Cisco Internet Streamer CDS 2.6 Software Configuration Guide

Working with Device Groups

When you first create a device group, all settings you configure for the device group are automatically propagated to all the SEs assigned to that group.

Note All SE settings in the “Configuring the Service Engine” section, except those listed below, can also be configured for a device group. The following pages are not available for device group configuration:

• Devices > Application Control > Windows Media Streaming > Bypass List . See the “Configuring Windows Media Streaming—Bypass List” section for more information.
• Devices > General Settings > Network > Network Interfaces . See the “Viewing Network Interfaces” section for more information.
• Devices > General Settings > Network > External IP . See the “Configuring External IP Addresses” section for more information.
• Devices > General Settings > Network > IP ACL . See the “Configuring IP ACL” section for more information.

After configuring the device group settings, the task bar for the corresponding configuration page for an individual SE that is part of that device group displays the Override Group Settings icon and the Device Group drop-down list with the device group name displayed.

When an SE is associated with one or many device groups, the name of the device group whose settings were applied last are displayed.

To configure individual settings for an SE in a device group, click the Override Group Settings icon in the task bar. You can then edit the fields on the page and click Submit . The Device Group drop-down list displays “Select a Device Group.”

To reapply the settings for the device group, select the device group from the Device Group drop-down list and click Submit . Alternatively, you can go to the corresponding device group configuration page and click the Force Settings on SEs in Group . The Force Settings on SEs in Group only displays for a device group configuration page when an SE’s individual settings override the group settings.

Note The individual SE configuration page does not display the Override Group Settings icon and Device Group drop-down list in the task bar if the settings have not been configured for the corresponding device group configuration page.

Note When adding an SE to an existing device group, the new SE does not automatically inherit the device group settings. Use the Force Group Settings option for the device group to force the group settings to all SEs in the group.

Alternatively, you can go to each device group configuration page and click the Force Settings on SEs in Group. A dialog box lists all the SEs that have different configuration settings than the device group settings. The Force Settings on SEs in Group only displays for a device group configuration page when an SE’s individual settings override the group settings.

To force all device group settings to all assigned SEs, go to the Device Group Home page and click the Force Group Settings icon in the task bar.

Note The last configuration submitted for the device, whether it is the device group configuration or the individual device configuration, is the configuration the device uses.

Table 4-4 describes the icons for the Device Groups configuration pages.

Table 4-4 Device Group Configuration Icons

Icon	Function
	Deletes a device group.
	Updates application statistics.
	Forces full database update.
	Reboots all devices in device group.
	Forces the group settings. Forces the complete set of configurations made for a device group to all devices associated with that group.
	Forces settings on SEs in a device group. Forces the configuration of the displayed page to all SEs in the device group.
	Overrides the group settings on the device.
	Prints the current window.

Aggregate Settings

The following device and device group configuration pages have aggregate settings:

• Replication > Scheduled Bandwidth . See the “Scheduled Bandwidth” section for more information.
• Service Control > Service Rules . See the “Configuring Service Rules” section for more information.
• Service Control > URL Signing . See the “Configuring URL Signing” section for more information.
• Application Control > Bandwidth Schedules . See the “Configuring Bandwidth Schedules” section for more information.
• General Settings > Login Access Control > Users > Usernames . See the “Creating, Editing, and Deleting Users—Usernames” section for more information.

To access these pages, first choose Devices > Devices or Devices > Device Groups , followed by the Edit icon next to the device or device group you want to configure.

Aggregate Settings is set to Yes by default. When Aggregate Settings is set to Yes , the settings for the device group are aggregated with the settings for the SE. This means you can configure settings for all SEs in a device group, then configure individual settings for each SE, and the combined settings for the device group and individual SE are apply to the SE. Any settings for the device group are listed with the View icon and any settings for the individual SE are listed with the Edit icon on the individual SE configuration page.

If Aggregate Settings is set to No , only the individual SE settings are applied to the SE and the device group settings do not apply to the SE.

To edit the device group settings, or configure new settings for the device group, you must go to the device group corresponding configuration page.

If you remove all device group settings, all device settings displayed with Aggregate Settings enabled are removed as well.

Note The last configuration submitted for the device, whether it is the device group configuration or the individual device configuration, is the configuration the device uses.

Table 4-5 describes the icons for the configuration pages that have aggregate settings.

Table 4-5 Aggregate Settings Icons

Icon	Function
	Creates a new entry.
	Edits an entry.
	Deletes an entry.
	Views read-only entry.
	Creates a filtered table. Filter the table based on the field values.
	Views all table entries. Click this icon to view all entries after you have created a filtered table.
	Refreshes the table.
	Prints the current window.

Device Group Overlap

If you want the ability to assign a device to more than one device group, you must enable device group overlap. Device group overlap is enabled by default.

To enable or disable device group overlap, do the following:

System > Configuration

Step 2 Click the Edit icon next to the DeviceGroup.overlap property. The Modifying Config Property page is displayed.

Step 3 To enable device group overlap, choose true from the Value drop-down list.

To disable device group overlap, choose false from the Value drop-down list.

Step 4 Click Submit to save the settings.

You cannot disable device group overlap after you have assigned devices to multiple device groups.

Tip To force the complete configuration set of a device group to all devices in that group, click the Force Group Settings icon in the task bar.

Activating a Service Engine

Activating a device (Service Engine, Service Router, or stamdby CDSM) can be done through the Devices home page initially, or through the Device Activation page.

To activate a device from the Device Activation page, do the following:

Step 1 Choose Devices > Devices . The Devices Table page is displayed (Figure 4-5).

Figure 4-5 Devices Table Page

Step 2 Click the Edit icon next to the device you want to configure. The Devices home page is displayed.

Step 3 Click Show All to display the top-level menu options, and click Device Activation . The Device Activation page is displayed (Figure 4-6).

Figure 4-6 Device Activation Page

Step 4 Enter the settings as appropriate. See Table 4-6 for a description of the fields.

Step 5 Click Submit to save the settings.

Assigning Devices to Device Groups

You can assign devices to device groups in three ways:

• Through the Device Group Assignment page
• Through the device Assignment page
• Through the Devices home page, if the device group is a baseline group

To assign devices to device groups through the Assignment page, do the following:

Step 1 Choose Devices > Devices , and click the Edit icon next to the device you want to assign.

Step 2 Click Show All , and then choose Assignments > Device Groups . The Device Group Table page is displayed with all of the configured device groups listed (Figure 4-7).

Note From this point forward, the beginning steps in the procedures are combined into one step using notation similar to the following: Devices > Devices Assignments > Device Groups.

Figure 4-7 Assignment Page

Step 3 Click the Assign icon (blue cross mark) next to the device group you want to assign to this SE. Alternatively, click the Assign All Device Groups icon in the task bar.

A green arrow wrapped around the blue X indicates an SE assignment is ready to be submitted. To unassign an SE, click this icon. The SE assignment states are described in Figure 4-8.

Figure 4-8 SE Assignment State

Step 4 Click Submit to save the settings.

A green circle with a check mark indicates a device group is assigned to this SE. To unassign the device group, click this icon, or click the Remove All Device Groups icon in the task bar. Click Submit to save the changes.

Additionally, the Filter Table icon and View All Device Groups icon allow you to first filter a table and then view all device groups again.

Configuring Bandwidth for Replication and Ingest

The bandwidth used for replication and ingest is determined by the settings in the Default Bandwidth and the Scheduled Bandwidth pages. The replication configuration pages consist of the following:

• Default Bandwidth
• Scheduled Bandwidth

Table 4-7 describes the icons on the replication bandwidth configuration pages.

Table 4-7 Replication Bandwidth Configuration Icons

Icon	Function
	Refreshes the table or page.
	Displays a graph.
	Applies the default settings to the device.
	Creates a new item.
	Creates a filtered table. Filter the scheduled bandwidth by start time, end time, days of the week, and bandwidth type.
	Views all scheduled bandwidth. Click this icon to view all schedule bandwidths after you have created a filtered table.
	Prints the current window.
	Edits a scheduled bandwidth. Click this icon next to one of the scheduled bandwidths to edit the settings.
	Deletes a scheduled bandwidth. To delete a scheduled bandwidth, click the Edit icon and then click this icon.

Default Bandwidth

The default bandwidth settings can be configured for acquisition (ingest) and distribution (replication) of content. The default settings are used unless a scheduled bandwidth is configured for a specified time period.

To set the default bandwidth for replication, do the following:

Step 1 Choose Devices > Devices > Replication > Default Bandwidth . The Replication Default Bandwidth page is displayed (Figure 4-9).

Figure 4-9 Replication Default Bandwidth Page

Step 2 Enter the settings as appropriate. See Table 4-8 for a description of the fields.

Step 3 Click Submit to save the settings.

For information on the task bar icons, see Table 4-7 .

Bandwidth Graph

To view a graphical representation of the bandwidth settings, click the Display Graph icon in the task bar. The Acquisition and Distribution Bandwidth graph is displayed in a new window.

The vertical axis of the graph represents the amount of bandwidth in Kbps (kilobits per second) and the horizontal axis represents the days of the week. The scale shown on the vertical axis is determined dynamically based on the bandwidth rate for a particular type of bandwidth and is incremented appropriately. The scale shown on the horizontal axis for each day is incremented for each hour. Each type of bandwidth is represented by a unique color. A legend at the bottom of the graph maps the colors to the corresponding bandwidths.

You can change the graph view by choosing the different options, as described in Table 4-9 .

Scheduled Bandwidth

Scheduled Bandwidth settings take precedence over Default Bandwidth settings.

To configure a bandwidth schedule, do the following:

Step 1 Choose Devices > Devices > Replication > Scheduled Bandwidth . The Replication Scheduled Bandwidth Table page is displayed (Figure 4-10).

The table is sortable by clicking the column headings.

Figure 4-10 Replication Scheduled Bandwidth Table Page

For information about Aggregate Settings, see the “Aggregate Settings” section

Note Configuring Replication Bandwidth Scheduling is only supported on a per SE-basis; Device Group configuration of Replication Bandwidth Scheduling is not supported.

Step 2 Click the Create New icon in the task bar. The Replication Scheduled Bandwidth page is displayed (Figure 4-11).

To edit a scheduled bandwidth, click the Edit icon next to the scheduled bandwidth you want to edit.

Figure 4-11 Replication Scheduled Bandwidth Page

Step 3 Enter the settings as appropriate. See Table 4-10 for a description of the fields.

Step 4 Click Submit to save the settings.

For information on the task bar icons, see Table 4-7 .

Service Control

The Service Control pages provide settings for client request filtering, URL signing, and Authorization Server settings. Additionally, transaction logs that monitor traffic are configured under the Service Control. Configuring service control consists of the following procedures:

• Configuring Service Rules
• Configuring URL Signing
• Configuring the Authorization Service
• Configuring Transaction Logs

Table 4-11 describes the icons for the Service Control pages.

Table 4-11 Service Control Icons

Icon	Function
	Refreshes the table or page.
	Applies the default settings to the device.
	Creates a new item.
	Creates a filtered table.
	Views all data. Click this icon to view all data after you have created a filtered table.
	Prints the current window.
	Edits an item.
	Deletes an item. To delete an item, click the Edit icon and then click this icon.

Configuring Service Rules

Note This is a licensed feature. Please ensure that you have purchased a Service Rule license for this advanced feature.

The Rules Template licensed feature provides a flexible mechanism to specify configurable caching requests by allowing these requests to be matched against an arbitrary number of parameters, with an arbitrary number of policies applied against the matches. You can specify a set of rules, each clearly identified by an action and a pattern. Subsequently, for every incoming request, if a pattern for a rule matches the given request, the corresponding action for that rule is taken.

Note The processing time on the SE is directly related to the number of service rules configured. Processing times increase with an increase in the total number of rules configured. If the SE processing time is greater than twice the datafeed poll rate, then the device goes offline until the processing is completed. You can avoid this by configuring a higher datafeed poll rate. The recommended datafeed poll rate for 750 service rules is 300 seconds. To configure the datafeed poll rate, see the “Configuring System Settings” section.

Configuring a service rule consists of the following tasks:

• Enabling the service rules. (Only needs to be performed once.)
• Configuring a pattern list and adding a pattern to it.
• Associating an action with an existing pattern list.

There are three cases for service rules:

1. If allow rules are configured, then it is an implicit deny.

2. If deny rules are configured, then it is an implicit allow.

3. If both allow and deny rules are configured, then it is an implicit allow.

For example, if all URL requests that match HTML are blocked implicitly, all requests that match other URL requests are allowed.

If all URL requests that match WMV are allowed implicitly, all request that match other URL requests are blocked.

If both of the above rules are configured, then HTML URL requests are blocked, and all other URL requests are allowed.

To configure or edit service rule settings, do the following:

Step 1 Choose Devices > Dev ices > Service Control > Enable Rules . The Enable Service Rules page is displayed.

Step 2 Check the Enable check box to enable the use of rule settings.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

Step 4 Choose Devices > Devices > Service Control > Service Rules . The Service Rules Table page is displayed.

The table is sortable by clicking the column headings.

For information about Aggregate Settings, see the “Aggregate Settings” section

Step 5 Click the Create New icon in the task bar. The Service Rules page is displayed (Figure 4-12).

To edit a service rule, click the Edit icon next to the service rule you want to edit.

Figure 4-12 Service Rules Page

Step 6 Create a pattern list and add a pattern to it.

a. From the Rule Type drop-down list, choose pattern-list .

b. In the Rule Parameters field, configure the pattern list number and the pattern type, following the rules usage guidelines shown on the Service Rules page. See Table 4-12 for a description of pattern types. The rule patterns are not case-sensitive.

For example, to create pattern list number 72 with the pattern type domain and the yahoo.com domain as the domain to be acted on, enter 72 domain yahoo.com in the Rule Parameters field.

Note A domain pattern list matching an SE IP address is not supported when IP-based redirection is enabled on the Service Router. See the “Configuring the Service Router” section for more information about IP-based redirection. Flash Media Streaming bypasses the rules configuration if the request is from another SE.

Step 7 Click Submit to save the settings.

The maximum number of pattern lists allowed is 128.

Step 8 Associate an action with an existing pattern list.

a. Choose an action type from the Rule Type drop-down list. See Table 4-13 for a description of rule actions.

b. In the Rule Parameters field, enter the list number of the pattern list that you want to associate with this action.

For example, if you want to block access by any protocol to yahoo.com, then choose block from the Rule Type drop-down list, and enter pattern-list 72 protocol all in the Rule Parameters field.

Note For the Web Engine and Flash Media Streaming, the Service Rule file must be used if service rules are to be configured. See the Appendix F, “Creating Service Rule Files” for more information.

Note Windows Media Streaming supports all service rule actions listed in Table 4-13. Movie Streamer supports the following service rule actions: allow, block, redirect, rewrite, and validate-url-signature.

Step 9 Click Submit to save the settings.

Note When configuring service rules, you must configure the same service rules on all SEs participating in a delivery service in order for the service rules to be fully implemented. The rule action must be common for all client requests because the SR may redirect a client request to any SE in a delivery service depending on threshold conditions.

Execution Order of Rule Actions

The order in which the rule actions are implemented for Windows Media Streaming and Movie Streamer is the order in which they were configured, except for the validate-url-signature action. If the rule pattern associated with the validate-url-signature action is matched, regardless of the configuration order of the rules, the validate-url-signature action is performed before any other action.

1. validate-url-signature

2. block or allow

Note The allow and block actions carry the same precedence. The order of implementation depends on the order of configuration between allow and block actions. Other actions always take precedence over allow.

3. redirect (before cache lookup)

4. rewrite (before cache lookup)

Note For the Web Engine and Flash Media Streaming, the Service Rule file must be used if service rules are to be configured. See the Appendix F, “Creating Service Rule Files” for more information.

Configuring URL Signing

URL signature keys are word values that ensure URL-level security. The URL signature key is a shared secret between the device that assigns the key and the device that decrypts the key. Based on your network settings, either the SE itself or some other external device can assign the signature key to the URL, but the SE decrypts the URL signature key.

The CDS uses a combination of key owners, key ID numbers, and a word value to generate URL signature keys. You can have a maximum of 32 key owners. Each key owner can have up to 16 key ID numbers.

To create request-specific URL signature keys, you can choose to append the IP address of the client that has made the request to the URL signature key.

To create a URL signature key, do the following:

The table is sortable by clicking the column headings.

For information about Aggregate Settings, see the “Aggregate Settings” section

Step 2 Click the Create New icon in the task bar. The URL Signing page is displayed.

To edit the URL signature, click the Edit icon next to the URL Signature Key ID owner you want to edit.

Step 3 Enter the settings as appropriate. See Table 4-14 for a description of the fields.

Step 4 Click Submit to save the settings.

For information on the URL signing mechanism, see Appendix H, “URL Signing and Validation.”

Configuring the Authorization Service

When Authorization Service is enabled, client requests are blocked if the request is for an unknown server or if the client’s IP address or geographic location is not allowed to request content. The Authorization Service is enabled by default and includes both types of blocking.

The Authorization Service verifies that all client requests have a service routing fully-qualified domain name (RFQDN) or origin server FQDN (OFQDN) that is recognized as part of a delivery service. For more information about RFQDNs and origin server, see the “Content Origins” section. If you want to allow client requests for unknown hosts, check the Enable Unknown-Server Requests check box.

Note The string “.se.” cannot be used in the RFQDN and OFQDN.

To block client requests based on geographical location, the SE communicates with a Geo-Location server, which maps IP addresses to a geographic locations. The Geo-Location server, which is the same Geo-Location server used for location-based routing on the SR, identifies the geographic location of a client request by the country, state, and city of the client. See the “Configuring Request Routing Settings” section. For more information about the Geo-Location servers, see the “Geo-Location Servers” section.

Each delivery service participating in the Authorization Service has a Geo/IP file that contains information on the allowed client IP addresses and geographic locations, and denied client IP addresses and geographic locations. The Authorization Service blocks client requests based on the Geo/IP file uploaded for the delivery service.

The SE that receives the client request compares the client’s information, as well as the URL string pattern, with the information configured for the delivery service and allows or denies the request. If the Authorization Service denies the request, the protocol engine receives the denied message and sends a request denied message to the client. For more information, see the“Authorization Plugins” section

To enable the Authorization Service, do the following:

Step 1 Choose Devices > Devices > Service Control > Authorization Service . The Authorization Service page is displayed.

Step 2 To enable the Authorization Service, check the Enable Authorization check box.

The Authorization Service is enabled by default.

Step 3 In the Primary Address and associated Port fields, enter the IP address and port number of the primary Geo-Location Server.

Step 4 In the Secondary Address and associated Port fields, enter the IP address and port number of the primary Geo-Location Server.

Step 5 To allow client requests for unknown hosts, while at the same time keeping the Authorization Service enabled, check the Enable Unknown-Server Requests check box.

Step 6 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

Note If the primary Geo-Location server is shut down and a secondary Geo-location server is configured and is up, requests are sent to the secondary Geo-Location server in a failover-type scenario. If the primary Geo-Location server is brought back up and is online, requests are still routed to the secondary Geo-Location server as long as the secondary Geo-Location server is up. Only if the secondary Geo-Location server goes down and the primary Geo-Location server is up will a fallback occur and requests once again will be routed to the primary Geo-Location server.

Configuring Transaction Logs

Transaction logs allow administrators to view the traffic that has passed through the SE. Typical fields in the transaction log are the date and time when a request was made, the URL that was requested, whether it was a cache hit or a cache miss, the type of request, the number of bytes transferred, and the source IP address. For more information about transaction logs and their formats, see the “Transaction Logs” section.

To enable transaction logging, do the following:

Step 1 Choose Devices > Devices > Service Control > Transaction Logging . The Transaction Log Settings page is displayed.

Step 2 Enter the settings as appropriate. See Table 4-15 for a description of the fields.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

Application Control

The Application Control pages provide settings for bandwidth management of delivery services and protocol engines. Configuring application control consists of the following procedures:

• Configuring Default and Maximum Bandwidth
• Configuring Bandwidth Schedules
• Configuring Windows Media Streaming—General Settings
• Configuring Windows Media Streaming—Bypass List
• Configuring Movie Streamer—General Settings
• Configuring RTSP Advanced Settings
• Configuring Flash Media Streaming—General Settings
• Configuring Flash Media Streaming—FMS Administrator
• Configuring Flash Media Streaming—Service Monitoring
• Configuring Flash Media Streaming—Service Monitoring
• Configuring Web Engine HTTP Cache Freshness

Configuring Default and Maximum Bandwidth

The bandwidth used for delivering content is determined by the settings in the Default and Maximum Bandwidth page, and the Scheduled Bandwidth page. The default settings are used unless a scheduled bandwidth is configured for a specified time period. For Flash Media Streaming bandwidth limits, see the “Configuring Flash Media Streaming—General Settings” section and the “Configuring Flash Media Streaming—Service Monitoring” section.

Note The bandwidth used for delivering content is always the minimum bandwidth configured of the following configurations: default bandwidth, maximum bandwidth, and scheduled bandwidth. When the bandwidth limit is reached, new client requests are dropped and a syslog entry is written. The client receives an error message “453: Not enough bandwidth.”

To configure the default and maximum bandwidth settings, do the following:

Step 1 Choose Devices > Devices > Application Control > Default and Maximum Bandwidth . The Default and Maximum Bandwidth page is displayed.

Step 2 Enter the settings as appropriate. See Table 4-16 for a description of the fields.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Configuring Bandwidth Schedules

Bandwidth Schedule settings take precedence over Default Bandwidth settings.

To configure a Bandwidth Schedule, do the following:

Step 1 Choose Devices > Devices > Application Control > Bandwidth Schedules . The Application Control Bandwidth Schedule Table page is displayed.

The table is sortable by clicking the column headings.

For information about Aggregate Settings, see the “Aggregate Settings” section

Step 2 Click Create New in the task bar. The Scheduled Bandwidth page is displayed.

To edit a bandwidth schedule, click the Edit icon next to the scheduled bandwidth you want to edit.

Step 3 Enter the settings as appropriate. See Table 4-17 for a description of the fields.

Step 4 Click Submit to save the settings.

To delete a bandwidth schedule, click the Edit icon for the group, then click the Delete icon in the task bar.

Bandwidth Graph

To view a graphical representation of the bandwidth settings, click the Display Graph icon in the task bar. The Application Bandwidth graph is displayed in a new window.

The vertical axis of the graph represents the amount of bandwidth in kilobits per second (kb/s) , and the horizontal axis represents the days of the week. The units shown on the vertical axis are determined dynamically based on the bandwidth rate for a particular bandwidth type. The units shown on the horizontal axis represent 24 hours per each day of the week. Each type of bandwidth is represented by a different color. A legend at the bottom of the graph maps colors to the corresponding bandwidth type.

To view the graph by bandwidth type, detailed or composite view, or days of the week, click a view option in the text at the top of the window. Table 4-18 describes the view options.

Configuring Windows Media Streaming—General Settings

To configure the General Settings for Windows Media Streaming, do the following:

Figure 4-13 Windows Media Streaming Page—General Settings

Step 2 Enter the settings as appropriate. See Table 4-19 for a description of the fields.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Configuring Windows Media Streaming—Bypass List

Incoming bandwidth refers to the bandwidth between a local SE and the origin server. When the SE is configured for Windows Media proxy services, incoming bandwidth usage for Video On Demand (VOD) content is unpredictable. This unpredictability is because the consumption of incoming bandwidth for VOD content can be triggered arbitrarily by an end user requesting the content. If the VOD content is not found in the SE cache, a cache miss occurs, and the Windows Media proxy must fetch the content from the origin server. The SE administrator cannot predict the incoming bandwidth usage for such events, so a large number of cache-miss VOD requests can consume all of the incoming bandwidth.

The Windows Media incoming bandwidth bypass configuration allows the administrator to configure a list of hosts that bypasses the incoming bandwidth limitation.

To configure the list of hosts for bypassing incoming bandwidth limits, do the following:

Step 1 Choose Devices > Devices > Application Control > Windows Media Streaming > Bypass List. The Bypass List page is displayed.

Step 2 In the Windows Media BW Incoming Bypass List field, enter up to four IP addresses or hostnames of hosts you want to bypass the incoming bandwidth check. Separate each entry with a space.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Configuring Movie Streamer—General Settings

The Movie Streamer is an open-source, standards-based, streaming server that delivers hinted MPEG-4, hinted 3GPP, and hinted MOV files to clients over the Internet and mobile networks using the industry-standard RTP and RTSP.

To configure the general settings for Movie Streamer, do the following:

Step 1 Choose Devices > Devices > Application Control > Movie Streamer > General Settings . The Movie Streamer General Settings page is displayed.

Step 2 Enter the settings as appropriate. See Table 4-20 for a description of the fields.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Configuring RTSP Advanced Settings

To configure RTSP advanced settings for Movie Streamer and Windows Media Streaming, do the following:

Step 2 Enter the settings as appropriate. See Table 4-21 for a description of the fields.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Configuring Flash Media Streaming—General Settings

The Flash Media Streaming engine delivers Adobe Flash applications and video files, as well as MP3 audio files using HTTP and an Adobe proprietary protocol, RTMP. For more information, see the “Flash Media Streaming Engine” section.

Note Flash Media Streaming uses port 1935 for RTMP and RTMPE streaming. Flash Media Streaming also supports RTMPT and RTMPTE over port 80.

To enable Flash Media Streaming, do the following:

Step 1 Choose Devices > Devices > Application Control > Flash Media Streaming > General Settings . The Flash Media Streaming General Settings page is displayed.

Step 2 Check the Enable Flash Media Streaming check box.

Step 3 Enter the settings as appropriate. See Table 4-22 for a description of the fields.

Step 4 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Configuring Flash Media Streaming—FMS Administrator

To enable servers to send Flash Media Server (FMS) Administration API calls to this device, do the following:

Step 1 Choose Devices > Devices > Application Control > Flash Media Streaming > FMS Admin Allow Hosts . The FMS Admin Allow Hosts page is displayed.

Step 2 Check the Enable check box.

Step 3 In the FMS Admin Allow Hosts field, enter the IP addresses (space delimited) of the servers that are allowed to send Flash Media Server Administration API calls to this device.

The Adobe Flash Media Server Administration APIs and the Administration Console that was built using the Administration APIs are supported. These APIs can be used to monitor and manage the Adobe Flash Media Server running on a Cisco CDS Service Engine.

Step 4 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Configuring Flash Media Streaming—Service Monitoring

To enable Flash Media Streaming Service Monitoring, do the following:

Step 1 Choose Devices > Devices > Application Control > Flash Media Streaming > Service Monitoring . The Service Monitoring page is displayed.

Step 2 Check the Enable Service Monitoring check box.

Service Monitoring monitors the Flash Media Streaming engine memory usage. If the memory usage reaches the 1.5 GB limit for either the Flash Media Streaming core process or the Flash Media Streaming edge process, an alarm is raised and the Service Router does not redirect any new Flash Media Streaming requests to this SE.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Configuring Web Engine HTTP Cache Freshness

To configure the web engine HTTP cache freshness, do the following:

Figure 4-14 HTTP Cache Freshness Page

Step 2 Enter the settings as appropriate. See Table 4-23 for a description of the fields.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

General Settings

The General Settings pages provide settings for access control of the device, maintenance, network connectivity, and monitoring. The configuring of general settings consists of the following procedures:

• Configuring Content Management
• Login Access Control
• Authentication
• Scheduling Database Maintenance
• Setting Storage Handling
• Network Settings
• Configuring Notification and Tracking
• Configuring Troubleshooting
• Configuring Service Router Settings

Configuring Content Management

To configure the maximum number of entries for cache content, do the following:

Step 2 Enter the settings as appropriate. See Table 4-24 for a description of the fields.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Login Access Control

Login authentication and authorization are used to control user access and configuration rights to CDSMs, SEs, and SRs. Login authentication is the process by which the devices verify whether the person who is attempting to log in to the device has a valid username and password. The person logging in must have a user account registered with the device. User account information serves to authorize the user for login and configuration privileges. The user account information is stored in an authentication, authorization, and accounting (AAA) database, and the devices must be configured to access the particular authentication server (or servers) where the AAA database is kept.

In a CDS network, user accounts can be created for access to the CDSM and, independently, for access to the SEs and SRs that are registered to the CDSM. For user accounts that access the CDSM, see the “Configuring AAA” section.

Login Authentication

Login authentication provides the configuration for independent logins; in other words, login access to the device only.

Login authentication can also be used to log in to the CDSM GUI. When logging in to the CDSM GUI with an external user account (RADIUS or TACACS+), the user is authenticated by the external database. After the external user is authenticated, its role depends on the privilege configured in the external database (zero [0] means a normal user and 15 means a super user). The privilege level of 0 or 15 is mapped to the read-only or admin user role in the CDSM GUI. No CDSM local user is created in the CDSM database for the external user that logs in, so the external user cannot be managed by the CDSM GUI.

Note If you plan to use a RADIUS server or a TACACS+ server for authentication, you must configure the server settings before you configure and submit these settings. See the “Configuring RADlUS Server Settings” section and the “Configuring TACACS+ Server Settings” section for more information.

When the primary login server and the primary enable server are set to local, usernames and passwords are local to each device. Local authentication and authorization uses locally configured login and passwords to authenticate login attempts.

Note If the Enable Failover Server Unreachable option is enabled, it applies to both the login authorization methods and the exec authentication methods.

If you are going to use different servers for login authentication and enable authentication (for example, local for login authentication and RADIUS for the enable authentication), then the username and password must be the same for both servers.

By default, local login authentication is enabled. You can disable local login authentication only after enabling one or more of the other login authentication servers. However, when local login authentication is disabled, if you disable all other login authentication methods, a warning message is displayed stating “At least one authentication method is required to select for login.”

To configure the login authentication and enable authentication schemes for the device, do the following:

Step 1 Choose Devices > Devices > General Settings > Login Access Control > Login Authentication . The Login Authentication page is displayed.

Step 2 Enter the settings as appropriate. See Table 4-25 for a description of the fields.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Exec Authorization

Exec authorization provides the configuration for determining the services allowed for each user that logs in to the device.

Exec authorization can also be used to determine the services the user has for the CDSM GUI. When logging in to the CDSM GUI with an external user account (RADIUS or TACACS+), the user is authenticated by the external database. After the external user is authenticated, its role depends on the privilege configured in the external database (zero [0] means a normal user and 15 means a super user). The privilege level of 0 or 15 is mapped to the read-only or admin user role in the CDSM GUI. No CDSM local user is created in the CDSM database for the external user that logs in, so the external user cannot be managed by the CDSM GUI.

Note If you plan to use a TACACS+ server for authorization, you must configure the server settings before you configure and submit these settings. See the “Configuring RADlUS Server Settings” section and the “Configuring TACACS+ Server Settings” section for more information.

When the primary authorization server is set to local, usernames and passwords are local to each device. Local authorization uses locally configured login and passwords to authorize services for the user.

Note If the Enable Failover Server Unreachable option is enabled, it applies to both the login authorization methods and the exec authentication methods.

If you are going to use different servers for login authentication and enable authentication (for example, local for login authentication and RADIUS for the enable authentication), then the username and password must be the same for both servers.

To configure the exec authorization schemes for the device, do the following:

Step 1 Choose Devices > Devices > General Settings > Login Access Control > Exec Authorization . The Exec Authorization page is displayed.

Step 2 Enter the settings as appropriate. See Table 4-26 for a description of the fields.

Note The following commands bypass authorization and accounting: CTRL+C, CTRL+Z, exit, end, and all of configuration commands for entering submode (for example, interface GigabitEthernet 1/0).

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Configuring SSH

Secure Shell (SSH) consists of a server and a client program. Like Telnet, you can use the client program to remotely log in to a machine that is running the SSH server. However, unlike Telnet, messages transported between the client and the server are encrypted. The functionality of SSH includes user authentication, message encryption, and message authentication.

The SSH page allows you to specify the key length and login grace time.

To enable the SSH daemon, do the following:

Step 1 Choose Devices > Devices > General Settings > Login Access Control > SSH . The SSH page is displayed.

Step 2 Check Enable to enable the SSH feature. SSH enables login access to the device through a secure and encrypted channel.

Step 3 In the Length of Key field, specify the number of bits needed to create an SSH key. The default is 2048.

Step 4 In the Login Grace Time field, specify the number of seconds the server waits for the user to successfully log in before it ends the connection. The authentication procedure must be completed within this time limit. The default is 300 seconds.

Note When changing the Login Grace Time, you need to first uncheck the Enable check box and click Submit. Enter the new Login Grace Time, check Enable, and click Submit.

Step 5 Select the SSH version.

a. To allow clients to connect using SSH protocol version 1, check the Enable SSHv1 check box.

b. To allow clients to connect using SSH protocol version 2, check the Enable SSHv2 check box.

Note You can enable both SSHv1 and SSHv2, or you can enable one version and not the other. You cannot disable both versions of SSH unless you disable the SSH feature by unchecking the Enable check box.

Step 6 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Enabling Telnet

To enable the Telnet service, do the following:

Step 1 Choose Devices > Devices > General Settings > Login Access Control > Telnet . The Telnet page is displayed.

Step 2 Check Telnet Enable to enable the terminal emulation protocol for remote terminal connections.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Setting the Message of the Day

The Message of the Day (MOTD) feature enables you to provide information bits to the users when they log in to a device. There are three types of messages that you can set up:

• MOTD banner
• EXEC process creation banner
• Login banner

To configure the Message of the Day settings, do the following:

Step 1 Choose Devices > Devices > General Settings > Login Access Control > Message of the Day . The MOTD page is displayed.

Step 2 Check Enable to enable the MOTD settings. The Message of the Day (MOTD) banner, EXEC process creation banner, and Login banner fields become enabled.

Step 3 In the Message of the Day (MOTD) Banner field, enter a string that you want to display as the MOTD banner when a user attempts to log in to the device.

Note In the Message of the Day (MOTD) Banner, EXEC Process Creation Banner, and Login Banner fields, you can enter a maximum of 980 characters. A new line character (or Enter) is counted as two characters, as it is interpreted as \n by the system. You cannot use special characters such as `, % ,^ , and " in the MOTD text.

Step 4 In the EXEC Process Creation Banner field, enter a string to be displayed as the EXEC process creation banner when a user enters into the EXEC shell of the device.

Step 5 In the Login Banner field, enter a string to be displayed after the MOTD banner when a user attempts to log in to the device.

Step 6 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Changing the CLI Session Time

To change the CLI session time, do the following:

Step 1 Choose Devices > Devices > General Settings > Login Access Control > CLI Session Time . The CLI Session Time page is displayed.

Step 2 In the CLI Session Time field, enter the time (in minutes) that the device waits for a response before ending the session.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Changing Users—Admin Password

Every device (CDSM, SE, and SR) has a built-in user account. The username is admin and the default password is default . This account allows access to all services and entities in the CDS. Any user that can access the Admin Password page in the CDSM can configure a new password for the administrator user account on individual SEs and SRs.

To change the Admin password, do the following:

Step 1 Choose Devices > Devices > General Settings > Login Access Control > Users > Admin Password . The Admin Password page is displayed.

Step 2 In the Password field, enter a new password.

The following characters are not allowed: ?./;[]{}"@=|

Step 3 In the Confirm Password field, re-enter the password.

Step 4 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Creating, Editing, and Deleting Users—Usernames

You can create, edit, and delete user accounts for login access to individual devices or device groups. A privilege profile must be assigned to each new user account. The Usernames page uses privilege profiles to determine which tasks a user can perform and the level of access provided. Users with administrative privileges can add, delete, or modify user accounts through the CDSM or the device CLI.

To create, edit, or delete a user account, do the following:

Step 1 Choose Devices > Devices > General Settings > Login Access Control > Users > Usernames . The User Table page is displayed.

The table is sortable by clicking the column headings.

For information about Aggregate Settings, see the “Aggregate Settings” section

Step 2 Click the Create New icon in the task bar. The Local User page is displayed.

To edit a local user, click the Edit icon next to the name you want to edit.

Step 3 Enter the settings as appropriate. See Table 4-27 for a description of the fields.

Step 4 Click Submit to save the settings.

To delete a user, click the Edit icon for the user, then click the Delete icon in the task bar.

Authentication

User authentication and authorization (configuration rights) data can be maintained in any combination of these three databases:

• Local database (located on the device)
• RADIUS server (external database)
• TACACS+ server (external database)

The Login Authentication page allows you to choose an external access server or the internal (local) device-based authentication, authorization, and accounting (AAA) system for user access management. You can choose one method or a combination of the three methods. The default is to use the local database for authentication.

Configuring RADlUS Server Settings

Note The CDSM does not cache user authentication information. Therefore, the user is reauthenticated against the Remote Authentication Dial In User Service (RADIUS) server for every request. To prevent performance degradation caused by many authentication requests, install the CDSM in the same location as the RADIUS server, or as close as possible to it, to ensure that authentication requests can occur as quickly as possible.

To configure the RADIUS server settings, do the following:

Step 1 Choose Devices > Devices > General Settings > Authentication > RADIUS Server . The RADIUS Server Settings page is displayed.

Step 2 Enter the settings as appropriate. See Table 4-28 for a description of the fields.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

To use RADIUS for login authentication and authorization, see the “Login Authentication” section.

Configuring TACACS+ Server Settings

Note The CDSM does not cache user authentication information. Therefore, the user is reauthenticated against the Terminal Access Controller Access Control System Plus (TACACS+) server for every request. To prevent performance degradation caused by many authentication requests, install the CDSM in the same location as the TACACS+ server, or as close as possible to it, to ensure that authentication requests can occur as quickly as possible.

To configure the TACACS+ server settings, do the following:

Step 1 Choose Devices > Devices > General Settings > Authentication > TACACS+ Server . The TACACS+ Server Settings page is displayed.

Step 2 Enter the settings as appropriate. See Table 4-29 for a description of the fields.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

To use TACACS+ for login authentication and authorization, see the “Login Authentication” section.

Configuring AAA Accounting

Accounting tracks all user actions and when the action occurred. It can be used for an audit trail or for billing for connection time or resources used (bytes transferred).

The CDS accounting feature uses TACACS+ server logging. Accounting information is sent to the TACACS+ server only, not to the console or any other device. The syslog file on the SE logs accounting events locally. The format of events stored in the syslog is different from the format of accounting messages.

The TACACS+ protocol allows effective communication of AAA information between SEs and a central TACACS+ server. It uses TCP for reliable connections between clients and servers. SEs send authentication and authorization requests, as well as accounting information to the TACACS+ server.

Note Before you can configure the AAA accounting settings for a device, you must first configure a TACACS+ server for the device. See the “Configuring TACACS+ Server Settings” section.

Note The CDSM does not cache user authentication information. Therefore, the user is reauthenticated against the Terminal Access Controller Access Control System Plus (TACACS+) server for every request. To prevent performance degradation caused by many authentication requests, install the CDSM in the same location as the TACACS+ server, or as close as possible to it, to ensure that authentication requests can occur as quickly as possible.

To configure the AAA accounting settings, do the following:

Step 1 Choose Devices > Devices > General Settings > Authentication > AAA Accounting. The AAA Accounting Settings page is displayed.

Step 2 Enter the settings as appropriate. See Table 4-29 for a description of the fields.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Configuring an Access Control List

To configure an access control list (ACL) for group authorization, do the following:

Step 1 Choose Devices > Devices > General Settings > Authentication > Access Control List > Configure Access Control List . The Access Control List Table page is displayed.

The table is sortable by clicking the column headings.

Step 2 Click the Create New icon in the task bar. The Configure Access Control List page is displayed.

To edit a group, click the Edit icon next to the name you want to edit.

Step 3 Enter the settings as appropriate. See Table 4-31 for a description of the fields.

Step 4 Click Submit to save the settings.

To delete a group, click the Edit icon for the group, then click the Delete icon in the task bar.

Step 5 From the left-panel menu, choose Enable Access Control List . The Enable Access Control List page is displayed.

Step 6 Check the Enable Access Control List check box and click Submit .

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

To move a group up or down in the Access Control List table, click the Up arrow or Down arrow in the Move column.

The ACL can be applied from the device or from a device group. The source of the currently applied settings is shown in the Access Control List Table page.

Scheduling Database Maintenance

The database maintenance runs at the scheduled time only when the following three conditions are satisfied:

• Last vacuum process happened more than 30 minutes in the past.
• Percent increase in disk space usage is greater than 10 percent.
• Available free disk space is greater than 10 percent of the total disk space.

If any of these conditions are not satisfied, the database maintenance does not run at the scheduled time.

To schedule a database cleaning or reindexing, do the following:

Step 1 Choose Devices > Devices > General Settings > Database Maintenance . The Database Maintenance Settings page is displayed.

Step 2 Enter the settings as appropriate. See Table 4-32 for a description of the fields.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Setting Storage Handling

The Storage option offers disk error-handling settings.

Enabling Disk Error Handling

The Disk Error Handling page allows you to configure how disk errors are handled, and to define disk error-handling thresholds for bad sectors and disk errors.

The Threshold for Bad Sectors and the Threshold for Disk Errors counts only apply to bad sectors and disk errors detected since the last reboot of the device. These counts do not persist across a device reboot (reload).

If the Enable Disk Error Handling Reload option is enabled and the disk drive is marked bad because the disk error-handling threshold (bad sectors or disk errors) was reached, the device is automatically reloaded. Following the device reload, the bad sector and disk error threshold counts are reset, and a syslog message and an SNMP trap are generated.

If a critical disk drive is marked bad, the redundancy of the system disks for this device is affected. Critical disks are disks with SYSTEM partitions. However, drives with SYSTEM partitions use RAID1. With the RAID system, if the critical primary disk fails, the other mirrored disk (mirroring only occurs for SYSTEM partitions) seamlessly continues operation. There is a separate alarm for bad RAID. The SMART statistics that are returned by the show disks SMART-info detail command include sector errors directly reported by the drive itself.

For more information about the SMART sector errors, latent sector handling, and the disk repair command, see the “Disk Maintenance” section.

Note We do not recommend enabling the Enable Disk Error Handling Reload option, because the software state may be lost when the device is reloaded.

To configure a disk error-handling method, do the following:

Step 2 Check the Enable check box.

Step 3 Check the Enable Disk Error Handling Reload check box if you want the device to reload the disk when a disk has problems.

Step 4 Check the Enable Disk Error Handling Threshold check box if you want to set the number of disk errors allowed before the disk is marked bad, and enter the following:

a. In the Threshold for Bad Sectors field, enter the number of allowed bad sectors before marking the disk bad. This threshold only applies to bad sectors detected since the last reboot of the device. The range is 0 to 100. The default threshold is 15.

b. In the Threshold for Disk Errors field, enter the number of allowed disk errors before marking the disk bad. This threshold only applies to disk and sector errors detected since the last reboot of the device. The range is from 0 to 100,000. The default is 500.

Note When both Threshold for Bad Sectors and Threshold for Disk Errors are set to 0, it means never mark the disk bad when it detects bad sectors or disk errors, and the disk_failure alarm is not raised. A disk with SYSTEM partitions uses RAID1. There is a separate alarm for bad RAID.

Step 5 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

The Disk Failure Percentage Threshold field on the Service Monitor page sets the overall percentage of CDNFS disk failures. When the percentage of failed disks (default is 75) exceeds this threshold, no further requests are sent to this device. The Disk Failure Threshold setting is only for the CDNFS disks. For more information, see the “Setting Service Monitor Thresholds” section.

Network Settings

The Network pages provide settings for network connectivity. Configuring network settings consist of the following procedures:

• Enabling FTP Services
• Enabling DNS
• Enabling RCP
• Configuring NTP
• Setting the Time Zone
• Viewing Network Interfaces
• Configuring External IP Addresses
• Configuring Port Channel and Load Balancing Settings
• Configuring IP General Settings
• Configuring IP ACL
• Configuring Static IP Routes
• Configuring DSR VIP

Enabling FTP Services

To enable FTP services to listen for connection requests, do the following:

Step 1 Choose Devices > Devices > General Settings > Network > FTP . The FTP Settings page is displayed.

Step 2 Check the Enable FTP Services check box.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Enabling DNS

DNS Settings are required on all SEs, SRs, and CDSMs. The SEs need to be able to resolve the content origin server host name, the SRs need to be able to communicate with the DNS servers, and the CDSMs need to resolve host names.

To configure Domain Name System (DNS) servers, do the following:

Step 1 Choose Devices > Devices > General Settings > Network > DNS . The DNS Settings page is displayed.

Step 2 Enter the settings as appropriate. See Table 4-33 for a description of the fields.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Enabling RCP

Remote Copy Protocol (RCP) lets you download, upload, and copy configuration files between remote hosts and a switch. Unlike TFTP, which uses User Datagram Protocol (UDP), a connectionless protocol, RCP uses TCP, which is connection oriented. This service listens for requests on TCP port 514.

To enable RCP services, do the following:

Step 1 Choose Devices > Devices > General Settings > Network > RCP . The RCP page is displayed.

Step 2 Check the RCP Enable check box to have the RCP services listen for RCP requests.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Configuring NTP

To configure the device to synchronize its clock with an NTP server, do the following:

Step 1 Choose Devices > Devices > General Settings > Network > NTP . The NTP page is displayed.

Step 2 Check Enable to enable NTP.

Step 3 In the NTP Server field, enter the IP address or hostname of up to four NTP servers. Use a space to separate the entries.

Step 4 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Setting the Time Zone

If you have an outside source on your network that provides time services, such as an NTP server, you do not need to set the system clock manually. When manually setting the clock, enter the local time. The device calculates Coordinated Universal Time (UTC) based on the time zone set.

Note Two clocks exist in the system: the software clock and the hardware clock. The software uses the software clock. The hardware clock is used only at startup to initialize the software clock.

To manually configure the time zone, do the following:

Step 1 Choose Devices > Devices > General Settings > Network > Time Zone . The Time Zone page is displayed with the default settings of UTC (offset = 0) and no daylight savings time configured.

Step 2 To configure a standard time zone, do the following:

a. Click the Standard Time Zone radio button.

The standard convention for time zones uses a Location/Area format in which Location is a continent or a geographic region of the world and Area is a time zone region within that location. For a list of standard time zones that can be configured and their UTC offsets, see Table 4-34.

b. From the Standard Time Zone drop-down list, choose a location for the time zone. The page refreshes, displaying all area time zones for the chosen location in the second drop-down list.

c. Choose an area for the time zone.

The UTC offset (hours and minutes ahead or behind UTC) for the corresponding time zone is displayed. During summer time savings, the offset may differ and is displayed accordingly.

Note Some of the standard time zones (mostly time zones within the United States) have daylight savings time zones configured automatically.

Step 3 To configure a customized time zone, do the following:

a. Click the Customized Time Zone radio button.

b. In the Customized Time Zone field, enter a name to for the time zone. The time zone entry is case sensitive and can contain up to 40 characters. Spaces are not allowed. If you specify any of the standard time zone names, an error message is displayed when you click Submit .

c. For UTC offset, choose + or – from the UTC Offset drop-down list to indicate whether the configured time zone is ahead or behind UTC. Also, choose the number of hours (0 to 23) and minutes (0 to 59) offset from UTC for the customized time zone. The range for the UTC offset is from –23:59 to 23:59, and the default is 0:0.

Step 4 To configure customized summer time savings, do the following:

Note Customized summer time can be specified for both standard and customized time zones.

The start and end dates for summer time can be configured in two ways: absolute dates or recurring dates. Absolute dates apply once and must be reset every year. Recurring dates apply every year.

a. Click the Absolute Dates radio button to configure summer settings once.

b. In the Start Date and End Date fields, specify the month, day, and year that the summer time savings starts and ends in mm/dd/yyyy format.

Alternatively, click the Calendar icon and select a date. The chosen date is highlighted in blue. Click Apply .

c. Click the Recurring Dates radio button to configure a recurring summer setting.

d. Using the drop-down lists, choose the start day, week, and month when the summer time savings starts. For example, if the summer time savings begins the first Sunday in March, you would select Sunday, 1st, March from the drop-down lists.

e. Using the drop-down lists, choose the start day, week, and month when the summer time savings ends.

Step 5 Using the Start Time drop-down lists and the End Time drop-down lists, choose the hour (0 to 23) and minute (0 to 59) at which daylight savings time starts and ends.

Start Time and End Time fields for summer time are the times of the day when the clock is changed to reflect summer time. By default, both start and end times are set at 00:00.

Step 6 In the Offset field, specify the minutes offset from UTC (0 to 1439). (See Table 4-34.)

The summer time offset specifies the number of minutes that the system clock moves forward at the specified start time and backward at the end time.

Step 7 To not specify a summer or daylight savings time for the corresponding time zone, click the No Customized Summer Time Configured radio button.

Step 8 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Table 4-34 lists the UTC offsets for the different locations around the world.

The offset time (number of hours ahead or behind UTC) as displayed in the table is in effect during winter time. During summer time or daylight savings time, the offset may be different from the values in the table and is calculated and displayed accordingly by the system clock.

Viewing Network Interfaces

The Network Interfaces page is informational only. To view this information, choose Devices > Devices > General Settings > Network > Network Interfaces . Information about the network interfaces configured for the device is displayed.

Configuring External IP Addresses

The External IP page allows you to configure up to eight Network Address Translation (NAT) IP addresses. This allows a router to translate up to eight internal addresses to registered unique addresses and translate external registered addresses to addresses that are unique to the private network.

To configure NAT IP addresses, do the following:

Step 1 Choose Devices > Devices > General Settings > Network > External IP . The External IP Settings page is displayed.

Step 2 Check the Enable check box.

Step 3 In the External IP Address fields (1–8), enter up to eight IP addresses.

Step 4 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Configuring Port Channel and Load Balancing Settings

For information about configuring port channels using the CLI, see the “Redundant Dedicated Management Ports” section.

To configure load balancing on port channels, do the following:

Step 1 Choose Devices > Devices > General Settings > Network > Port Channel Settings . The Port Channel Settings page is displayed.

Step 2 From the Load Balancing Method drop-down list, choose one of the following load balancing methods:

• dst-ip —Destination IP address
• dst-mac —Destination MAC address
• dst-mixed-ip-port —Destination IP address and TCP/UDP port
• dst-port —Destination port
• round robin —Each interface in the channel group
• src-dst-ip —Source and destination IP address
• src-dst-mac —Source and destination MAC address
• src-dst-mixed-ip-port —Source destination IP address and source destination port
• src-dst-port —Source and destination port
• src-mixed-ip-port —Source IP address and source destination port
• src-port —Source port

Round robin allows traffic to be distributed evenly among all interfaces in the channel group. The other balancing options give you the flexibility to choose specific interfaces (by IP address, MAC address, port) when sending an Ethernet frame.

The source and destination options mean that while calculating the outgoing interface, take into account both the source and destination (MAC address or port).

Note Round-robin load-balancing mode is not supported when Link Aggregation Control Protocol (LACP) is enabled on the port channel.

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Configuring IP General Settings

The Path Maximum Transmission Unit (MTU) Discovery discovers the largest IP packet size allowable between the various links along the forwarding path and automatically sets the correct value for the packet size. By using the largest MTU the links can support, the sending device can minimize the number of packets it must send.

Note The Path MTU Discovery is a process initiated by the sending device. If a server does not support IP Path MTU Discovery, the receiving device has no mechanism available to avoid fragmenting datagrams generated by the server.

To enable Path MTU Discovery, do the following:

Step 1 Choose Devices > Devices > General Settings > Network > IP General Settings . The IP General Settings page is displayed.

Step 2 Check Enable Path MTU Discovery .

Step 3 Click Submit to save the settings.

To apply the factory default settings for the device, click the Apply Defaults icon in the task bar.

To remove the settings from the device, click the Remove Settings icon in the task bar.

Configuring IP ACL

Access control lists (ACLs) provide a means to filter packets by allowing a user to permit or deny IP packets from crossing specified interfaces. Packet filtering helps to control packet movement through the network. Such control can help limit network traffic and restrict network use by certain users or devices.

You can also apply ACLs to management services such as SNMP, SSH, HTTPS, Telnet, and FTP. ACLs can be used to control the traffic that these applications provide by restricting the type of traffic that the applications handle.

In a managed CDS network environment, administrators need to be able to prevent unauthorized access to various devices and services. CDS supports standard and extended ACLs that allow administrators to restrict access to or through a CDS network device, such as the SE. Administrators can use ACLs to reduce the infiltration of hackers, worms, and viruses that can harm the network.

ACLs provide controls that allow various services to be tied to a particular interface. For example, the administrator can use IP ACLs to define a public interface on the Service Engine for content serving and a private interface for management services (for example, Telnet, SSH, SNMP, HTTPS, and software upgrades). A device attempting to access one of the services must be on a list of trusted devices before it is allowed access. The implementation of ACLs for incoming traffic on certain ports for a particular protocol type is similar to the ACL support for the Cisco Global Site Selector and Cisco routers.

To use ACLs, the system administrator must first configure ACLs and then apply them to specific services. The following are some examples of how IP ACLs can be used in various enterprise deployments:

• Application layer proxy firewall with a hardened outside interface has no ports exposed. ( Hardened means that the interface carefully restricts which ports are available for access primarily for security reasons. Because the interface is outside, many types of attacks are possible.) The device’s outside address is globally accessible from the Internet, while its inside address is private. The inside interface has an ACL to limit Telnet, SSH, and CDSM traffic.
• Device is deployed anywhere within the enterprise. Like routers and switches, the administrator wants to limit Telnet, SSH, and CDSM access to the IT source subnets.
• Device is deployed as a reverse proxy in an untrusted environment, and the administrator wishes to allow only port 80 inbound traffic on the outside interface and outbound connections on the back-end interface.

Note IP ACLs are defined for individual devices only. IP ACLs cannot be managed through device groups.

When you create an IP ACL, you should note the following constraints:

• IP ACL names must be unique within the device.
• IP ACL names must be limited to 30 characters and contain no spaces or special characters.
• CDSM can manage up to 50 IP ACLs and a total of 500 conditions per device.
• When the IP ACL name is numeric, numbers 1 through 99 denote standard IP ACLs and numbers 100 through 199 denote extended IP ACLs. IP ACL names that begin with a number cannot contain nonnumeric characters.
• Extended IP ACLs cannot be used with SNMP applications.

Creating a New IP ACL

To create a new IP ACL, do the following:

Step 1 Choose Devices > Devices > General Settings > Network > IP ACL . The IP ACL Table page is displayed.

The table is sortable by clicking the column headings.

Step 2 Click the Create New icon in the task bar. The IP ACL page is displayed.

To edit an ACL, click the Edit icon next to the name you want to edit.

Step 3 In the Name field, enter a name, observing the naming rules for IP ACLs.

Step 4 From the ACL Type drop-down list, choose an IP ACL type ( Standard or Extended) . The default is Standard .

Step 5 Click Submit . The page refreshes and the Modifying IP ACL page for a newly created IP ACL is displayed.

Note Clicking Submit at this point merely saves the IP ACL; IP ACLs without any conditions defined do not appear on the individual devices.

Adding Conditions to an IP ACL

To add conditions to an IP ACL, do the following:

Step 1 Choose Devices > Devices > General Settings > Network > IP ACL . The IP ACL Table page is displayed.

Step 2 Click the Edit icon next to the name of the IP ACL you want to add a condition to. The Modifying IP ACL page is displayed.

Step 3 Click the Create New icon in the task bar. The Condition page is displayed.

To edit a condition, click the Edit icon next to the name you want to edit.

Note The number of available fields for creating IP ACL conditions depends on the whether the IP ACL type is standard or extended.

Step 4 Enter values for the properties that are enabled for the type of IP ACL that you are creating.

• To create a standard IP ACL, go to Step 5.
• To create an extended IP ACL, go to Step 6.

Step 5 To set up conditions for a standard IP ACL, do the following:

a. From the Purpose drop-down list, choose a purpose ( Permit or Deny ).

b. In the Source IP field, enter the source IP address.

c. In the Source IP Wildcard field, enter a source IP wildcard address.

d. Click Submit . The Modifying IP ACL page is displayed showing the new condition and its configuration.

e. To add another condition to the IP ACL, repeat the steps.

f. To reorder your list of conditions in the Modifying IP ACL page, use the Up arrow or Down arrow in the Order column, or click a column heading to sort by any configured parameter.

Note The order of the conditions listed becomes the order in which IP ACLs are applied to the device.

g. When you have finished adding conditions to the IP ACL, and you are satisfied with all your entries and the order in which the conditions are listed, click Submit in the Modifying IP ACL page to commit the IP ACL to the device database.

A green “Change submitted” indicator appears in the lower right corner of the Modifying IP ACL page to indicate that the IP ACL is being submitted to the device database.

Table 4-35 describes the fields in a standard IP ACL.

Step 6 To set up conditions for an extended IP ACL, do the following:

a. From the Purpose drop-down list, choose a purpose ( Permit or Deny ).

b. From the Extended Type drop-down list, choose Generic , TCP , UDP , or ICMP .

After you choose a type of extended IP ACL, various options become available depending on what type you choose.

c. Enter the settings as appropriate. See Table 4-36 for descriptions of the extended IP ACL fields.

d. Click Submit . The Modifying IP ACL page is displayed showing the new condition and its configuration.

e. To add another condition to the IP ACL, repeat the steps.

f. To reorder your list of conditions from the Modifying IP ACL page, use the Up arrow or Down arrow in the Order column, or click a column heading to sort by any configured parameter.

Note The order of the conditions listed becomes the order in which IP ACLs are applied to the device.

g. When you have finished adding conditions to the IP ACL, and you are satisfied with all your entries and the order in which the conditions are listed, click Submit in the Modifying IP ACL page to commit the IP ACL to the device database.

A green “Change submitted” indicator appears in the lower-left corner of the Modifying IP ACL page to indicate that the IP ACL is being submitted to the device database.

Table 4-37 lists the UDP keywords that you can use with extended access control lists.