Table Of Contents
Configuring Active Health Probes
Defining an Active Probe and Accessing Probe Configuration Mode
Configuring General Probe Attributes
Configuring a Probe Description
Configuring the Destination IP Address
Configuring the Time Interval Between Probes
Configuring the Retry Count for Failed Probes
Configuring the Wait Period and Threshold for Successful Probes
Configuring the Wait Interval for the Opening of the Connection
Configuring the Timeout Period for a Probe Response
Configuring the Termination of the TCP Connection
Configuring an Expected String from the Server
Configuring Data that the Probe Sends to the Server Upon Connection
Configuring the Credentials for a Probe
Configuring the Header Field for the HTTP Probe
Configuring the HTTP Method for the Probe
Configuring the Status Code from the Destination Server
Configuring the Cipher Suite for the HTTPS Probe
Configuring the Supported SSL or TLS Version
Configuring the Status Code from the Destination Server
Configuring the Expected IP Address
Configuring the Status Code from the Destination Server
Configuring the Username Credentials
Configuring the Method for the Probe
Configuring the Credentials for a Probe
Configuring the Method for the Probe
Configuring the Credentials and Shared Secret for a Probe
Configuring the Network Access Server IP Address
Associating a Script with a Probe
Clearing Statistics for Individual Probes
Clearing All Probe Statistics in a Context
Configuring Health Monitoring
Health monitoring on the ACE tracks the state of a server by sending out probes. Also referred as out-of-band health monitoring, the ACE verifies the server response or checks for any network problems that can prevent a client from reaching a server. Based on the server response, the ACE can place the server in or out of service, and can make reliable load balancing decisions.
You can also use health monitoring to detect failures for a gateway or host in high availability configurations. For more information, see the Cisco Application Content Engine Module Administration Guide.
The ACE identifies the health of a server in the following categories:
•
Passed—The server returns a valid response.
•
By configuring the ACE for health monitoring, the ACE sends active probes periodically to determine the server state. The ACE supports 4096 unique probe configurations which includes ICMP, TCP, HTTP, and other predefined health probes. The ACE also allows the opening of 1000 sockets simultaneously.
You can associate the same probe with multiple real servers or server farms. Each time that you use the same probe again, the ACE counts it as another probe instance. You can allocate a maximum of 16 K probe instances.
This chapter contains the following sections:
•
Configuring Active Health Probes
By default, no active health probes are configured on the ACE. You can configure health probes on the ACE to actively make connections and explicitly send traffic to servers. The probes determine whether the health status of a server passes or fails by its response.
Configuring active probes is a three-step process:
•
•
–
–
–
•
For information on associating a probe with a real server or a server farm, and putting it into service, see the Chapter 2, Configuring Real Servers and Server Farms.
You can also configure one or more probes to track a gateway or host. For more information, see the Cisco Application Content Engine Module Administration Guide.
Defining an Active Probe and Accessing Probe Configuration Mode
When you initially configure a health probe, you define its type and name. The CLI then enters the probe configuration mode, which allows you to configure the attributes for the probe type.
To define a probe and access its configuration mode, use the probe command in configuration mode. The syntax of this command is:
probe probe_type probe_name
The arguments are:
•
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
•
For example, to define a TCP probe named PROBE1 and access the TCP probe configuration mode, enter:
host1/Admin(config)# probe tcp PROBE1host1/Admin(config-probe-tcp)#To delete a TCP probe named PROBE1, enter:
host1/Admin(config)# no probe tcp PROBE1There are some probe attributes and associated commands that apply to all probe types. For information on configuring these attributes, see the "Configuring General Probe Attributes" section.
Configuring General Probe Attributes
When you access probe configuration mode to configure the attributes for the probe, the ACE provides a set of commands that you can configure for all probe types, except as indicated. The following sections describes how to configure the general attributes for a probe:
•
•
•
•
•
•
•
Configuring a Probe Description
To provide a description for a probe, use the description command. This command is available for all probe-type configuration modes. The syntax of this command is:
description text
The text argument provides a description of the probe. Enter a text string with a maximum of 240 characters.
For example, to configure a description THIS PROBE IS FOR TCP SERVERS, enter:
host1/Admin(config-probe-type)# description THIS PROBE IS FOR TCP SERVERSTo remove the description for the probe, use the no description command. For example, enter:
host1/Admin(config-probe-type)# no descriptionConfiguring the Destination IP Address
By default, the probe uses the IP address from the real server or server farm configuration for the destination IP address. To configure the destination address that the probe uses, use the ip address command. This command is available for all probe-type configuration modes except scripted. The syntax of this command is:
ip address ip_address [routed]
The argument and option are:
•
•
For example, to configure an IP address of 192.8.12.15, enter:
host1/Admin(config-probe-type)# ip address 192.8.12.15To reset the default behavior of the probe using the IP address from the real server or server farm configuration, use the no ip address command. For example, enter:
host1/Admin(config-probe-type)# no ip addressConfiguring the Port Number
By default, the probe uses the port number based on its type. Table 4-1 lists the default port numbers for each probe type.
To configure the port number that the probe uses, use the port command. This command is available for all probes probe-type configuration modes except ICMP. The syntax of this command is:
port number
The number argument is the number of the port. Enter a number from 1 to 65535.
For example, to configure a port number of 88 for an HTTP probe, enter:
host1/Admin(config-probe-http)# port 88To reset the port number to its default value, use the no port command. For example, to remove an HTTP probe port number of 88 and reset an HTTP probe port number to its default setting of 80, enter:
host1/Admin(config-probe-http)# no portConfiguring the Time Interval Between Probes
The time interval between probes is the frequency that the ACE sends probes to the server marked as passed. To change the time interval between probes, use the interval command. This command is available for all probe-type configuration modes. The syntax of this command is:
interval seconds
The seconds argument is the time interval in seconds. Enter a number from 2 to 65535. By default, the time interval is 120.
Note
For example, to configure a time interval of 50 seconds, enter:
host1/Admin(config-probe-type)# interval 50To reset the time interval to the default setting of 120, use the no interval command. For example, enter:
host1/Admin(config-probe-type)# no intervalConfiguring the Retry Count for Failed Probes
Before the ACE marks a server as failed, it must detect that probes have failed a consecutive number of times. By default, when three consecutive probes have failed, the ACE marks the server as failed. To configure this number of failed probes, use the faildetect command. This command is available for all probe-type configuration modes. The syntax of this command is:
faildetect retry_count
The retry_count argument is the consecutive number of failed probes before marking the server as failed. Enter a number from 1 to 65535. By default, the count is 3.
For example, to configure the number of failed probes at 5 before declaring the server as failed, enter:
host1/Admin(config-probe-type)# faildetect 5To reset the number of probe failures to the default setting of 3, use the no faildetect command. For example, enter:
host1/Admin(config-probe-type)# no faildetectConfiguring the Wait Period and Threshold for Successful Probes
After the ACE marks a server as failed, it waits a period of time and then sends a probe to the failed server. When the ACE receives a number of consecutive successful probes, it marks the server as passed. By default, the ACE waits 300 seconds before sending out a probe to a failed server and marks a server as passed if it receives 3 consecutive successful responses.
To configure the time interval to send a probe to a failed server and the number of probes to mark the server as passed, use the passdetect command. This command is available for all probe-type configuration modes. The syntax of this command is:
passdetect {interval seconds | count number}
The arguments are:
•
•
Note
For example, to configure wait interval at 10 seconds, enter:
host1/Admin(config-probe-type)# passdetect interval 10For example, to configure five success probe responses from the server before declaring it as passed, enter:
host1/Admin(config-probe-type)# passdetect count 5To reset the wait interval to its default setting, use the no passdetect interval command. For example, enter:
host1/Admin(config-probe-type)# no passdetect intervalTo reset the successful probe responses to its default setting, use the no passdetect count command. For example, enter:
host1/Admin(config-probe-type)# no passdetect countConfiguring the Wait Interval for the Opening of the Connection
When the ACE sends a probe, it waits for the SYN-ACK after sending a SYN to open and then send an ACK to establish the connection with the server. To configure the time interval for a connection to be established, use the open command. This command is available in Echo TCP, Finger, FTP, HTTP, HTTPS, IMAP, POP, scripted, SMTP, TCP, and Telnet probe configuration mode (all TCP-based probes). The syntax of this command is:
open timeout
The timeout argument is the time to wait in seconds to open a connection with a server. Enter an integer from 1 to 65535. The default wait interval is 10 seconds.
Note
For example, to configure the wait time interval to 25 seconds, enter:
host1/Admin(config-probe-type)# open 25To reset the time interval to its default setting of 10 seconds, use the no open command. For example, enter:
host1/Admin(config-probe-type)# no openConfiguring the Timeout Period for a Probe Response
By default, when the ACE sends a probe, it expects a response within a time period of 10 seconds. For example, for an HTTP probe, the timeout period is the number of seconds to receive an HTTP reply for a GET or HEAD request. If the server fails to respond to the probe, the ACE marks the server as failed.
To configure this time period to receive a server response to the probe, use the receive command. This command is available for all probe-type configuration modes. The syntax of this command is:
receive timeout
The timeout argument is the timeout period in seconds. Enter a number from 1 to 65535. By default, the timeout period is 10.
Note
For example, to configure the timeout period for a response at 5 seconds, enter:
host1/Admin(config-probe-type)# receive 5To reset the time period to receive a response from the server to its default setting of 10 seconds, use the no receive command. For example, enter:
host1/Admin(config-probe-type)# no receiveConfiguring an ICMP Probe
An ICMP probe sends an ICMP echo request and listens for a response. If a server returns a response, the ACE marks the server as passed. If the server does not send a response causing the probe to time out, or the server sends an unexpected ICMP echo response type, the ACE marks the probe as failed.
To create an ICMP probe and access its configuration mode, use the probe icmp name command in configuration mode.
For example, to define a ICMP probe named PROBE3 and access its mode, enter:
host1/Admin(config)# probe icmp PROBE3host1/Admin(config-probe-icmp)#Then, you can configure the attributes in the "Configuring General Probe Attributes" section.
Configuring a TCP Probe
A TCP probe initiates a TCP 3-way handshake and expects the server to send a response. By default, a successful response causes the probe to mark the server as passed. Then the probe sends a FIN to end the session. If the response is not valid or if there is no response, the probe marks the server as failed.
Optionally, you can configure the probe to send a RST or specific data, and to expect specific response in order to mark the server as passed. You can also configure the probe to send specific data and receive a specific response from the server. If the response is not valid or there is no response, the probe marks the server as failed.
To create a TCP probe and access its configuration mode, use the probe tcp name command in configuration mode.
For example, to define a TCP probe named PROBE1 and access its mode, enter:
host1/Admin(config)# probe tcp PROBE1host1/Admin(config-probe-tcp)#You can configure attributes for a TCP probe, as described in the following sections:
•
•
•
Then, you can configure the attributes in the "Configuring General Probe Attributes" section.
Configuring the Termination of the TCP Connection
A TCP probe makes a connection and if the connection through a 3-way handshake (SYN, SYN-ACK, and ACK) is successful, the probe is marked as pass. By default, the ACE terminates a TCP connection gracefully by sending a FIN to the server.
Note
To configure the ACE to terminate a TCP connection by sending a RST, use the connection term command. This command is available for TCP-based connection-oriented probes (ECHO TCP, Finger, FTP, HTTP, HTTPS, IMAP, POP, SMTP, TCP, and Telnet probe configuration modes). The syntax of this command is:
connection term forced
For example, enter:
host1/Admin(config-probe-tcp)# connection term forcedTo reset the method to terminate a connection gracefully, use the no connection term command. For example, enter:
host1/Admin(config-probe-tcp)# no connection term forcedConfiguring an Expected String from the Server
When you configure a probe to expect a string from a server, it searches the response for a configured string. If the ACE finds the expected string, the server is marked as passed. If you do not configure an expected string, the ACE ignores the server response.
Note
To configure what the ACE expects as a response string from the probe destination server, use the expect regex command. This command is available in Finger, HTTP, HTTPS, TCP, and UDP probe configuration modes. The syntax of this command is:
expect regex string [offset number]
The argument and option are:
•
•
Note
For example, to configure the ACE to expect a response string of ack, enter:
host1/Admin(config-probe-tcp)# expect regex ackTo remove the expectation of a response string for TCP and UDP probes, use the no expect command. For example, enter:
host1/Admin(config-probe-tcp)# no expectTo remove the expectation of a response string for HTTP and HTTPS probes, use the no expect regex command. For example, enter:
host1/Admin(config-probe-http)# no expect regexConfiguring Data that the Probe Sends to the Server Upon Connection
To configure the ASCII data that the probe sends when the ACE connects to the server, use the send-data command. This command is available in ECHO, Finger, TCP, and UDP probe configuration modes. The syntax of this command is:
send-data expression
The expression argument is the data that the probe sends. Enter an unquoted text string with a maximum of 255 characters including spaces.
Note
For example, to configure the probe to send TEST as the data, enter:
host1/Admin(config-probe-tcp)# send-data testTo remove the data, use the no send-data command. For example, enter:
host1/Admin(config-probe-tcp)# no send-dataConfiguring a UDP Probe
Note
By default, the UDP probe sends a UDP packet to a server and marks the server as failed only if the server returns an ICMP Port Unreachable message. If the ACE does not receive any ICMP errors for the UDP request that was sent, the probe is marked as passed. Optionally, you can configure this probe to send specific data and expect a specific response to mark the server as passed.
If the IP interface of the server is down or disconnected, the UDP probe by itself would not know that the UDP application is not reachable.
To create a UDP probe and access its configuration mode, use the probe udp name command.
For example, to define a UDP probe named PROBE2 and access its mode, enter:
host1/Admin(config)# probe udp PROBE2host1/Admin(config-probe-udp)#You can configure the following attributes for a UDP probe:
•
•
Then, you can configure the attributes in the "Configuring General Probe Attributes" section.
Configuring Echo Probes
The Echo probe sends a specified string to the server and compares the response with the original string. You must configure the string that needs to be echoed. If the response string matches the original string, the server is marked as passed. If you do not configure a string, the probe behaves like a TCP or UDP probe, respectively.
To create an Echo probe and access its configuration mode, use the probe echo command. The syntax of this command is:
probe echo {tcp | udp} name
The keywords and argument are:
•
•
•
For example, to define an Echo probe using TCP named PROBE and access its mode, enter:
host1/Admin(config)# probe echo tcp PROBEhost1/Admin(config-probe-echo-tcp)#For example, to define an Echo probe using UDP named PROBE17 and access its mode, enter:
host1/Admin(config)# probe echo udp PROBE17host1/Admin(config-probe-echo-udp)#For Echo TCP or UDP probes, you can configure the attributes in the "Configuring General Probe Attributes" section.
For a TCP connection, as configured through the tcp keyword, you can also configure the attributes in the "Configuring a TCP Probe" section.
For a UDP connection, as configured through the udp keyword, you can also configure the attributes in the "Configuring a UDP Probe" section.
Configuring Finger Probes
The Finger probe uses a Finger query to a server for an expected response string. The ACE searches the response for the configured string. If the ACE finds the expected response string, the server is marked as passed. If you do not configure an expected response string, the ACE ignores the server response.
To create a Finger probe and access its configuration mode, use the probe finger command. The syntax of this command is:
probe finger name
The name argument is the identifier of the probe. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to define a Finger probe named PROBE8 and access its mode, enter:
host1/Admin(config)# probe finger PROBE8host1/Admin(config-probe-finger)#To configure the attributes for a Finger probe, you can configure the attributes in the "Configuring General Probe Attributes" and "Configuring a TCP Probe" sections.
Configuring an HTTP Probe
An HTTP probe establishes a TCP connection and issues an HTTP request to the server for an expected string and status code. The ACE can compare the received response with configured codes, looking for a configured string in the received HTTP page, or verifying hash for the HTTP page. If any of these checks fail, the server is marked as failed.
For example, if you configure an expected string and status code and the ACE finds them both in the server response, the server is marked as passed. However, if the ACE does not receive either the server response string or the expected status code, it marks the server as failed.
Note
The server response must include the Content-Length header for the expect regex or hash command to function. Otherwise, the probe does not attempt to parse the regex or hash value.To create an HTTP probe and access its configuration mode, use the probe http name command. For example, to define an HTTP probe named PROBE4 and access its mode, enter:
host1/Admin(config)# probe http PROBE4host1/Admin(config-probe-http)#You can configure attributes for an HTTP probe, as described in the following sections:
•
•
•
•
•
Then, you can configure the general attributes in the "Configuring General Probe Attributes" section. You can also configure TCP probe attributes including an expected response string in the "Configuring a TCP Probe" section.
Configuring the Credentials for a Probe
The credentials for a probe are the username and password used for authentication on the server. To configure the credentials for the probe, use the credentials command. The syntax of this command is:
credentials username [password]
The arguments are:
•
•
For example, to configure the username ENG1 and a password TEST, enter:
host1/Admin(config-probe-http)# credentials ENG1 TESTTo delete the credentials for the probe, use the no credentials command. For example, enter:
host1/Admin(config-probe-http)# no credentialsConfiguring the Header Field for the HTTP Probe
To configure an HTTP header or multiple header fields for the HTTP probe, use the header command. The syntax of this command is:
header field_name header-value value
The arguments are:
•
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
•
For example, to configure the Accept-Encoding HTTP header with a field value of IDENTITY, enter:
host1/Admin(config-probe-http)# header Accept-Encoding header-value IDENTITYTo remove the header configuration for the probe, use the no form of the header command. For example, to remove a header with the Accept-Encoding field name, enter:
host1/Admin(config-probe-http)# no header Accept-EncodingConfiguring the HTTP Method for the Probe
By default, the HTTP request method is a GET with the URL "/". If you do not configure a URL, the probe behaves as a TCP probe.
To configure the HTTP method and URL used by the probe, use the request method command. The syntax of this command is:
request method {get | head} url path
The keywords and arguments are:
•
–
–
•
For example, to configure the HEAD HTTP method and the /digital/media/graphics.html URL used by an HTTP probe, enter:
host1/Admin(config-probe-http)# request method head url /digital/media/graphics.htmlTo reset the HTTP method for the probe to GET, use the no request method command. For example, enter:
host1/Admin(config-probe-http)# no request method head url /digital/media/graphics.htmlConfiguring the Status Code from the Destination Server
When the ACE receives a response from the server, it expects a status code to mark a server as passed. By default, there are no status codes configured on the ACE. If you do not configure a status code, any response code from the server is marked as failed.
To configure a single or range of code responses that the ACE expects from the probe destination, use the expect status command. You can specify multiple status code ranges with this command by entering the command with different ranges separately. The syntax of this command is:
expect status min_number max_number
The arguments and options are:
•
•
For example, to configure an expected status code of 200 that indicates that the HTTP request was successful, enter:
host1/Admin(config-probe-http)# expect status 200 200To configure a range of expected status codes from 200 to 210, enter:
host1/Admin(config-probe-http)# expect status 200 210To configure multiple ranges of expected status codes from 200 to 202 and 204 to 205, you must configure each range separately. For example, enter:
host1/Admin(config-probe-http)# expect status 200 202host1/Admin(config-probe-http)# expect status 204 205To remove a single expected status code, use the no expect status command. For example, to remove the expected status code of 200, enter:
host1/Admin(config-probe-http)# no expect status 200 200To remove a range of expected status codes, enter the range when using the no expect status command. For example, to remove a range of 200 to 202 from a range of 200 to 210, enter:
host1/Admin(config-probe-http)# no expect status 200 202To remove multiple ranges of expected status codes, you must remove each range separately. For example, if you have set two different ranges (200 to 202 and 204 to 205), enter:
host1/Admin(config-probe-http)# no expect status 200 202host1/Admin(config-probe-http)# no expect status 204 205Configuring an MD5 Hash Value
By default, no MD5 hash value is configured on the ACE. To configure the ACE to dynamically generate the hash value or manually configure the value, use the hash command. If you do not use this command to configure the hash value, the ACE does not calculate a hash value on the HTTP data returned by the probe. The syntax of this command is:
hash [value]
When you enter this command with no argument, the ACE generates the hash on the HTTP data returned by the first successful probe. If subsequent HTTP server hash responses match the generated hash value, the ACE marks the server as passed.
If a mismatch occurs due to changes to the HTTP data, the probe fails and the show probe ... detail command displays an MD5 mismatch error in the Last disconnect error field. To clear the reference hash and have the ACE recalculate the hash value at the next successful probe, change the URL or method by using the request method command. For more information, see the "Configuring the HTTP Method for the Probe" section.
The optional value argument is the MD5 hash value that you want to manually configure. Enter the MD5 hash value as a hexadecimal string with exactly 32 characters (16 bytes).
Note
You can configure the hash command on a probe using the HEAD method, however there is no data to hash and has no effect causing the probe to always succeed.For example, to configure the ACE to generate the hash on the HTTP data returned by the first successful probe, enter:
host1/Admin(config-probe-http)# hashTo manually configure a hash value, enter:
host1/Admin(config-probe-http)# hash 0123456789abcdef0123456789abcdefTo configure the ACE to no longer compare the referenced hash value to the computed hash value, enter:
host1/Admin(config-probe-http)# no hashConfiguring an HTTPS Probe
An HTTPS probe is similar to an HTTP probe except it uses SSL to generate encrypted data.
Note
To create an HTTPS probe and access its configuration mode, use the probe https command. The syntax of this command is:
probe https name
For the name argument, enter an identifier of the HTTPS probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to define an HTTPS probe named PROBE5 and access its mode, enter:
host1/Admin(config)# probe https PROBE5host1/Admin(config-probe-https)#You can configure attributes for an HTTPS probe, as described in the following sections:
•
•
Then, you can also configure the attributes in the "Configuring General Probe Attributes" and "Configuring an HTTP Probe" sections.
Configuring the Cipher Suite for the HTTPS Probe
By default, the HTTPS probe accepts any of the RSA configured cipher suites. To configure the probe to expect a specific type of RSA cipher suite from the back-end server, use the ssl cipher command. The syntax of this command is:
ssl cipher RSA_ANY | cipher_suite
The keyword and variable are:
•
•
–
–
–
–
–
–
–
–
–
–
–
For example, to configure the HTTPS probes with the RSA_WITH_RC4_128_SHA cipher suite, enter:
host1/Admin(config-probe-https)# ssl cipher RSA_WITH_RC4_128_SHATo reset the default behavior of the HTTPs probes accepting any RSA cipher suite, enter:
host1/Admin(config-probe-https)# ssl cipher RSA_ANYYou can also use the no ssl cipher command to reset the default behavior. Enter:
host1/Admin(config-probe-https)# no ssl cipherConfiguring the Supported SSL or TLS Version
The version in the ClientHello message sent to the server indicates the highest supported version. By default, the probe supports SSL version 3. To configure the version of SSL that the probe supports, use the ssl version command. The syntax of this command is:
ssl version SSLv2 | SSLv3 | TLSv1
The keywords are:
•
•
•
For example, to configure the SSL version 2, enter:
host1/Admin(config-probe-https)# ssl version SSLv2To reset the default setting, enter:
host1/Admin(config-probe-https)# no ssl versionConfiguring FTP Probes
An FTP probe establishes a TCP connection to the server and then issues a quit command. To create an FTP probe and access its configuration mode, use the probe ftp command. The syntax of this command is:
probe ftp name
For the name argument, enter an identifier of the FTP probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to define an FTP probe named PROBE8 and access its mode, enter:
host1/Admin(config)# probe ftp PROBE8host1/Admin(config-probe-ftp)#The following "Configuring the Status Code from the Destination Server" section describes how to configure status codes for the probe.
Then, you can configure the attributes in the "Configuring General Probe Attributes" and "Configuring a TCP Probe" sections.
Configuring the Status Code from the Destination Server
When the ACE receives a response from the server, it expects a status code to mark a server as passed. By default, there are no status codes configured on the ACE. If you do not configure a status code, any response code from the server is marked as failed.
To configure a single or range of code responses that the ACE expects from the probe destination, use the expect status command. You can specify multiple status code ranges with this command by entering the command with different ranges separately. The syntax of this command is:
expect status min_number max_number
The arguments and options are:
•
•
For example, to configure an expected status code of 200 that indicates that the request was successful, enter:
host1/Admin(config-probe-ftp)# expect status 200 200To configure a range of expected status codes from 200 to 201, enter:
host1/Admin(config-probe-ftp)# expect status 200 201To configure multiple ranges of expected status codes from 200 to 201 and 230 to 250, you must configure each range separately. For example, enter:
host1/Admin(config-probe-ftp)# expect status 200 201host1/Admin(config-probe-ftp)# expect status 230 250To remove a single expected status code, use the no expect status command. For example, to remove the expected status code of 200, enter:
host1/Admin(config-probe-ftp)# no expect status 200 200To remove a range of expected status codes, enter the range when using the no expect status command. For example, to remove a range of 200 to 201, enter:
host1/Admin(config-probe-ftp)# no expect status 200 201To remove multiple ranges of expected status codes, you must remove each range separately. For example, if you have set two different ranges (200 to 201 and 230 to 250), enter:
host1/Admin(config-probe-ftp)# no expect status 200 201host1/Admin(config-probe-ftp)# no expect status 230 250Configuring Telnet Probes
A Telnet probe establishes a connection to the server and verifies that a greeting from the application was received. To create a Telnet probe and access its configuration mode, use the probe telnet command. The syntax of this command is:
probe telnet name
For the name argument, enter an identifier of the Telnet probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to define a Telnet probe named PROBE6 and access its mode, enter:
host1/Admin(config)# probe telnet PROBE6host1/Admin(config-probe-telnet)#Then, you can configure the attributes in the "Configuring General Probe Attributes" and "Configuring a TCP Probe" sections.
Configuring DNS Probes
A DNS probe sends a request to a DNS server giving it a configured domain (by default, the domain is www.cisco.com). To determine if the server is up, the ACE must receive one of the configured IP addresses for that domain. To create a DNS probe and access its configuration mode, use the probe dns command. The syntax of this command is:
probe dns name
For the name argument, enter an identifier of the DNS probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to define a DNS probe named PROBE7 and access its mode, enter:
host1/Admin(config)# probe dns PROBE7host1/Admin(config-probe-dns)#You can configure attributes for a DNS probe, as described in the following sections:
•
Then, you can configure the attributes in the "Configuring General Probe Attributes" section.
Configuring the Domain Name
The DNS probe sends a domain name for the DNS server to resolve. By default, the probe uses the www.cisco.com domain. To configure the domain name that the probe sends to the server, use the domain command. The syntax of this command is:
domain name
The name argument is the domain that the probe sends to the DNS server. Enter an unquoted text string with a maximum of 255 characters.
For example, to configure the domain name of support.cisco.com, enter:
host1/Admin(config-probe-dns)# domain support.cisco.comTo reset the domain to www.cisco.com, use the no domain command. For example, enter:
host1/Admin(config-probe-dns)# no domainConfiguring the Expected IP Address
When a DNS probe sends a domain name resolve request to the server, it verifies the returned IP address by matching the received IP address with the configured addresses. To configure the IP address that the ACE expects as a server response to a DNS request, use the expect address command. The syntax of this command is:
expect address ip_address
The ip_address argument is the expected returned IP address. Enter a unique IPv4 address in dotted-decimal notation (for example, 192.8.12.15).
You can specify multiple IP addresses with this command by entering the command with a different address separately. For example, to configure an expected IP address of 192.8.12.15 and 192.8.12.23, enter:
host1/Admin(config-probe-dns)# expect address 192.8.12.15host1/Admin(config-probe-dns)# expect address 192.8.12.23To remove an IP address, use the no expect address command. For example, enter:
host1/Admin(config-probe-dns)# no expect address 192.8.12.15Configuring SMTP Probes
SMTP probes initiates an SMTP session by logging into the server, sends a HELO message, and then disconnects from the server. To create an SMTP probe and access its configuration mode, use the probe smtp command. The syntax of this command is:
probe smtp name
For the name argument, enter an identifier of the SMTP probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to define a SMTP probe named PROBE10 and access its mode, enter:
host1/Admin(config)# probe smtp PROBE10host1/Admin(config-probe-smtp)#Then, you can configure the status codes in the "Configuring the Status Code from the Destination Server" section.
You can also configure the attributes in the "Configuring General Probe Attributes" section, and connection termination in the "Configuring the Termination of the TCP Connection" section.
Configuring the Status Code from the Destination Server
When the ACE receives a response from the server, it expects a status code to mark a server as passed. By default, there are no status codes configured on the ACE. If you do not configure a status code, any response code from the server is marked as failed.
To configure a single or range of code responses that the ACE expects from the probe destination, use the expect status command. You can specify multiple status code ranges with this command by entering the command with different ranges separately.
The syntax of this command is:
expect status min_number max_number
The arguments and options are:
•
•
For example, to configure a single expected status code of 211, enter:
host1/Admin(config-probe-smtp)# expect status 211 211To configure a range of expected status codes from 211 to 250, enter:
host1/Admin(config-probe-smtp)# expect status 211 250To configure multiple ranges of expected status codes from 211 and 250 and 252 to 254, you must configure each range separately. Enter:
host1/Admin(config-probe-smtp)# expect status 211 250host1/Admin(config-probe-smtp)# expect status 252 254To remove a single expected status code, use the no expect status command. For example, to remove the expected status code of 211, enter:
host1/Admin(config-probe-smtp)# no expect status 211 211To remove a range of expected status codes, enter the range when using the no expect status command. For example, to remove a range of 211 to 250, enter:
host1/Admin(config-probe-smtp)# no expect status 211 250To remove multiple ranges of expected status codes, you must remove each range separately. For example, if you have set two different ranges (211 and 250 and 252 to 254), enter:
host1/Admin(config-probe-smtp)# no expect status 211 250host1/Admin(config-probe-smtp)# no expect status 252 254Configuring an IMAP Probe
An Internet Message Access Protocol (IMAP) probe makes a server connection and sends user credential (login, password, and mailbox) information. The ACE can send a configured command. Based on the server response, the ACE marks the probe as passed or failed.
To create an IMAP probe and access its configuration mode, use the probe imap command.The syntax of this command is:
probe imap name
For the name argument, enter an identifier of the IMAP probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to define a IMAP probe named PROBE11 and access its mode, enter:
host1/Admin(config)# probe imap PROBE11host1/Admin(config-probe-imap)#Then you can configure attributes for an IMAP probe, as described in the following sections:
•
•
You can also configure the general attributes in the "Configuring General Probe Attributes" section and the connection termination method in the "Configuring the Termination of the TCP Connection" section.
Configuring the Username Credentials
The credentials for an IMAP probe are the username and password used for authentication on the server. To configure the credentials for the probe, use the credentials username command. The syntax of this command is:
credentials username password
The arguments are:
•
•
For example, to configure the username ENG1 and a password TEST, enter:
host1/Admin(config-probe-imap)# credentials ENG1 TESTTo delete the username credentials for the probe, use the no credentials username command. For example, to delete the username ENG1, enter:
host1/Admin(config-probe-imap)# no credentials ENG1Configuring the Mailbox
To configure the name of the mailbox from which the probe retrieves e-mail, use the credentials mailbox command. The syntax of this command is:
credentials mailbox name
The mailbox name keyword and argument specifies the user mailbox name from which to retrieve e-mail for an IMAP probe. Enter an unquoted text string with a maximum of 64 characters.
For example, to configure the user mailbox LETTERS, enter:
host1/Admin(config-probe-imap)# credentials mailbox LETTERSTo delete the mailbox for the probe, use the no credentials mailbox command. For example, enter:
host1/Admin(config-probe-imap)# no credentials mailboxConfiguring the Method for the Probe
To configure the request method command used by an IMAP probe, use the request method command. The syntax of this command is:
request method command
The command argument is the request command for the probe. Enter a text string with a maximum of 32 characters with no spaces.
For example, to configure the last request command for an IMAP probe, enter:
host1/Admin(config-probe-imap)# request method lastTo remove the request command for the probe, use the no request command. For example, enter:
host1/Admin(config-probe-imap)# no requestConfiguring a POP3 Probe
Post Office Protocol 3 (POP3) probes initiates a session and sends the configured credentials. The ACE can send a configured command. Based on the server response, the ACE marks the probe as passed or failed.
To create a POP probe and access its configuration mode, use the probe pop command.The syntax of this command is:
probe pop name
For the name argument, enter an identifier of the POP probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to define a POP probe named PROBE12 and access its mode, enter:
host1/Admin(config)# probe pop PROBE12host1/Admin(config-probe-pop)#Then you can configure attributes for a POP probe, as described in the following sections:
•
•
You can also configure the general attributes in the "Configuring General Probe Attributes" section and the connection termination method in the "Configuring the Termination of the TCP Connection" section.
Configuring the Credentials for a Probe
The credentials for a probe are the username and password used for authentication on the server. To configure the credentials for the probe, use the credentials command. The syntax of this command is:
credentials username [password]
The arguments are:
•
•
For example, to configure the username ENG1 and a password TEST, enter:
host1/Admin(config-probe-pop)# credentials ENG1 TESTTo delete the credentials for the probe, use the no credentials command. For example, enter:
host1/Admin(config-probe-pop)# no credentialsConfiguring the Method for the Probe
To configure the request method command used by a POP probe, use the request method command. The syntax of this command is:
request method command
The command argument is the request command for the probe. Enter a text string with a maximum of 32 characters with no spaces.
For example, to configure the last request method command for a POP probe, enter:
host1/Admin(config-probe-pop)# request command lastTo remove the request method for the probe, use the no request command. For example, enter:
host1/Admin(config-probe-pop)# no requestConfiguring RADIUS Probe
A RADIUS probe sends a query using a configured username, password and shared secret to a RADIUS server. If the server is up, it is marked as passed. If you configure a Network Access Server (NAS) address, the ACE uses it in the outgoing packet. Otherwise, the ACE uses the IP address associated with the outgoing interface as the NAS address.
To create the RADIUS probe and access its configuration mode, use the probe radius command.The syntax of this command is:
probe radius name
For the name argument, enter an identifier of the RADIUS probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to define a RADIUS probe named PROBE and access its mode, enter:
host1/Admin(config)# probe radius PROBEhost1/Admin(config-probe-radius)#To configure probe attributes for a RADIUS probe, see the following sections:
•
•
You can also configure the general attributes in the "Configuring General Probe Attributes" section.
Configuring the Credentials and Shared Secret for a Probe
The credentials for a probe are the username and password used for authentication on the server, and optional shared secret to allow probe access to the RADIUS server. To configure the credentials for the probe, use the credentials command. The syntax of this command is:
credentials username password [secret shared_secret]
The arguments are:
•
•
•
For example, to configure the username ENG1 and a password TEST, enter:
host1/Admin(config-probe-radius)# credentials ENG1 TESTTo delete the credentials for the probe, use the no credentials command. For example, enter:
host1/Admin(config-probe-radius)# no credentialsConfiguring the Network Access Server IP Address
If a Network Access Server (NAS) address is not configured for the RADIUS probe, the ACE uses the IP address associated with the outgoing interface as the NAS address. To configure an NAS address, use the nas ip address command. The syntax of this command is:
nas ip address ip_address
The ip_address argument is the NAS IP address. Enter a unique IPv4 address in dotted-decimal notation (for example, 192.8.12.15).
For example, to configure a NAS address of 192.8.12.15, enter:
host1/Admin(config-probe-radius)# nas ip address 192.8.12.15To remove the NAS IP address, use the no nas ip address command. For example, enter:
host1/Admin(config-probe-radius)# no nas ip addressConfiguring Scripted Probes
Scripted probes allow you to run a script to execute the probe that you created for health monitoring. In this way, you can author specific scripts with features not present in standard health probes. To configure a scripted probe, you need to:
•
•
•
The ACE allows the configuration of 256 unique script files. For information on copy and loading a script file on the ACE, see Appendix A, Using Toolkit Command Language (TCL) Scripts with the ACE.
To a create scripted probe, access the scripted probe configuration mode, and associate the script file to the probe, use the probe scripted command. The syntax of this command is:
probe scripted name
For the name argument, enter an identifier of the scripted probe as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
Note
For example, to define a scripted probe named PROBE19 and access its mode, enter:
host1/Admin(config)# probe scripted PROBE19host1/Admin(config-probe-scrptd)#To configure the scripted probe attributes, see the "Associating a Script with a Probe" section.
You can also configure the general commands in the "Configuring General Probe Attributes" section.
Associating a Script with a Probe
Scripted probes run probes from a configured script to perform health probing. You can also configure arguments that are passed to the script. Before you can associate a script file with a probe, you must copy and load the script on the ACE. For information on copying and loading a script, see Appendix A, Using Toolkit Command Language (TCL) Scripts with the ACE.
To specify the name of the script file and the arguments to be passed to the script, use the script command. The syntax of this command is:
script script_name [script_arguments]
The arguments are:
•
•
For example, to configure the script name of PROBE-SCRIPT and arguments of ??, enter:
host1/Admin(config-probe-scrptd)# script PROBE-SCRIPT ??To remove the script and its arguments from the configuration, use the no script command. For example, enter:
host1/Admin(config-probe-scrptd)# no scriptDisplaying Probe Information
To display configuration information and statistics for a probe, use the show probe command in Exec mode. The syntax of this command is:
show probe [probe_name] [detail]
The argument and option are:
•
•
If you do not enter a probe name, this command shows a summary of information for all configured probes. For example, enter:
host1/Admin# show probeYou can also display configuration information for all probes through the show running-config probe command.
For example, enter:
host1/Admin# show running-config probeTable 4-2 describes the fields in the show probe command output including additional output provided by the detail option.
Table 4-2 Field Descriptions for the show probe Command
Probe
Name of the probe.
Type
Probe type.
State
Whether the probe is active or inactive.
Description
Configured description for the probe (detail option output).
Port
Port number that the probe uses. By default, the probe uses the port number based on its type.
Address
Destination address for the probe.
Addr type
Address type.
Interval
Time interval in seconds that the ACE sends probes to a server marked as passed.
Pass intvl
Time period in seconds to send a probe to a failed server.
Pass count
Consecutive number of passed probes before marking the server as passed.
Fail count
Consecutive number of failed probes before marking the server as failed.
Recv timeout
Time period in seconds to receive a server response to the probe.
DNS domain
Domain name configured for the probe (detail option output for a DNS probe).
HTTP method
HTTP method and URL used by the probe, GET or HEAD (detail option output for HTTP and HTTPS probes).
HTTP URL
URL used by the probe with the HTTP method (detail option output for HTTP and HTTPS probes).
IMAP mailbox
Mailbox username where the probe retrieves e-mail (detail option output for IMAP probes).
IMAP/POP command
Request method command for the probe (detail option output for IMAP and POP probes).
NAS address
Network Access Server (NAS) address for the RADIUS server (detail option output for RADIUS probes).
Script filename
Filename for the script (detail option output for scripted probes).
Conn termination
TCP connection termination type, GRACEFUL or FORCED (detail option output for ECHO TCP, Finger, FTP, HTTP, HTTPS, IMAP, POP, SMTP, TCP, and Telnet probes).
Expect offset
Number of characters into the received message or buffer to start searching for the expect regex expression (detail option output for HTTP, HTTPS, TCP, and UDP probes).
Expect regex
Configured expected response data from the probe destination (detail option output for HTTP, HTTPS, TCP, and UDP probes).
Open timeout
Time interval in seconds that the probe waits to open and establish the connection with the server (detail option output for Finger, FTP, HTTP, HTTPS, IMAP, POP, scripted, SMTP, TCP, and Telnet probe).
Send data
ASCII data that the probe sends (detail option output for ECHO, Finger, TCP, and UDP probes).
probe results
probe association
Real server association for the probe.
probed-address
Destination or source address for the probe.
probes
Total number of probes.
failed
Total number of failed probes.
passed
Total number of passed probes.
health
Health of the probe. Possible values are PASSED or FAILED.
Additional detail option output for scripted probes:
Socket state
Socket state.
No. Passed states
Number of passed states.
No. Failed states
Number of failed states.
No. Probes skipped
Number of skipped probes. A skipped probe occurs when the ACE does not send out a probe because the scheduled interval to send a probe is shorter than it takes to complete the execution of the probe; mainly due to the send interval being shorter than the open timeout or receive timeout interval.
Last status code
Last exit code (see Table A-7).
Last disconnect err
Message for the exit code for a scripted probe (see Table A-7) or an internal error.
Last probe time
Timestamp for the last probe.
Last fail time
Timestamp for the last failed probe.
Last active time
Timestamp for the last active time.
Internal error
Counter for the number of internal errors encountered.
Table 4-3 list the possible disconnect errors that can appear in the show probe output. For a list of disconnect messages for scripted probes, see Table A-7.
To display the global statistics for a probe type, use the show stats probe type command in Exec mode. The syntax of this command is:
show stats probe type probe_type
To view a list of probe types, enter:
host1/Admin# show stats probe type ?For example, to view the global statistics for all DNS probes, enter:
host1/Admin# show stats probe type dnsTable 4-4 describes the fields in the show stats probe type command output.
Clearing Probe Statistics
This section describes the commands you use to clear probe statistics, either for individual probes or for all probes in a context. It contains the following subsections:
•
•
Clearing Statistics for Individual Probes
To clear the statistics displayed through the show probe command for a specific probe, use the clear probe command in Exec mode.The syntax of this command is:
clear probe name
The name argument is the name of a configured probe.
For example, to clear the statistics for the DNS1 probe, enter:
host1/Admin# clear probe DNS1
Note
Clearing All Probe Statistics in a Context
To clear all probe statistics in the current context, use the clear stats probe command in Exec mode. The syntax of this command is:
clear stats probe
For example, enter:
host1/Admin# clear stats probe
Note
Where to Go Next
To learn how to use the Toolkit Command Language (TCL) to write probe scripts, see Appendix A, Using Toolkit Command Language (TCL) Scripts with the ACE. To configure stickiness (session persistence), see Chapter 5, Configuring Stickiness. To configure firewall load balancing (FWLB), see Chapter 6, Configuring Firewall Load Balancing.
