Table Of Contents
Service, Owner, and Content Rule Overview
Content Rule Configuration Quick Start
Naming and Assigning a Content Rule to an Owner
Configuring a Virtual IP Address
Configuring a Domain Name Content Rule
Matching Content Rules on Multiple Domain Names
Configuring a Content Rule using a Domain Name and a Virtual IP Address
Using Wildcards in Domain Name Content Rules
General Guidelines for Domain Name Wildcards in Content Rules
Adding Services to a Content Rule
Adding a Service to a Content Rule
Adding a Primary Sorry Server to a Content Rule
Adding a Secondary Sorry Server to a Content Rule
Adding a Domain Name System to a Content Rule
Disabling a Domain Name System in a Content Rule
Removing a Service from a Content Rule
Configuring a DNS Balance Type
Specifying a Uniform Resource Locator
Specifying an Extension Qualifier List in a Uniform Resource Locator
Specifying the Number of Spanned Packets
Redirecting Requests for Content
Enabling TCP Flow Reset Reject
Configuring Persistence, Remapping, and Redirection
Configuring Bypass Persistence
Configuring HTTP Redirection and Service Remapping
Specifying an HTTP Redirect String
Specifying an Application Type
Enabling Content Requests to Bypass Transparent Caches
Clearing Counters in a Content Rule
Clearing Counters for Content Rules
Clearing Service Statistics Counters in a Content Rule
Configuring Content Rules
This chapter describes how to create and configure content rules. Information in this chapter applies to all CSS models except where noted.
This chapter contains the following sections:
•
Service, Owner, and Content Rule Overview
•
•
•
•
•
•
•
•
•
•
•
•
•
Service, Owner, and Content Rule Overview
The CSS enables you to configure services, owners, and content rules to direct requests for content to a specific destination service (for example, a server or a port on a server). By configuring services, owners, and content rules, you optimize and control how the CSS handles each request for specific content.
•
(a local or remote server and port). You add services to content rules. Adding a service to a content rule includes it in the resource pool that the CSS uses for load balancing requests for content. A service may belong to multiple content rules. To configure services, refer to Chapter 1, Configuring Services.•
•
When a request for content is made, the CSS:
1.
2.
3.
4.
The CSS uses content rules to determine:
•
•
•
The type of rule also implies the Layer at which the rule functions.
•
•
•
Note
Content rules are hierarchical. That is, if a request for content matches more than one rule, the characteristics of the most specific rule apply to the flow. The CSS uses this order of precedence to process requests for the content, with 1 being the highest match and 9 being the lowest match. The hierarchy for content rules is as follows:
1.
2.
3.
4.
5.
6.
7.
8.
9.
Note
Note
Figure 3-1 illustrates the CSS service, owner, and content rule concepts.
Figure 3-1 Services, Owners, and Content Rules Concepts
Content Rule Configuration Quick Start
Table 3-1 provides a quick overview of the steps required to create and configure a Layer 3 content rule. Each step includes the CLI command required to complete the task. For a complete description of each feature and all the content rule configuration options, see the sections following Table 3-1.
Ensure that you have already created and configured a service and owner for the content rules. The command examples in Table 3-1 create a Layer 3 content rule for owner arrowpoint.
Naming and Assigning a Content Rule to an Owner
To name a content rule and assign it to an owner, use the content command. By assigning content rules to an owner, you can manage access to the content. Assign content rules to an owner by creating the content rule in the mode for that owner. The CSS identifies content rules by the names you assign. Enter a content rule name from 1 to 31 characters.
The following example assigns:
•
•
(config-owner[arrowpoint])# content rule1Once you assign a content rule to an owner, the CLI prompt changes to reflect the specific owner and content rule mode.
(config-owner-content[arrowpoint-rule1])#Within owner and content mode, you can configure how the CSS will handle requests for the content. To remove an existing content rule from an owner, use the no content command from owner mode. For example, enter:
(config-owner[arrowpoint])# no content rule1Configuring a Virtual IP Address
Note
A Virtual IP address (VIP) is an address that an Internet Domain Name System (DNS) provides when asked to resolve a domain name. For example, a DNS server may translate www.arrowpoint.com to the VIP 192.217.4.15. Internet Service Providers (ISPs) generally assign VIPs. ISPs request VIPs from the Internet Assigned Name Authority (IANA).
Assigning a VIP to owner content enables the CSS to translate (using Network Address Translation (NAT)) the VIP to the IP address of the service where the content resides.
Note
To enable the CSS to translate an owner's Internet IP address to the IP address of the service where the content resides, configure a VIP to the owner content. By translating a VIP to the service IP address, the CSS enhances network security because it prevents users from accessing your private network IP addresses.
Caution
Note
The variables and options for the vip address command include:
•
•
Note
To configure a Virtual IP address (VIP), issue the vip address command and specify either an IP address or a host name. For example, enter:
(config-owner-content[arrowpoint-rule1])# vip address 192.168.3.6
Note
To configure a Virtual IP address (VIP) with a range of 10, use the vip address command with the range option. For example, enter:
(config-owner-content[arrowpoint-rule1])# vip address 192.168.3.6 range 10When using the vip address range command, use IP addresses that are within the subnet you are using. The CSS does not ARP for IP addresses that are not on the circuit subnet. For example, if you configure the circuit for 10.10.10.1/24 and configure the VIP range as 10.10.10.2 range 400, the CSS will not ARP for any IP addresses beyond 10.10.10.254. Using the same example with a VIP range of 200, the CSS will ARP for all IP addresses in the range.
To remove a VIP from a content rule, enter:
(config-owner-content[arrowpoint-rule1])# no vip addressshows an example of configuring a VIP. In this example, a user requests content from arrowpoint. The content physically resides on the server with IP address 10.3.6.1. By configuring VIP 158.37.6.0 to the content, the CSS translates the VIP to the server IP address where the content actually resides without exposing internal IP addresses.
Figure 3-2 Example of Configuring a Virtual IP Address
Configuring a Domain Name Content Rule
The CSS allows you to use a domain name in place of, or in conjunction with, a VIP in a content rule. Using a domain name in a content rule enables you to:
•
•
Note
To configure a domain name in a content rule, use the url command and place two slash characters (//) at the front of the quoted url_name or url_path.
For example, enter:
(config-owner-content[arrowpoint-rule1])# url "//www.arrowpoint.com/*"Normally, port 80 traffic does not use a port number in the domain name. To specify a port other than port 80, enter the domain name with the port number exactly. Separate the domain name and the port number with a colon. For example, enter:
(config-owner-content[arrowpoint-rule1])# url "//www.arrowpoint.com:8080/*"Use domain name rules rather than VIP rules when you have several transparent caches and you want certain domains to use the most powerful cache server. You want all other domains load balanced among the remaining cache servers. For this configuration, set up a domain name rule for the specific domains you want directed to the powerful cache server. Then configure a wildcard VIP rule (specify port 80 and no VIP) to balance all other HTTP traffic among the remaining caches.
You may use a single VIP in front of a server that is hosting many domain names. Over time, some of the domain names may receive more traffic and could benefit from having their content on a separate server. To segregate the traffic, configure the domain names you want directed to specific services. You do not need to configure additional VIPs for the domain names because the CSS will use the domain names as the matching criteria in the content rules.
Matching Content Rules on Multiple Domain Names
When you have a requirement for a content rule to match on multiple domain names, you can associate a Domain Qualifier List (DQL) to the rule. A DQL is a list of domain names that you configure. You can use a DQL on a rule to specify that content requests for each domain in the list will match on the rule.
You can determine the order that the domain names are listed in the DQL. You can arrange the names in a DQL by assigning an index number as you add the name to the list.
DQLs exist independently of any range mapping. You can use them as matching criteria to balance across servers that do not have IP addresses or port ranges. If you want to use range mapping when using a service range, you need to consider the index of any domain name in the DQL. If you are not using service ranges with DQLs, you do not need to configure any index and the default index is 1.
For example, you could configure a DQL named Woodworker.
(config)# dql WoodworkerThe domain names you could add as part of the DQL include www.wood.com, www.woodworker.com, www.maple.com, www.oak.com. You could configure www.wood.com and www.woodworker.com to have the same mapping index. You can enter indexes from 1 to 1000 and provide an optional quoted description for each index.
For example, enter:
(config-dql[Woodworker]# domain www.wood.com index 1 "This is the same as the woodworker domain"(config-dql[Woodworker]# domain www.woodworker.com index 1(config-dql[Woodworker]# domain www.maple.com index 2(config-dql[Woodworker]# domain www.oak.com index 3If you specify a DQL as a matching criteria for content rule WoodSites, and there are two services, S1 and S2, associated with the rule, the CSS checks the services at mapping time for ranges. To add a DQL to a content rule, use the url command as shown:
(config-owner-content[WoodSites])# url "/*" dql WoodworkerFor example, if the CSS receives a request for www.oak.com along with other criteria, a match on the WoodSites rule occurs on DQL index 3. If the rule has the roundrobin load balancing method, the CSS examines a service (S2 for this example) to determine the backend connection mapping parameters. If you configured S2 with a VIP address of 10.0.0.1 with a range of 5, the addresses include 10.0.0.1 through 10.0.0.5. Because this service has a range of addresses and 0 (any) as its port, the DQL index of 3 matches the service VIP range index of 3, which is address 10.0.0.3.
To delete a DQL, use the no dql command. For example, enter:
(config)# no dql Woodworker
Note
For a complete description of DQLs, refer to Chapter 5, Configuring Source Groups, ACLs, EQLs, URQLs, NQLs, and DQLs.
Configuring a Content Rule using a Domain Name and a Virtual IP Address
Use a domain name and a virtual IP address (VIP) in a content rule when you want the CSS to match content requests going to a specific domain at a specific VIP. If the CSS is serving more than one VIP at the domain name, configure two domain name content rules and specify the different VIPs.
This configuration is shown in the sample running-config below. Note that because the IP addresses in the example below are contiguous, you could use the vip address range command to specify a VIP range of 2.
content domainRule1vip address 192.168.1.1protocol tcpport 80url "//www.domain.com/*"add service Serv1activatecontent domainRule2vip address 192.168.1.2protocol tcpport 80url "//www.domain.com/*"add service Serv1activateIf your network topology does not require that the CSS ARP-reply for VIPs, you do not need to configure separate content rules for the domain name and VIP. In this situation, a domain name content rule without a VIP is sufficient because it will match on all content requests going to the domain regardless of the VIP.
An example of a topology where ARP-replying is not required is when an upstream router has the CSS statically configured as the next hop router for the VIPs. A domain name content rule is as follows:
content domainRule3protocol tcpport 80url "//www.domain.com/*"add service Serv1activeUsing Wildcards in Domain Name Content Rules
You can use wildcards in domain names as part of the matching criteria for a content rule. Domain name wildcards work within the content rule hierarchy. That is, if a request for content matches more than one rule (including a wildcard domain name), the characteristics of the most specific rule determine how the CSS sets up the flow.
Note
For example, the following content rule criteria have the highest precedence because, as a set, they provide the greatest specificity in matching content:
Domain name, IP address, protocol, port, URL
If you want to create a content rule using all these criteria, such as the configuration shown below, then the content rule matches only on the JPEG files that are found in the domain whose name starts with "arr", as well as the other criteria, including VIP address, protocol, and port number.
(config-owner-content[arrowpoint-rule1])# vip address 192.168.3.6(config-owner-content[arrowpoint-rule1])# protocol tcp(config-owner-content[arrowpoint-rule1])# port 80(config-owner-content[arrowpoint-rule1])# url "//arr*.com/*.jpg"When the CSS encounters a content rule with a wildcard domain name and matches according to the content rule hierarchy, it stops the search at that point. This behavior is consistent with the way that the CSS manages content rules in general.
For example, if the content request matches on the rule with VIP address 192.168.3.6 and URL /*, the CSS does not continue the search to match on a second rule with a wildcard VIP address (no address specified) and a URL of /*.jpg. The specific address match makes the first rule more specific than the second rule.
To further clarify, if the match occurs on a rule with //arrowpoint*.com/*, the search stops at that point and does not continue to match on a rule with //arr*.com/*.gif, because the first rule is a more specific match. Also note that a fully-specified domain name rule (arrowpoint.com) is more specific than a wildcard domain name rule (arr*.com).
For example, to have the content rule match on all instances of the text string "arr" in the domain name portion of the content rule, enter:
(config-owner-content[arrowpoint-rule1])# url "//www.arr*.com/*"General Guidelines for Domain Name Wildcards in Content Rules
A domain name is made up of text strings called "words" and word separators called "dots" (.). The CSS parses the domain name from right word to left word. The CSS allows wildcards to be used as part of the domain name in one word or more than one word, but the wildcard cannot start the word.
For example, the CSS supports the following domain names:
•
•
•
•
Notice that the wildcard character either appears by itself as a domain word, or appears to the right of any characters that start a domain word. However, a wildcard character cannot start a domain name word.
For example, point.com:
•
•
•
Note
Adding Services to a Content Rule
To add an existing service to a content rule, use the add command. Adding a service to a content rule includes it in the resource pool that the CSS uses for load balancing requests for content. The maximum number of services that you can add into a single content rule is 64. Note that a service may belong to multiple content rules. To see a list of services you can add to a content rule, use add service ? command.
Note
The add service command enables you to add the following types of services to a content rule:
•
•
•
When you configure a Layer 3 or 4 content rule, the rule hits the local services. If:
•
•
Redirect services and redirect content strings cannot be used with Layer 3 or 4 rules because they use the HTTP protocol.
When you configure a Layer 5 content rule, the CSS directs content requests to local services. If:
•
•
•
For information on configuring service types, refer to Chapter 1, Configuring Services, "Specifying a Service Type".
Note
Adding a Service to a Content Rule
Use the add service command to add a service to a content rule. The maximum number of services that you can add into a single content rule is 64.
For example, enter:
(config-owner-content[arrowpoint-rule1])# add service serv2Specifying a Service Weight
When you add a service to a content rule, you can assign a weight for the service using the add service weight option. The CSS uses this weight when you configure ACA or weighted roundrobin load balancing on the content rule. When you assign a higher weight to the service, the CSS redirects more requests to the service.
To set the weight for a service, enter a number from 1 to 10. The default is the weight configured for this service through the (config-service) weight command. By default, all services have a weight of 1.
For example, enter:
(config-owner-content[arrowpoint-rule1])# add service serv2 weight 3
Note
Adding a Primary Sorry Server to a Content Rule
Use the primarySorryServer command to configure the primary sorry service for a content rule. The CSS directs content requests to the primary sorry server when all other services are unavailable. You can configure this service to contain content, or to provide a drop or redirect message. This service is not used in load balancing.
Note
Enter the server name as a case-sensitive unquoted text string with no spaces.
Note
For example, enter:
(config-owner-content[arrowpoint-rule1])# primarySorryServer slowserverTo remove a primary sorry service, enter:
(config-owner-content[arrowpoint-rule1])# no primarySorryServerAdding a Secondary Sorry Server to a Content Rule
Use the secondarySorryServer command to configure the secondary sorry service for a content rule. A secondary sorry service is a backup service the CSS uses when the primary sorry service is unavailable. You can configure this service to contain content, or to provide a drop or redirect message. This service is not used in load balancing.
Enter the server name as a case-sensitive unquoted text string with no spaces.
Note
For example, enter:
(config-owner-content[arrowpoint-rule1])# secondarySorryServer slowestserverTo remove a secondary sorry service, enter:
(config-owner-content[arrowpoint-rule1])# no secondarySorryServerAdding a Domain Name System to a Content Rule
To specify a DNS name that maps to a content rule, use the add dns command. The options for this command are:
•
1 to 31 characters.•
Note
For example, enter:
(config-owner-content[arrowpoint-rule1])# add dns arrowpoint 120To remove a DNS name mapped to the content rule, enter:
(config-owner-content[arrowpoint-rule1])# remove dns arrowpoint
Note
Disabling a Domain Name System in a Content Rule
To disable DNS in a content rule, use the dns-disable-local command. The CSS informs other CSSs through an Application Peering Protocol (APP) session that the services related to the content rule are not available for DNS activities. However, the services remain active for other functions.
For example, to disable DNS for a specific content rule, enter:
(config-owner-content[arrowpoint-rule1])# dns-disable-localTo enable DNS in the content rule, use the no dns-disable-local command. For example, enter:
(config-owner-content[arrowpoint-rule1])# no dns-disable-localActivating a Content Rule
Activating content enables the CSS to provide access to the content. To activate content, use the active command in the content mode to activate specific content.
Note
For example, enter:
(config-owner-content[arrowpoint-rule1])# activeSuspending a Content Rule
Suspending a content rule deactivates it. Suspending a content rule:
•
•
To suspend a content rule, use the suspend command in content mode. For example, enter:
(config-owner-content[arrowpoint-rule1])# suspendRemoving a Content Rule
To remove an existing content rule, use the no content command from owner mode. For example, enter:
(config-owner[arrowpoint])# no content rule1Removing a Service from a Content Rule
To remove an existing service from a content rule, use the remove command from owner-content mode. Removing a service removes it from the resource pool that the CSS uses for balancing the load of requests for content governed by a rule. When you remove a service, the remaining services are rebalanced.
For example, enter:
(config-owner-content[arrowpoint-rule1])# remove service serv1Configuring a Protocol
Specifying a protocol in a content rule enables the CSS to direct requests for content associated with the content rule to use a specific protocol. You may specify the following protocols for content:
•
•
•
To configure the TCP protocol for content, enter:
(config-owner-content[arrowpoint-rule1])# protocol tcpTo reset the protocol to the default of any, enter:
(config-owner-content[arrowpoint-rule1])# no protocolConfiguring a Port
Specifying a port enables the CSS to associate a content rule with a specific TCP/UDP port number. Specify a port number ranging from 0 to 65535. The default is 0, which indicates any port.
To configure a port for content, enter:
(config-owner-content[arrowpoint-rule1])# port 80To reset the port number to the default of 0 value, enter:
(config-owner-content[arrowpoint-rule1])# no portConfiguring Load Balancing
To specify the load-balancing algorithm for a content rule, use the balance command available in content configuration mode. The options are:
•
•
•
•
Note
•
We do not recommend that you use UDP content rules with the leastconn load-balancing algorithm. The service connection counters do not increment and remain at 0 because UDP is a connectionless protocol. Because the counters remain at 0, the CSS will give inconsistent results.
•
•
•
•
•
Note
In a transparent caching environment (for example, no VIP address on a Layer 5 content rule), the CSS bypasses these HTTP methods, and they are forwarded to the destination server.For example, to specify weightedrr load balancing, enter:
(config-owner-content[arrowpoint-rule1])# balance weightedrrTo revert the balance type to the default of roundrobin, enter:
(config-owner-content[arrowpoint-rule1])# no balanceConfiguring a DNS Balance Type
Use the dnsbalance command to determine where to resolve a request for a domain name into an IP address. The syntax and options for this content mode command are:
•
•
•
•
For example, enter:
(config-owner-content[arrowpoint-rule1])# dnsbalance roundrobinTo restore the DNS balance type to the default setting of using the owner's method, enter:
(config-owner-content[arrowpoint-rule1])# no dnsbalanceConfiguring Hotlists
Use the hotlist command to define a hotlist that lists the content most requested (hot content) during a user-defined period of time. The CSS enables you to configure hotlist attributes for content rules. Defining hotlist attributes for a content rule enables you to determine which content is heavily accessed. With this information, you can accurately determine which content should be replicated.
Note
You can configure the following attributes for hotlists for specific content from config-owner-content mode:
•
(config-owner-content[arrowpoint-rule1])# hotlistTo disable a hotlist, enter:
(config-owner-content[arrowpoint-rule1])# no hotlist•
(config-owner-content[arrowpoint-rule1])# hotlist interval 10To restore the hotlist interval to the default of 1, enter:
(config-owner-content[arrowpoint-rule1])# no hotlist interval•
(config-owner-content[arrowpoint-rule1])# hotlist size 10To restore the hotlist size to the default of 10, enter:
(config-owner-content[arrowpoint-rule1])# no hotlist size•
(config-owner-content[arrowpoint-rule1])# hotlist threshold 9To restore the hotlist threshold default of 0, enter:
(config-owner-content[arrowpoint-rule1])# no hotlist threshold•
(config-owner-content[arrowpoint-rule1])# hotlist type hitcountTo restore the hotlist type to the default setting hitCount, enter:
(config-owner-content[arrowpoint-rule1])# no hotlist typeTo display hotlist information, use the show domain hotlist command. Table 3-2 describes the fields in the show domain hotlist output.
Configuring a Domain Hotlist
Use the domain command to enable the domain hotlist and configure domain hotlist parameters. A domain hotlist lists the most accessed domains on a CSS during a user-defined period of time. The syntax and options are:
•
•
•
•
To enable a domain hotlist, enter:
(config)# domain hotlistTo disable the domain hotlist, enter:
(config)# no domain hotlistTo display the domain hotlist and its configuration, use the show domain hotlist command (see Table 3-2).
Specifying a Uniform Resource Locator
Use the url command to specify the Uniform Resource Locator (URL) for content and enable the CSS to access a remote service when a request for content matches the rule. Enter the URL as a quoted text string with a maximum length of 252 characters. Before you can change the URL for the content rule, you must remove the current URL first.
Note
The syntax and options for this content mode command are:
•
•
•
•
The variables are:
•
To specify a domain name, place two slashes (//) at the beginning of the URl. For example, "//www.arrowpoint.com/*" allows the rule to match on HTTP traffic that contains the www.arrowpoint.com domain name in the HTTP host tag.
Normally, port 80 traffic does not use a port number in the domain name. To specify a port other than port 80, enter the domain name with the port number exactly. Separate the domain name and the port number with a colon. For example, enter:
(config-owner-content[arrowpoint-rule1])# url "//www.arrowpoint.com:8080/*"To use stickiness based on Secure Socket Layer (SSL) session ID, set the URL to /*. Also, set the port to 443 with the (config-owner-content) port command and enable stickiness with the (config-owner-content) advanced-balance ssl command. Then specify an SSL application type.
You can specify certain wildcard operations for wildcard matching. Use a "*" character to specify a wildcard match. You can specify a maximum of eight directories. Each directory name can be a maximum of 32 characters with a total maximum of 252 characters in the URL. You can specify only one wildcard per URL.
Examples of supported wildcards are:
•
•
•
•
•
–
–
For example, "/announcements/new/*".
•
•
Note
For example, to specify a URL that matches all requests for content in the announcements directory with .html extensions, enter:
(config-owner-content[arrowpoint-products.html])# url "/announcements/*.html"To remove a URL, enter:
(config-owner-content[arrowpoint-products.html])# no urlTo remove a URQL from a URL, enter:
(config-owner-content[arrowpoint-products.html])# no url urqlTo display a URL for a content rule, use the show rule command for the content rule.
Specifying an Extension Qualifier List in a Uniform Resource Locator
Server selections are based on the Uniform Resource Locator (URL) specified in the owner content rule. To enable the CSS to access a service when a request for content matches the extensions contained in a previously defined EQL, specify the URL and EQL name for the content. For information on creating an EQL, refer to Chapter 5, Configuring Source Groups, ACLs, EQLs, URQLs, NQLs, and DQLs.
Specify a URL as a quoted text string with a maximum of 252 characters followed by eql and the EQL name.
Note
For example, enter:
(config-owner-content[arrowpoint-products.html])# url "/*" eql graphicsThe following example enables the CSS to direct all requests to the correct service for content that matches:
•
•
(config-owner-content[arrowpoint-products.html])# url "/customers/products/*" eql graphicsTo display a content rule EQL, use the show rule command.
Specifying the Number of Spanned Packets
Use the spanning-packets command to configure the number of packets spanned for the search of the HTTP header termination string. In some environments, URL, cookie strings, or HTTP header information can span over multiple packets. In these environments, the CSS can parse up to 20 packets for Layer 5 information before making load balancing decision. By default, the CSS parses 6 packets.
The CSS makes the load-balancing decision as soon as it finds a match and does not require parsing of all of the configured number of spanned packets. Because parsing multiple packets does impose a longer delay in connection, performance can be impacted by longer strings that span mulitple packets.
To change the number of packets, enter a number from 1 to 20. The default value is 6. For example, to configure the number of packets spanned to 10, enter:
(config)# spanning-packets 10To reset the number of packets spanned to the default value of 6, enter:
(config)# no spanning-packetsSpecifying a Load Threshold
Use the load-threshold command to set the normalized load threshold for the availability of each local service on a content rule. When the service load metric exceeds this threshold, the local service becomes unavailable and is redirected to remote services. To define a remote service, use the service mode type redirect command (refer to Chapter 1, Configuring Services, "Specifying a Service Type").
Enter the load threshold as an integer from 2 to 254. The default is 254, which is the maximum threshold a service can reach before becoming unavailable. To view the load on services, use show service. For example, enter:
(config-owner-content[arrowpoint-rule1])# load-threshold 100To reset the load threshold to its default value of 254, enter:
(config-owner-content[arrowpoint-rule1])# no load-thresholdRedirecting Requests for Content
Use the redirect command to set HTTP status code 302 for a content rule and specify the alternate location of the content governed by a rule. Use this command to:
•
•
Note
Do not configure a service for a redirect-only content rule.For example, enter:
(config-owner-content[arrowpoint-rule1])# redirect "//www.arrowpoint.com/newlocation.html"To delete the redirect URL, enter:
(config-owner-content[arrowpoint-rule1])# no redirectEnabling TCP Flow Reset Reject
Use the flow-reset-reject command to enable the CSS flow manager subsystem to send a TCP RST (reset) frame when a flow for requested content is mapped to a destination IP address that is no longer reachable. The flow-reset-reject command prevents a CSS client from hanging up and retransmitting when the request can never be serviced. In addition, for UDP flows the command allows the CSS to purge the flow cache of the UDP flow so that another request gets remapped to a different IP address, if necessary, without attempting to use the previously mapped IP address. The flow-reset-reject command is applied on a per content rule basis.
Use the no form of this command to disable the sending of the TCP RST frame to the client.
To enable the CSS to send a TCP RST frame, enter:
(config-owner-content[rule1])# flow-reset-rejectTo reset the CSS back to the default state of not sending a TCP RST frame, enter:
(config-owner-content[rule1])# no flow-reset-rejectConfiguring Persistence, Remapping, and Redirection
During the life of a persistent connection, a CSS must determine if it needs to move a client connection to a new service based on content rules, load balancing, and service availability. In some situations, moving the client connection is not necessary; in other situations, it is mandatory. This section describes how to configure the CSS to make these decisions using:
•
•
•
•
Content Rule Persistence
When a CSS receives a request for content from a client, the software checks if the request matches on a content rule to determine the best service to handle the request. If the request matches on a content rule, the CSS establishes a client connection to the best service specified by the content rule. By default, the CSS keeps the client on the same connection for an entire flow session as long as a new content request:
•
•
This CSS behavior is known as content rule persistence. If you are using transparent caches (which prefetch content) or mirrored-content servers, this scheme works well because the same content is available on each service.
Use the persistent command in content configuration mode to maintain a persistent connection with a server as long as the above criteria are met. By default, persistence is enabled. Disabling persistence allows the CSS to move a connection to a better service on the same rule or to use cache bypass functionality (EQLs or failover bypass).
For example, enter:
(config-owner-content[arrowpoint-rule1])# persistentUse the no persistent command on a content rule with:
•
•
•
•
•
To disable persistence:
(config-owner-content[arrowpoint-rule1])# no persistent
Note
Configuring Bypass Persistence
If a CSS bypasses a service (for example, a transparent cache is down and failover bypass is configured) and the next content request on the same TCP connection matches on a content rule that contains the transparent cache that was down, the CSS will continue to bypass the cache, by default, even after the bypassed cache is back online. In this case, the CSS typically sends the content request to the origin server. This behavior is called bypass persistence.
You can configure the CSS to redirect or remap a bypassed connection using the bypass persistence global config command in conjunction with the persistence reset command.
Use the bypass persistence command to determine if the CSS performs either a remapping or redirection operation to reset a bypassed service when a content request matches on a content rule, but a previous request caused the bypass. This global command affects all flows. By default, bypass persistence is enabled.
For example, enter:
(config)# bypass persistence disableThe CSS uses remapping or redirection to reset the connection according to the setting of the persistence reset method.
(config)# bypass persistence enableThe CSS does not use remapping or redirection to reset the connection and continues to bypass a service.
Configuring HTTP Redirection and Service Remapping
If you need to place different content on different servers (for example, to conserve server disk space, for load-balancing considerations, or when using proxy caches), content rule persistence is not useful. In this case, you can disable persistence by using the no persistent command, described in "Content Rule Persistence" earlier in this section.
When the CSS receives a request for content that is not available on the current service, it must reset the current connection to the service and establish a new connection to another service (for example, a different proxy cache or the origin server) that contains the requested content. You can accomplish this in either of the following ways:
•
•
Note
Use the persistence reset command with the content rule no persistent command to cause an HTTP redirection or perform a back-end remapping operation when resetting a connection to a new back-end service. The global persistence reset command affects all flow setups that require redirection or remapping.
For example, to enable redirection:
(config)# persistence reset redirectFor example, to enable service remapping:
(config)# persistence reset remap
Note
Specifying an HTTP Redirect String
Use the redirect-string command to specify an HTTP redirect string to be used when an HTTP redirect service generates an "object moved" message for the service. The CSS uses the entire configured redirect string as the new location for the requested content. If no string is configured, the CSS prepends the domain configured with the (config-service) domain command to the original request. If neither the redirect string nor the domain name are configured, the CSS uses the domain in the host-tag field from the original request combined with the requested HTTP content. If no host tag is found, the CSS uses the IP address of the service to generate the redirect.
Note
Note
Note
The syntax for this service mode command is:
redirect-string string
Enter the HTTP redirect string as a quoted or an unquoted text string with no spaces and a maximum length of 64 characters. Use quotation marks when you want to include a question mark in the string.
For example, enter:
(config-service[serv1])# redirect-string www.arrowpoint.comTo remove the redirect string from the service, enter:
(config-service[serv1])# no redirect-string www.arrowpoint.comUsing Show Remap
Use the show remap command to display the configured persistence reset and bypass persistence settings. This command is available in all modes except RMON, URQL, and VLAN configuration modes.
Table 3-3 describes the fields in the show remap output.
Defining Failover
Note
To define how the CSS handles content requests when a service fails or is suspended, use the failover command. For the CSS to use this setting, ensure that you configure a keepalive for each service; that is, do not set the keepalive type to none (the keepalive default is ICMP). The CSS uses the keepalive settings to monitor the services to determine server health and availability.
The failover command applies to the following caching load balancing types:
•
•
•
•
•
•
Note
This command supports the following options:
•
•
•
For example, enter:
(config-owner-content[arrowpoint-rule1])# failover bypassTo restore the default setting of failover linear, enter:
(config-owner-content[arrowpoint-rule1])# no failoverFigure 3-3 shows three cache services configured for failover next. If ServerB fails, the CSS sends ServerB content requests to ServerC, which was configured after ServerB in the content rule.
Figure 3-3 ServerB Configured for Failover Next
As shown in Figure 3-4, if ServerC fails, the CSS sends ServerC content requests to ServerA because no other services were configured after ServerC.
Figure 3-4 ServerC Configured for Failover Next
Figure 3-5 shows three cache services configured for failover linear. If you suspend ServerB or if it fails, the CSS does not rebalance the services. It evenly distribute ServerB cache workload between servers A and C.
Note that Figure 3-5 and Figure 3-6 use the alphabet to illustrate division balance.
Figure 3-5 Suspended or Failed Service Configured for Failover Linear
Figure 3-6 also shows three cache services configured for failover linear, but in this example, you remove ServerB using the remove service command from owner-content mode. Because the CSS does not apply the failover setting when you remove a service, it rebalances the remaining services.
Figure 3-6 Removing a Service Configured for Failover Linear
Specifying an Application Type
To specify the application type associated with a content rule, use the application command. The application type enables the CSS to correctly interpret the data stream to match and parse the content rule. Otherwise, the data stream packets are rejected. Define an application type for non-standard ports.
When configuring Layer 5 content rules for an application other than HTTP, use the appropriate application type to enable the Layer 5 rule to function.
Note
The application command enables you to specify the following application types:
•
•
•
•
•
Note
Note
For example, in a content rule that specifies port 21, you may want to configure the application type as ftp-control. Configuring the content rule to application type ftp-control instructs the CSS to process only FTP requests coming into port 21.
(config-owner-content[arrowpoint-rule1])# application ftp-controlFor example, the following owner portion of a startup-config shows a content rule configured for application ftp-control.
!************************** OWNER **************************owner arrowpointcontent ftprulevip address 192.3.6.58protocol tcpport 21application ftp-controladd serv1add serv3activeTo remove an application type, enter:
(config-owner-content[arrowpoint-rule1])# no applicationEnabling Content Requests to Bypass Transparent Caches
Use the param-bypass command to enable content requests to bypass transparent caches when the CSS detects special terminators in the requests. These terminators include "#" and "?" which indicate that the content is dependent on the arguments that follow the terminators. Because the content returned by the server is dependent on the content request itself, the returned content is deemed as not cacheable, and the content request is directed to the origin server.
This command contains the following options:
•
•
For example, to enable the param-bypass command, enter:
(config-owner-content[arrowpoint-rule1])# param-bypass enableShowing Content
The show content command enables you to display content entries in the Content Service Database (CSD) of the 11500 series CSS. This command is available in all modes.
To display content from a specific module, and content entry location, in either the CSS 11503 or CSS 11506, specify the show content command as follows:
show content slot slot_number {start-index index_number}
The variables and options are:
•
•
Use the show content command with no options or variables to show all content entries in the Content Service Database for a CSS 11501, 11503, or 11506.
For example, to look at the content from the module in CSS 11503 chassis slot 2, starting at index 150, enter:
(config)# show content slot 2 start-index 150Table 3-4 describes the fields in the show content output.
Note
Showing Content Rules
The show rule command displays content rule information for specific content rules or all content rules currently configured in the CSS. Use the following show rule commands from any mode:
•
•
•
•
•
•
•
•
•
•
•
•
To display all content rule information, enter:
# show ruleTo display the summary for all content rules, enter:
# show rule-summaryTo display all rule attributes for an owner, enter:
# show rule owner content_rule all
Note
Table 3-5 describes the fields in the show rule output.
Table 3-5 Field Descriptions for the show rule Command
Name
The name of the content rule.
Owner
The owner of the rule.
Author
The author (Local CSS or remote CSS peer) of the rule.
Index
A CSS assigned unique index for the rule. The number is based in the order that the rule was created.
State
The state of the rule (active or suspend).
Type
The application type associated with the rule. The possible values are:
•
•
•
•
•
L3
Destination IP address.
L4
Destination protocol and port.
URL
The URL for the content.
URQL
The name of the associated URL Qualifier list.
EQL
The name of the associated EQL.
DQL
The name of the associated DQL.
Header Field Group
The name of the associated header-field group.
Total Bytes
Total bytes to the content rule.
Total Frames
Total frames to the content rule.
Total Redirects
Total redirects by the content rule (when the redirect command is configured for a content rule). This field increments whenever a request for content is redirected to an alternate location.
Total Rejects
Total rejects by the content rule. This field increments when all services for a content rule are unavailable.
Overload Rejects
Total rejects on the content rule due to overload on the rule's available services.
Balance
The load-balancing algorithm for the content rule. The possible values are:
•
•
•
•
Balance (continued)
•
•
•
•
•
•
Advanced Balance
The advanced load-balancing method for the content rule, including stickiness (as described in Chapter 4, Configuring Sticky Parameters for Content Rules). The possible values are:
•
•
•
Advanced Balance (continued)
•
•
•
•
•
Sticky Mask
The subnet mask used for stickiness. The default is 255.255.255.255.
Sticky Inactivity timeout
The inactivity timeout period on a sticky connection for a content rule before the CSS removes the sticky entry from the sticky table. The range is from 0 to 65535 minutes. The default value is 0, which means this feature is disabled.
Sticky No Cookie Found Action
The action the CSS should take for a sticky cookie content rule when it cannot locate the cookie header or the specified cookie string in the client request. The possible values are:
•
•
•
•
Sticky Server Down Failover
The action that the CSS should take when a sticky string is found but the associated service has failed or is suspended. The possible values are:
•
•
•
•
•
ArrowPoint Cookie Path
The pathname where you want to send the ArrowPoint cookie. The default path of the cookie is "/".
ArrowPoint Cookie Expiration
The expiration time that the CSS compares with the time associated with the ArrowPoint cookie. If you do not set an expiration time, the cookie expires when the client exits the browser.
String Match Criteria
The string criteria to derive string results and the method to choose a destination server for the result. The string result is a sticky string in the cookie header, URL, or URL extension based on a sticky type being configured. See the following fields.
String Range
The starting and ending byte positions within a cookie, URL, or URL extension from a client. By specifying the range of bytes, the CSS processes the information located only within the range.
•
•
String Prefix
The string prefix located in the sticky range. If you do not configure the string prefix, the string functions start from the beginning of the cookie, URL, or URL extension, depending on the sticky type. If the string prefix is configured but is not found in the specified sticky range, load balancing defaults to the roundrobin method. The default has no prefix ("").
String Eos-Char
The ASCII characters as the delimiters for the sticky string.
String Ascii-Conversion
Whether to enable or disable the ASCII conversion of escaped special characters within the specified sticky range before applying any processing to the string. By default, ACSII conversion is enabled.
String Skip-Len
The number of bytes to skip after the end of the prefix to find the string result. The default is 0. The range is from 0 to 64.
String Process-Len
The number of bytes, after the end of the prefix designated by the string prefix command and skipping the bytes designated by the string skip-length command, that the string operation will use. The range is from 0 to 64. The default is 0.
String Operation
The method to choose a destination server for a string result; derived from the settings of the string criteria commands. The possible values are:
•
•
•
•
Redirect
Text used to build an HTTP 302 redirect message that is sent to the client when the rule is matched.
Persistence
Whether or not a persistent connection with a server is maintained. By default, persistence is enabled.
Param-Bypass
Whether or not content requests bypass transparent caches when the CSS detects special terminators in the requests. These terminators include "#" and "?" which indicate that the content is dependent on the arguments that follow the terminators. Bypass is disabled by default.
Session Redundancy
Indicates whether Adaptive Session Redundancy (ASR) is enabled or disabled on the rule. For details on ASR, refer to the Cisco Content Services Switch Advanced Configuration Guide.
Redund Glb Index
The unique global index value for Adaptive Session Redundancy assigned to the content rule using the redundant-index command in owner-content configuration mode.
IP Redundancy
The state of IP redundancy if configured on the rule. Possible values are: Master, Backup, or Down. If IP redundancy is not configured, the state is Not Redundant.
Flow Timeout Multiplier
Number of seconds that a flow remains idle before the CSS reclaims the flow resources, as configured with the flow-timeout-multiplier command. For details on the flow-timeout-multiplier command, refer to the Cisco Content Services Switch Administration Guide.
Rule Services
Content rule services to configuration and statistic information, as follows.
Local Load Threshold
The normalized load threshold for the availability of each local service on the content rule. When the service load metric exceeds this threshold, the local service becomes unavailable and is redirected to the remote services. The range is from 2 through 254. The default is 254, which is the maximum load. A load of 255 indicates that the service is down
PrimarySorryServer
The primary service to be used when all other services for the content rule are unavailable.
SecondSorryServer
The secondary service to be used when all other services for the content rule are unavailable.
Name
The names of the services.
Hits
The number of content hits on the service.
Wgt
The weight for the service used when you configure ACA, weighted roundrobin, and DFP load balancing on the content rule. With a higher weight, the CSS redirects more requests to the service. The letters preceding the weight numbers have the following meanings:
•
•
•
State
The state of the service.
Ld
The service load. The range is from 2 to 255. 255 indicates that the service is unavailable.
KAlive
The service keepalive type.
Conn
The number of connections currently mapped to the service.
DNS
The number of times that the CSS DNS resolver chose the service as the answer to a DNS client query.
DNS Names
Domain Name System names.
DNS TTL
The time to Live value in seconds, which determines how long the DNS client remembers the IP address response to the query.
DNS Balance
Where the CSS resolves a request for a domain name into an IP address. The possible values are:
•
•
•
•
Hotlist
Whether or not hotlist is enabled.
Size
The total number of hotlist entries that is maintained for the rule. The range is from 1 to 100. The default is 10.
Type
The hotlist type. Currently, the CSS supports only the hit count hotlist type, which is the default setting. Hit count is the number of times that the content is accessed.
Threshold
The hit count per interval threshold below which content is not considered hot. The range is from 0 to 65535. The default is 0.
Interval
The interval, in minutes, for refreshing the hotlist. The range is from 1 to 60. The default is 1.
Associated ACLs
The ACLs associated with a content rule.
TCP RST Client If Service Unreachable
Whether or not the flow-reset-reject command is enabled to allow the CSS's flow manager subsystem to send a TCP RST (reset) frame when a flow is mapped to a service that is no longer reachable. By default, the flow-reset-reject command is disabled.
Clearing Counters in a Content Rule
The CSS allows you to clear counters:
•
•
Use the zero command and its options to clear the counters for content rules or services associated with content rules, and set the counters to zero.
This section covers:
•
•
Clearing Counters for Content Rules
To reset the counters for all content rules to zero, use the zero all command. The reset counter statistics appear as zero in the show summary display.
Note
For example, enter:
(config-owner-content[rule1])# zero allClearing Service Statistics Counters in a Content Rule
To clear a service statistics counter for all CSS services associated with a content rule, use the zero command. To clear a service statistics counter for a specific service in the content rule, use the zero command and identify the name of the service. In this case, only the counter for the specified service is set to zero.
The reset statistics appear as 0 in the show service display.
You can issue the following zero commands from content mode:
•
•
•
You can issue the following zero commands from content mode:
•
•
•
For example, to clear a counter for all services associated with the specified content rule, enter:
(config-owner-content[rule1])# zero total-connectionsFor example, to clear a counter for a specific service in a content rule, enter:
(config-owner-content[rule1])# zero total-connections service serv1Where to Go Next
Once you create content rules you can configure sticky parameters for the content rules. For information on configuring sticky parameters, refer to Chapter 4, Configuring Sticky Parameters for Content Rules.
