Once the content rule is suspended, use the no dql command to remove the DQL from the content rule.
For example:
(config) no dql pet_domainsShowing DQL Configurations
Use the show dql command to display all DQL configurations. To display a specific DQL, include the DQL name in the command line.
For example:
(config-dql[pet_domains])# show dql pet_domainsTable 3-9 describes the fields in the show dql output.
Configuring Virtual Web Hosting
Virtual Web hosting enables you to host a large number of Web sites on a small number of servers (typically 2 to 10 servers) that have mirrored content. Each server may contain hundreds or thousands of Web sites. The servers determine which Web site is being requested based on IP address, port, and domain name.
Using virtual Web hosting, you may configure:
•
•
•
You can configure the CSS to load balance the Web sites by configuring port ranges, VIP ranges, and DQLs. For more information on the service and content rule commands required, refer to the Content Services Switch Basic Configuration Guide.
Refer to Table 3-10 for the steps required to configure virtual Web hosting.
