Configuration manager application
Flash image
Electronic versions of this document and the Cisco 11000 Series Secure Content Accelerator Configuration Guide

The table below shows the configuration manager software versions appropriate for each operating system.

Operating System	Software Version
Red Hat Linux	3.1
Windows NT 4	3.1
Windows 2000	3.1
Solaris Sparc	3.1

Firmware and Software Version Notes

The FW directory contains the firmware flash image for the Cisco 11000 Series Secure Content Accelerator. The product is shipped with the latest flash image and, therefore, this file does not need to be used unless instructed by product support.

Product Version Information

The CSS 11000 Secure Content Accelerator configuration utility, cscacfg, is only compatible with devices that have the same software version. Devices with a different firmware version must be configured using the configuration manager that matches the firmware on the device.

Release version refers to the CD software release and not to the firmware or configuration manager versions. Any reference to firmware or the configuration manager in these release notes or documentation to CD software release version. The commands show version and show device display both the cscacfg (configuration manager) and firmware versions as well as the software release version. The end number of the text returned shows the build date and time stamp in the following format:

|Year|Month|Day|Time Stamp|

For example:

|2001|08|03|1046|

Loading New Firmware

The FW directory contains the firmware image of the Cisco 11000 Series Secure Content Accelerator. This file is described in the following table.

Filename	Description
css-sca-2fe-k9.phz	Image of the 3.1 software release. This image is used only to reflash the device and update previous versions of the device.

Use the following instructions to upgrade the firmware on the device and the remote configuration manager software. Please read the entire document before proceeding with the flash upgrade.

Loading a Flash Image—CLI

Note When updating a device with a new version of the firmware (rather than reloading the same version), you must use the CLI matching the previous version

1. Start the currently loaded configuration manager and attach to the device (remote only).

2. Enter the command enable.

3. Enter the command copy file flash.

4. Enter the path and file name of the new flash file as shown below.

NT or Windows 2000: d:\fw\css-sca-2fe-k9.phz
Red Hat Linux: /mnt/cdrom/fw/css-sca-2fe-k9.phz
Solaris: /cdrom/cdrom0/fw/css-sca-2fe-k9.phz

5. Press Enter and allow a couple of minutes to ensure that the flash has been successfully loaded.

6. Enter the command reload to reboot the device. Respond to screen prompts confirming the reload.

7. The device will write the image and then reboot again.

8. Enter quit to exit the configuration manager. If you plan to use the remote configuration manager with the device, you must install the new configuration manager as described in "Loading A New Remote Configuration Manager".

Loading a Flash Image—GUI

1. Attach to the device with a Web browser.

2. Click Tools to activate the Tools tabs.

3. Click the Firmware tab.

4. Type the path and file name or URL in the Upload Firmware text box, or click Browse and navigate to and select the file from the local file system.

5. Click Upload to load the firmware into the GUI.

6. Click Install Image next to the file information in the Installable Firmware Images panel.

7. After the new firmware has uploaded, click the Restart tab.

8. Click Reboot to reload the device.

9. If you plan to use the remote configuration manager with the device, you must install the new configuration manager as described in "Loading A New Remote Configuration Manager".

Loading A New Remote Configuration Manager

You can use the onboard telnet- and serial-based CLI configuration manager and Web-based GUI management without loading any additional software. However, if you wish to manager the SSL device from a remote connection, you must load the configuration manager version included on the distribution CD or configure the GUI for SSL client-side administration.Windows NT or Windows 2000

1. Remove the old remote configuration manager using Add/Remove Programs in the Control Panel.

2. If the distribution CD is not in the CD drive, insert it now.

3. Double-click the CD icon.

4. Double-click the MSWin icon.

5. Double-click the WinNT icon (Windows NT) or the Win2K icon (Windows 2000).

6. Double-click the setup.exe application icon.

7. Follow the Install Shield instructions on the screen.

Linux

Enter the following commands:

mount -o map=off /mnt/cdrom
cd /mnt/cdrom/Linux/i386
./install_csca

Solaris

1. Remove the previous package with pkgrm.

2. Enter this command:

pkgadd -d /cdrom/cdrom0/Solaris/Sparc

3. When presented with the package to add, press Enter to install it.

4. Type q after installation to exit.

What's New in 3.1

Increases the maximum number of concurrent connections possible.
Adds Backend Server configuration, enabling the device to take HTTP requests from a client and process HTTPS requests to the configured server.
Adds Reverse Proxy Server configuration, enabling the device to act as an SSL proxy for client requests. The device receives HTTP requests from the client configured to use the device as a proxy and then processes HTTPS requests to the requested web site.
Adds SNTP support.
Adds ability to generate keys on the device and save them to disk at time of creation.
Adds ability to generate certificate signing requests or self-signed certificates.
An additional security policy has been added to address potential problems in non-US installations using Internet Explorer. This policy, noexport56, includes the following ciphers: DES-CBC3-SHA, ARC-SHA, ARC4-MD5, DES-CBC-SHA, DES-CBC3-MD5, EXP-DES-CBC-SHA, EXP-ARC2-MD5, and EXP-ARC4-MD5. While this security policy disables the 56-bit cipher suite, it does not compromise the strength or the integrity of the encryption in any way.
Adds ability to suspend SSL server activity.
Adds client authentication ability to SSL server entries.
Adds ability to have automatic HTTP redirection to HTTPS.
Expands the SNMP capabilities by enhancing GET capabilities.
Adds the monitor command which expands the ability of showing statistics, device state, and configuration.
Adds the ability to set the baud rate of the Console port.
Adds the ability to turn on/off session caching.
HTTP headers can now be added to backend HTTP stream.
Adds ability to set the port for telnet and web management.
Adds ability to terminate sessions from the command line.
Adds custom completion to the help commands.
Adds the ability to set the date on the device manually.
Command syntax is now displayed with a ? rather than TAB which still shows completion of the command.
Adds Ephemeral RSA toggle.
Expands GUI functionality including Secure Server Wizard.

Notes for 3.1

The following sections contain notes related to the 3.1 release.

Upgrading from Previous Releases

The 3.1 version can only be upgraded from 3.0 and later releases. Upgrading from other versions can fail or cause the loss of certain configuration parameters. The CD includes a 3.0.5 directory containing firmware images and remote configuration software necessary for the incremental update. Before continuing with the section "Installing the 3.0.5 Firmware", please read the upgrade notes below.

Upgrade Notes

The following table presents device behaviors resulting from several upgrade scenarios as well as workarounds, if available.

Scenario	Result	Workaround
User-defined security policy "noexport56" is present. Reboot.	The user-defined security policy is over-written.	Recreate the existing user-defined security policy using a different name before updating the device.
User-defined certificate group "defaultCA" is present. Reboot.	The user-defined certificate group is over-written.	Recreate the existing user-defined certificate group with a different name before updating the device.
Prior to update, 251 user-defined security policies are present.	The security policy listed as index number 251 is deleted at reboot.	1. Prior to updating, attach to the device using a CLI and use the show ssl command. 2. Look at the list in the Security Policies block. The Id 251 security policy is deleted at reboot. You can delete another security policy to preserve that one. 3. Identify the security policy used least. 4. Use the following commands to delete it. `enable configure ssl no secpolicy polname` 5. Proceed with the update as instructed.
Prior to update, 64 user-defined certificate groups are present.	The certificate group listed as index number 64 is deleted at reboot.	1. Prior to updating, attach to the device using a CLI and use the show ssl command. 2. Look at the list in the Certificate Groups block. The Id 64 certificate group is lost when rebooting. You can delete another group to preserve that one. 3. Identify the certificate group used least. 4. Use the following commands to delete it. `enable configure ssl no certgroup certgpname` Proceed with the update as instructed.
Prior to update, more than 495 user-defined certificates are present.	Certificates listed as index number 499 and above are deleted at reboot.	1. Prior to updating, attach to the device using a CLI and use the show ssl command. 2. Look at the list in the Certificates block. Certificates listed as Id 499 and above are lost when rebooting. You can delete any less-used certificates to preserve the user-defined certificates listed as Id 499 and above. 3. Identify the certificates used least. 4. Use the following commands to delete each certificate. `enable configure ssl no cert certname` Proceed with the update as instructed.

Installing the 3.0.5 Firmware

1. Insert the CD into the CD-ROM drive of the configuring computer.

2. Start the configuration manager.

3. Attach the configuration manager to the Secure Content Accelerator.

4. Enter write flash at the prompt to save the current configuration. If more than one device is attached, you must supply the device name.

5. Enter copy file flash at the prompt.

6. Enter the path and file name for the firmware image as shown below:

Windows NT/Windows 2000: d:\305\fw\cisco.phr
Linux: /mnt/cdrom/305/fw/cisco.phr
Solaris: /cdrom/cdrom0/305/fw/cisco.phr

7. Enter y at the warning prompt.

8. Press Enter and wait several minutes to ensure the firmware has been flashed successfully.

9. Enter reload to reboot the device.

10. Enter quit to exit the configuration manager.

At this point, you can update the firmware to 3.1 using a telnet-, serial-, or Web GUI-based configuration session, or load the 3.0.5 remote configuration manager. To load the 3.0.5 remote configuration manager, continue with "Loading the 3.0.5 Remote Configuration Manager" below; otherwise, go to "Loading a Flash ImageCLI" or "Loading a Flash ImageGUI" above.

Loading the 3.0.5 Remote Configuration Manager

Follow the appropriate instructions to install the 3.0.5 remote configuration manager. After installing this version of the remote configuration manager, go to "Loading a Flash ImageCLI" above to complete the update to 3.1.

Windows NT or Windows 2000

1. Remove the old remote configuration manager using Add/Remove Programs in the Control Panel.

2. If the distribution CD is not in the CD drive, insert it now.

3. Double-click the CD icon.

4. Double-click the MSWin icon.

5. Double-click the WinNT icon (Windows NT) or the Win2K icon (Windows 2000).

6. Double-click the setup.exe application icon.

7. Follow the Install Shield instructions on the screen.

Linux

Enter the following commands:

mount -o map=off /mnt/cdrom
cd /mnt/cdrom/Linux/i386
./install_csca

Solaris

1. Remove the previous package with pkgrm.

2. Enter this command:

pkgadd -d /cdrom/cdrom0/Solaris/Sparc

3. When presented with the package to add, press Enter to install it.

4. Type q after installation to exit.

Operational Notes for 3.1

Configuring a device using multiple sessions or methods simultaneously can cause undesirable results. We recommend only one session be used at a time to make configuration changes.
If you change the IP address of a device with the remote configuration manager, the connection is lost to that device and must be re-established by restarting the remote configuration manager or using the discover command to find the device.
After changing a device from one-port to two-port mode, write the configuration to flash and reload (reboot) the device for proper functioning.
Copying to a device a configuration that changes the IP address or resets the interface settings can have unexpected results. If a configuration file was saved using the remote configuration manager or the onboard CLI, we recommend the same configuration manager be used to copy the configuration back to the device.
Changing terminal settings in variance with the actual window size can affect the readline capabilities of the device: the displayed cursor position might not be indicative of its actual position.
No error message is displayed when deleting an access list that is referenced by certain subsystems. Access is denied.
Although you can set the encryption method for the remote management using the GUI, the encryption is not enabled until a shared secret (passphrase) is set and remote management encryption is enabled. Use the serial console to set the shared secret; use any CLI to enable remote management encryption.
When using the Secure Content Accelerator with a CSS, do not set the keep-alive monitor on the CSS to use TCP service port 2932. This port is reserved for communication with the SSL appliance using the remote configuration manager. If you set the remote management port to a different TCP service port, ensure that the CSS keep-alive monitor does not use that port.

Network Design and Command Notes for 3.1

If your firewall or router filters traffic based upon MAC address, you must allow multiple MAC addresses per IP address on the interface connected to the device.
Changing the interface speed and duplex from autonegotiation does not display forced configuration if open connections are present. Forced speed and duplex settings are displayed only if a non-autonegotiated speed is specified.
Adding a static route entry for duplicating a previously RIP-discovered route is not supported.
Deleting a RIP-discovered route is not supported.
A RIP-discovered default route cannot be cleared with the command clear ip routes or by disabling RIP alone. To remove this type of route, disable RIP and reload the device.
The command ip route does not allow a change to an existing entry. To change an entry, delete the old entry first and then add the new one.
When changing TCP service ports in the remote management and Web management subsystems, the device must be reloaded (rebooted) for the change to take effect. When changing TCP service ports in the telnet subsystem, the reassignment is immediate. Subsequent telnet connections must be made with the newly assigned port.
In two-port mode services such as syslog, RIP, RDATE server, SNTP server, and SNMP are available only through the "Server" port.
There is no abort for the traceroute command. If the host cannot be reached, the procedure will take several minutes to timeout.
The help system for the ping completion of the traceroute command indicates a lookup option. This option is unavailable.
Multiple subsystems can be set to use the same access port. However, this causes undesirable results. Please ensure each subsystem "listening" port is unique on the device.
To use the syslog ability, the configured syslog server must be set to listen for remote entries.

Secure Server Notes for 3.1

If you edit an object referenced by a server, the server must be restarted before the changes will take effect. To restart the server, enter Privileged and Configuration modes, and use the suspend and activate commands.
Non-transparent server objects are not updated if the device IP address is changed. Reloading the device or accessing the configuration of each server object resets the IP address assignment.
Older browsers do not support chained certificates. We recommend upgrading to a newer browser version if chained certificate support is desired.
The HTTP redirect functionality is supported only in one-port mode at present.
A saved configuration file does not contain private keys. Private keys must be loaded separately with names exactly matching those referenced by the secure server. Additionally, old private keys are not removed from the startup-configuration by copying a new configuration to the device. To remove the old private keys, delete each private key, and write the running-configuration to the startup configuration or erase the startup-configuration.
When using client authentication, individual Web browsers behave very differently in the way they filter requests for client certificates and how they cache certain aspects of the session.

GUI Notes for 3.1

When setting up the device with SSL client-side GUI access, do not configure a non-transparent secure server to use the same localport.
Erasing the running-configuration of a device using the GUI disconnects the Web browser from the device. To continue configuration, reconnect to the device.
Setting the localport in a secure server entry to the listening TCP port of the Web management subsystem renders the GUI is inaccessible. You must use a different listening TCP port for each entity.
When pasting a configuration via the GUI, the existing configuration is erased first; therefore, all configurations pasted using the GUI should be complete configurations. Incremental configuration updates are only possible by adding the changes to a complete configuration, and then pasting this configuration. An option for overwriting or incrementally updating a configuration using a pasted configuration will be added at a future date.
The GUI telnet client does not process a backspace to the beginning of a line. Press Enter to obtain a new line and enter the command.
The administrative timeout in the GUI does not limit access from the same browser. Disconnect the browser when not at the workstation.
The GUI telnet client cannot connect if the port is not set to the default setting or if telnet access has been disabled on the device.
In certain situations the GUI does not report errors when trying to delete an object referenced by another object. This situation usually results in silent failure. However, be aware that the GUI allows you to delete a certificate referenced by a certificate group.
The GUI caches certain items and can misrepresent the state of the actual device in certain circumstances, such as if the device is rebooted without saving changes. To obtain the current device state, refresh the page. This can be accomplished by holding the SHIFT-clicking the Refresh button.
Once Web management is enabled, it is always accessible via the "Server" port (two-port mode) or the "Network" port (one-port mode) even if SSL client-side access has been configured. Use an access list to prevent unwanted access.
Assigning a Web management access list to the device completely prevents HTTPS access from the GUI. Setting the following access list allows HTTPS access to the GUI from any IP address:

access-list 10 permit 127.0.0.1 0.0.0.0
web-mgmt access-list 10

CLI Notes for 3.1

The monitor command can take an interval. The updated syntax is monitor [seconds] <command>, where seconds is the number of seconds between display refreshes and command is the command to use for display.
The write messages command is available during serial and telnet management sessions. Instead of a file name, specify a URL.
The copy to startup-configuration command replaces the startup-configuration. The keys and shared-secret password still exist unless they have been deleted or erased.
Erasing the running-configuration of a device using the CLI disconnects any remote configuration manager, GUI, or telnet sessions from the device. To continue configuration, reconnect to the device.
We do not recommend pasting complete configurations using the CLI. The device can lock up. Pasting sections of the configuration alleviates this problem.
Invalid date strings may be accepted when entering a date. Verify the setting using the show date command, and correct the date if necessary.
The custom completer completes previously created objects with the word "create" if TAB is pressed after the full name is typed. To edit an existing object, ensure "create" is not part of the command.
When writing configuration files to the running configuration, the new configuration file appends to the existing configuration rather than replacing it. In the process of recreating existing configuration information, some errors will be displayed. These can be ignored safely.
When trying to clear a current management session, an appropriate error message is displayed. However, the message sent to the message buffer might be misleading and can be safely ignored.
The on prefix will not change if you change the hostname of the referenced device. You must change the on prefix manually.
The passphrase option in the password command documentation is misleading. A passphrase is not supplied on the command line, but requested after entering the password command.

SNMP Notes for 3.1

Disabling SNMP does not disable the associated TCP ports. To disable the ports, save the disabled configuration and reload the device.
Certificate verification and SSL negotiation failure traps do not function.
You can set the SNMP access list to a non-existent one using the GUI. In this instance the access list behavior is to deny all traffic to that subsystem.
The factory-set default SNMP community is "public"; however, "public" is not listed in the configuration. The behavior of setting and resetting the SNMP community is demonstrated in the table below,

Command	SNMP community is set to...	SNMP community in configuration is...
snmp default community XYZ	XYZ	XYZ
no snmp default community	XYZ	No default community listed
snmp default community public	public	public

Linux-Specific Issues for 3.1

Using ^C to abort the QuickStart wizard may not work if the intr char is not set to ^C. Check the intr char using the command stty -a at the Linux prompt, and use this key combination to abort the QuickStart wizard.
While using the monitor command only the Enter key will abort the display.

Solaris-Specific Issues for 3.1

The remote configuration manager will not run using the sh shell.
While using the monitor command only the Enter key will abort the display.

Windows NT 4.0-Specific Issues for 3.1

The arrow keys on the Windows NT 4.0 default telnet client when accessing the CLI do not behave as expected. To scroll through the command history, use CTRL-N and CTRL-P.
In rare instances when using the Windows version of the configuration manager, resizing the window while doing a continuous display of statistics can cause an exception in the configuration manager.
Pasting certificates or keys using the default Windows NT telnet client may fail. This may be the result of the Return character at the end of each line in the file. If you open the file with Notepad and see black boxes at the end of each line, delete them and replace them with carriage returns using the Enter key. The file should load after this.

Windows 2000-Specific Issues for 3.1

In rare instances when using the Windows version of the configuration manager, resizing the window while doing a continuous display of statistics can cause an exception in the configuration manager.

Version 3.1 Command Changes

Table 1 and Table 2 list CLI commands and options that have been added or changed to software version 3.1. Changed commands are listed in their current 3.1 format. No commands have been removed in this release. The command descriptions are a summary. Please see the Cisco 11000 Series Secure Content Accelerator Configuration Guide for more information.

Table 1: CLI Commands Added in 3.1

Mode	Command and Syntax	Description
Top Level: Non-Privileged and Privileged Modes	monitor <command> on <devname\|groupname\|all> monitor <command>	Availability: Remote, Serial, Telnet Displays the results of the specified show command at one second intervals, where command is the command. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
set monitor-interval <value> no set monitor-interval	Availability: Remote, Serial, Telnet Sets the number of seconds between monitor-prefixed command refreshes. Use the no form of the command to return the monitor interval to default value.
show flow on <devname\|groupname\|all> show flow	Availability: Remote, Serial, Telnet Displays IP connection information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show rdate-server on <devname\|groupname\|all> show rdate-server	Availability: Remote, Serial, Telnet Displays the IP address of the RDATE protocol server configuration for one or more devices.
show sntp-server on <devname\|groupname\|all> show sntp-server	Availability: Remote, Serial, Telnet Displays SNTP-server information for one or more devices. The SNTP server is used for date and time information.
show ssl session-stats [continuous] [interval <value>] on <devname\|groupname\|all> show ssl session-stats [continuous] [interval <value>]	Availability: Remote, Serial, Telnet Displays SSL session statistics summed over all secure logical servers on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
Top Level: Non-Privileged and Privileged Modes (continued)	show telnet on <devname\|groupname\|all> show telnet	Availability: Remote, Serial, Telnet Displays telnet management information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show web-management on <devname\|groupname\|all> show web-management	Availability: Remote, Serial, Telnet Displays Web-based GUI management information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
terminal baud <1200\|2400\|4800\|9600\|19200\|38400\|115200>	Availability: Serial Sets the baud for communicating with the Secure Content Accelerator.
Top Level: Privileged Mode	clear line <sessionId>	Availability: Serial Closes a specified management session, where sessionId is the session identifier.
clear ssl session-stats on <devname\|groupname\|all> clear ssl session-stats	Availability: Remote, Serial, Telnet Resets all SSL session statistics for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
refresh	Availability: Remote, Serial, Telnet Updates device information in the configuration manager.
Group Configuration Mode	finished	Availability: Remote Exits Group Configuration Mode and returns to Top Level mode.
Configuration Mode	finished	Availability: Remote, Serial, Telnet Leaves Configuration Mode and returns to Top Level mode.
registration-code <code>	Availability: Remote, Serial, Telnet Stores the registration code of the device.
sntp-server <ipaddr> no sntp-server	Availability: Remote, Serial, Telnet Assigns an SNTP server, where ipaddr is the IP address of the server. Use the no form of the command to remove the SNTP server information.
Configuration Mode (continued)	telnet port <portid> no telnet port <portid>	Availability: Remote, Serial, Telnet Specifies the TCP service port to use for telnet management sessions, where portid is the TCP service port to be used when managing the device via a telnet session. Use the no form of the command to return the telnet management port to the default setting. The port assignment is used at the next attach.
web-mgmt port <portid> no web-mgmt port <portid>	Availability: Remote, Serial, Telnet Specifies the TCP service port used for management with the Web-based GUI, where portid is the TCP service port to be used when managing the device via the GUI. Use the no form of the command to return the GUI management port to the default setting. The port assignment is used at the next attach.
Interface Configuration Mode	finished	Availability: Remote, Serial, Telnet Leaves Interface Configuration Mode and returns to Top Level mode.
SSL Configuration Mode	backend-server <servname> [create] no backend-server <servname>	Availability: Remote, Serial, Telnet Creates and/or configures the specified backend server, where servname is the name of the server, and enters Backend Server Configuration mode for that server. The no form of the command is used to remove the specified backend server. A device can have a total of 255 servers in any combination of backend, reverse-proxy, or standard secure servers.
finished	Availability: Remote, Serial, Telnet Leaves SSL Configuration Mode and returns to Top Level mode.
gencsr <key <keyname>> [newhdr] [digest md5\|sha1] [output <filename\|url>]	Availability: Remote, Serial, Telnet Generates a certificate signing request and/or self-signed certificate, where keyname is the name of the key to use for generation and filename and url are the location for the optional output file.
reverse-proxy-server <servname> [create] no reverse-proxy-server <servname>	Availability: Remote, Serial, Telnet Creates and/or configures the specified reverse-proxy server, where servname is the name of the server, and enters Reverse-Proxy Server Configuration mode for that server. The no form of the command is used to remove the specified reverse-proxy server. A device can have a total of 255 servers in any combination of backend, reverse-proxy, or standard secure servers.
Backend Server Configuration Mode	activate	Availability: Remote, Serial, Telnet Activates the current suspended backend server if enough information has been configured.
certgroup serverauth <certgroupname> no certgroupchain	Availability: Remote, Serial, Telnet Assigns a certificate group to be used for server certificate authentication, where certgroupname is the name of the existing certificate group. The no form of the command is used to disable server authentication using the certificate group. When using the no form of the command, you need not specify any certificate group name. Only one certificate group can be used.
end	Availability: Remote, Serial, Telnet Exits Backend Server Configuration mode, activates all changes, and returns to SSL Configuration mode.
exit	Availability: Remote, Serial, Telnet Exits Backend Server Configuration mode, activates all changes, and returns to SSL Configuration mode.
finished	Availability: Remote, Serial, Telnet Leaves Backend Server Configuration Mode and returns to Top Level mode.
help [command]	Availability: Remote, Serial, Telnet Displays help information for the specified command. If you do not specify a command, help information is displayed for all Backend Server Configuration Commands.
info	Availability: Remote, Serial, Telnet Displays current information about the logical secure server being edited or created.
ip address <ipaddr> [netmask <mask>] no ip address	Availability: Remote, Serial, Telnet Sets the specified IP address for the backend server, where ipaddr is the IP address and mask is the valid netmask. Using the no form of the command clears the IP address for the backend server.
localport <port\|default>	Availability: Remote, Serial, Telnet Specifies the TCP service port through which non-secure connections are received, where port is the port specification. Using the keyword default sets the port specification to 80.
log-url <ipaddr>	Availability: Remote, Serial, Telnet Specifies a host for logging of URL requests, where ipaddr is the IP address of the log host.
Backend Server Configuration Mode (continued)	remoteport <port\|default>	Availability: Remote, Serial, Telnet Specifies the TCP service port through which redirected secure connections are sent, where port is the port specification. Using the keyword default sets the port specification to 443.
secpolicy <polname\|all\|default\|strong\|weak>	Availability: Remote, Serial, Telnet Creates an association between this server and the specified security policy, where polname is the name of the existing security policy.
serverauth enable no serverauth enable	Availability: Remote, Serial, Telnet Enables server certificate authentication. Using the no form of the command disables server certificate authentication.
serverauth ignore all \| none\|signature-failure\| expired-date\|cert-not-yet-valid\| invalid-ca\|domain-name no serverauth ignore all \| none\|signature-failure\| expired-date\|cert-not-yet-valid\| invalid-ca\|domain-name	Availability: Remote, Serial, Telnet Specifies the server authentication errors to ignore. Any combination of options can be used currently. Use the no form of the command to cease ignoring the specific server authentication error.
session-cache enable no session-cache enable	Availability: Remote, Serial, Telnet Enables session caching. Use the no form of the command to disable session caching.
session-cache size <cachesize>	Availability: Remote, Serial, Telnet Specifies the size of the session cache, where cachesize is the number of sessions to be cached. The default is 1024. The acceptable range is 1 to 5096.
session-cache timeout <seconds>	Availability: Remote, Serial, Telnet Specifies the session cache length before being timed out, where seconds is the number of seconds before the cache times out.
suspend [now]	Availability: Remote, Serial, Telnet Suspends the function of the backend server.
transparent no transparent	Availability: Remote, Serial, Telnet Enables the backend server to function as a transparent proxy (default). When transparent proxy behavior is disabled, the device accepts connections on the IP address of the Secure Content Accelerator rather than on the server address. The no form of the command is used to disable this behavior.
Certificate Configuration Mode	finished	Availability: Remote, Serial, Telnet Leaves Certificate Configuration Mode and returns to Top Level mode.
Certificate Group Configuration Mode	finished	Availability: Remote, Serial, Telnet Leaves Certificate Group Configuration Mode and returns to Top Level mode.
Key Configuration Mode	finished	Availability: Remote, Serial, Telnet Leaves Key Configuration Mode and returns to Top Level mode.
genrsa [bits <512\|1024>] [encrypt <des\|des3>] [seed <seedstring>] [output <filename\|url>]	Availability: Remote, Serial, Telnet Generates an RSA key.
Reverse-Proxy Server Configuration Mode	activate	Availability: Remote, Serial, Telnet Activates the current suspended reverse-proxy server if enough information has been configured.
certgroup serverauth <certgroupname> no certgroupchain	Availability: Remote, Serial, Telnet Assigns a certificate group to be used for server certificate authentication, where certgroupname is the name of the existing certificate group. The no form of the command is used to disable server authentication using the certificate group. When using the no form of the command, you need not specify any certificate group name. Only one certificate group can be used.
end	Availability: Remote, Serial, Telnet Exits Reverse-Proxy Server Configuration mode, activates all changes, and returns to SSL Configuration mode.
exit	Availability: Remote, Serial, Telnet Exits Reverse-Proxy Server Configuration mode, activates all changes, and returns to SSL Configuration mode.
finished	Availability: Remote, Serial, Telnet Leaves Reverse-Proxy Server Configuration Mode and returns to Top Level mode.
help [command]	Availability: Remote, Serial, Telnet Displays help information for the specified command. If you do not specify a command, help information is displayed for all Reverse-Proxy Server Configuration Commands.
info	Availability: Remote, Serial, Telnet Displays current information about the logical secure server being edited or created.
ip address <ipaddr> [netmask <mask>] no ip address	Availability: Remote, Serial, Telnet Sets the specified IP address for the backend server, where ipaddr is the IP address and mask is the valid netmask. Using the no form of the command clears the IP address for the backend server.
Reverse-Proxy Server Configuration Mode (continued)	localport <port\|default>	Availability: Remote, Serial, Telnet Specifies the TCP service port through which non-secure connections are received, where port is the port specification. Using the keyword default sets the port specification to 80.
log-url <ipaddr>	Availability: Remote, Serial, Telnet Specifies a host for logging of URL requests, where ipaddr is the IP address of the log host.
remoteport <port\|default>	Availability: Remote, Serial, Telnet Specifies the TCP service port through which redirected secure connections are sent, where port is the port specification. Using the keyword default sets the port specification to 443.
secpolicy <polname\|all\|default\|strong\|weak>	Availability: Remote, Serial, Telnet Creates an association between this server and the specified security policy, where polname is the name of the existing security policy.
serverauth enable no serverauth enable	Availability: Remote, Serial, Telnet Enables server certificate authentication. Using the no form of the command disables server certificate authentication.
serverauth ignore all \| none\|signature-failure\| expired-date\|cert-not-yet-valid\| invalid-ca\|domain-name no serverauth ignore all \| none\|signature-failure\| expired-date\|cert-not-yet-valid\| invalid-ca\|domain-name	Availability: Remote, Serial, Telnet Specifies the server authentication errors to ignore. Any combination of options can be used currently. Use the no form of the command to cease ignoring the specific server authentication error.
session-cache enable no session-cache enable	Availability: Remote, Serial, Telnet Enables session caching. Use the no form of the command to disable session caching.
session-cache size <cachesize>	Availability: Remote, Serial, Telnet Specifies the size of the session cache, where cachesize is the number of sessions to be cached. The default is 1024. The acceptable range is 1 to 5096.
session-cache timeout <seconds>	Availability: Remote, Serial, Telnet Specifies the session cache length before being timed out, where seconds is the number of seconds before the cache times out.
suspend [now]	Availability: Remote, Serial, Telnet Suspends the function of the reverse-proxy server.
Security Policy Configuration Mode	finished	Availability: Remote, Serial, Telnet Leaves Security Policy Configuration Mode and returns to Top Level mode.
Server Configuration Command Mode	activate	Availability: Remote, Serial, Telnet Activates the current logical secure server if enough information has been configured.
certgroup clientauth <certgroupname> no clientauth	Availability: Remote, Serial, Telnet Assigns a certificate group to be used as a certificate trust list for client certificate authentication. The no form of the command is used to disable client authentication using the certificate group. When using the no flag, you need not specify any certificate group name. Only one certificate chain can be used.
clientauth enable no clientauth enable	Availability: Remote, Serial, Telnet Enables client certificate authentication. Use the no form of the command to disable client certificate authentication.
clientauth error <cert-not-provided\|cert-not-yet-valid\|cert-has-expired\| cert-revoked\|cert-has-invalid-ca\|cert-has-signature-failure\|cert-other-error\|all> <fail\|failhtml\|ignore\|redirect <url>> no clientauth error <cert-not-provided\| cert-not-yet-valid\|cert-has-expired\|cert-revoked\| cert-has-invalid-ca\|cert-has-signature-failure\|cert-other-error\|all >	Availability: Remote, Serial, Telnet Specifies the client certificate authentication errors to ignore. Any combination of options can be used currently. Use the no form of the command to cease ignoring the specific client authentication error.
clientauth verifydepth <depth>	Availability: Remote, Serial, Telnet Specifies the level of certificate within the certificate group to use when verifying client certificates, where depth is the number of certificates within the certificate group to use for authentication.
ephrsa no ephrsa	Availability: Remote, Serial, Telnet When an export browser version connects to a server using 1024-bit keys, this allows the RSA key exchange (the SSL handshake) to be negotiated using a dynamically created 512-bit key. Using ephemeral RSA ensures the device complies with United States commerce laws. The default is no ephemeral RSA. Use the no form of the command to disable ephemeral RSA.
finished	Availability: Remote, Serial, Telnet Leaves Server Configuration Mode and returns to Top Level mode.
Server Configuration Mode (continued)	httpheader <session\|server-cert\|client-cert\| pre-filter\|prefix <prefixString>> no httpheader <session\|server-cert\|client-cert\| pre-filter\|prefix>	Availability: Remote, Serial, Telnet Specifies the header information to pass to backend HTTP servers. Any combination of options can be used currently. Use the no form of the command to cease using the specific option.
redirect no redirect	Availability: Remote, Serial, Telnet Enables server redirection. Use the no form of the command to disable server redirection.
session-cache enable no session-cache enable	Availability: Remote, Serial, Telnet Enables session caching. Use the no form of the command to disable session caching.
session-cache size <cachesize>	Availability: Remote, Serial, Telnet Specifies the size of the session cache, where cachesize is the number of sessions. The default is 1024. The acceptable range is 1 to 5096.
session-cache timeout <seconds>	Availability: Remote, Serial, Telnet Specifies the session cache length before being timed out, where seconds is the number of seconds.
suspend [now]	Availability: Remote, Serial, Telnet Suspends the function of the server.

Mode

Command and Syntax

Description

Top Level: Non-Privileged and Privileged Modes

monitor <command>

on <devname|groupname|all> monitor <command>

Availability: Remote, Serial, Telnet

Displays the results of the specified show command at one second intervals, where command is the command. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

set monitor-interval <value>
no set monitor-interval

Availability: Remote, Serial, Telnet

Sets the number of seconds between monitor-prefixed command refreshes. Use the no form of the command to return the monitor interval to default value.

show flow

on <devname|groupname|all> show flow

Availability: Remote, Serial, Telnet

Displays IP connection information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show rdate-server

on <devname|groupname|all> show rdate-server

Availability: Remote, Serial, Telnet

Displays the IP address of the RDATE protocol server configuration for one or more devices.

show sntp-server

on <devname|groupname|all> show sntp-server

Availability: Remote, Serial, Telnet

Displays SNTP-server information for one or more devices. The SNTP server is used for date and time information.

show ssl session-stats [continuous] [interval <value>]

on <devname|groupname|all> show ssl session-stats [continuous] [interval <value>]

Availability: Remote, Serial, Telnet

Displays SSL session statistics summed over all secure logical servers on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

Top Level: Non-Privileged and Privileged Modes

(continued)

show telnet

on <devname|groupname|all> show telnet

Availability: Remote, Serial, Telnet

Displays telnet management information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show web-management

on <devname|groupname|all> show web-management

Availability: Remote, Serial, Telnet

Displays Web-based GUI management information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

terminal baud <1200|2400|4800|9600|19200|38400|115200>

Availability: Serial

Sets the baud for communicating with the Secure Content Accelerator.

Top Level: Privileged Mode

clear line <sessionId>

Availability: Serial

Closes a specified management session, where sessionId is the session identifier.

clear ssl session-stats

on <devname|groupname|all> clear ssl session-stats

Availability: Remote, Serial, Telnet

Resets all SSL session statistics for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

refresh

Availability: Remote, Serial, Telnet

Updates device information in the configuration manager.

Group Configuration Mode

finished

Availability: Remote

Exits Group Configuration Mode and returns to Top Level mode.

Configuration Mode

finished

Availability: Remote, Serial, Telnet

Leaves Configuration Mode and returns to Top Level mode.

registration-code <code>

Availability: Remote, Serial, Telnet

Stores the registration code of the device.

sntp-server <ipaddr>
no sntp-server

Availability: Remote, Serial, Telnet

Assigns an SNTP server, where ipaddr is the IP address of the server. Use the no form of the command to remove the SNTP server information.

Configuration Mode

(continued)

telnet port <portid>
no telnet port <portid>

Availability: Remote, Serial, Telnet

Specifies the TCP service port to use for telnet management sessions, where portid is the TCP service port to be used when managing the device via a telnet session. Use the no form of the command to return the telnet management port to the default setting. The port assignment is used at the next attach.

web-mgmt port <portid>
no web-mgmt port <portid>

Availability: Remote, Serial, Telnet

Specifies the TCP service port used for management with the Web-based GUI, where portid is the TCP service port to be used when managing the device via the GUI. Use the no form of the command to return the GUI management port to the default setting. The port assignment is used at the next attach.

Interface Configuration Mode

finished

Availability: Remote, Serial, Telnet

Leaves Interface Configuration Mode and returns to Top Level mode.

SSL Configuration Mode

backend-server <servname> [create]
no backend-server <servname>

Availability: Remote, Serial, Telnet

Creates and/or configures the specified backend server, where servname is the name of the server, and enters Backend Server Configuration mode for that server. The no form of the command is used to remove the specified backend server. A device can have a total of 255 servers in any combination of backend, reverse-proxy, or standard secure servers.

finished

Availability: Remote, Serial, Telnet

Leaves SSL Configuration Mode and returns to Top Level mode.

gencsr <key <keyname>> [newhdr] [digest md5|sha1] [output <filename|url>]

Availability: Remote, Serial, Telnet

Generates a certificate signing request and/or self-signed certificate, where keyname is the name of the key to use for generation and filename and url are the location for the optional output file.

reverse-proxy-server <servname> [create]
no reverse-proxy-server <servname>

Availability: Remote, Serial, Telnet

Creates and/or configures the specified reverse-proxy server, where servname is the name of the server, and enters Reverse-Proxy Server Configuration mode for that server. The no form of the command is used to remove the specified reverse-proxy server. A device can have a total of 255 servers in any combination of backend, reverse-proxy, or standard secure servers.

Backend Server Configuration Mode

activate

Availability: Remote, Serial, Telnet

Activates the current suspended backend server if enough information has been configured.

certgroup serverauth <certgroupname>
no certgroupchain

Availability: Remote, Serial, Telnet

Assigns a certificate group to be used for server certificate authentication, where certgroupname is the name of the existing certificate group. The no form of the command is used to disable server authentication using the certificate group. When using the no form of the command, you need not specify any certificate group name. Only one certificate group can be used.

end

Availability: Remote, Serial, Telnet

Exits Backend Server Configuration mode, activates all changes, and returns to SSL Configuration mode.

exit

Availability: Remote, Serial, Telnet

Exits Backend Server Configuration mode, activates all changes, and returns to SSL Configuration mode.

finished

Availability: Remote, Serial, Telnet

Leaves Backend Server Configuration Mode and returns to Top Level mode.

help [command]

Availability: Remote, Serial, Telnet

Displays help information for the specified command. If you do not specify a command, help information is displayed for all Backend Server Configuration Commands.

info

Availability: Remote, Serial, Telnet

Displays current information about the logical secure server being edited or created.

ip address <ipaddr> [netmask <mask>]
no ip address

Availability: Remote, Serial, Telnet

Sets the specified IP address for the backend server, where ipaddr is the IP address and mask is the valid netmask. Using the no form of the command clears the IP address for the backend server.

localport <port|default>

Availability: Remote, Serial, Telnet

Specifies the TCP service port through which non-secure connections are received, where port is the port specification. Using the keyword default sets the port specification to 80.

log-url <ipaddr>

Availability: Remote, Serial, Telnet

Specifies a host for logging of URL requests, where ipaddr is the IP address of the log host.

Backend Server Configuration Mode

(continued)

remoteport <port|default>

Availability: Remote, Serial, Telnet

Specifies the TCP service port through which redirected secure connections are sent, where port is the port specification. Using the keyword default sets the port specification to 443.

secpolicy <polname|all|default|strong|weak>

Availability: Remote, Serial, Telnet

Creates an association between this server and the specified security policy, where polname is the name of the existing security policy.

serverauth enable
no serverauth enable

Availability: Remote, Serial, Telnet

Enables server certificate authentication. Using the no form of the command disables server certificate authentication.

Availability: Remote, Serial, Telnet

Specifies the server authentication errors to ignore. Any combination of options can be used currently. Use the no form of the command to cease ignoring the specific server authentication error.

session-cache enable
no session-cache enable

Availability: Remote, Serial, Telnet

Enables session caching. Use the no form of the command to disable session caching.

session-cache size <cachesize>

Availability: Remote, Serial, Telnet

Specifies the size of the session cache, where cachesize is the number of sessions to be cached. The default is 1024. The acceptable range is 1 to 5096.

session-cache timeout <seconds>

Availability: Remote, Serial, Telnet

Specifies the session cache length before being timed out, where seconds is the number of seconds before the cache times out.

suspend [now]

Availability: Remote, Serial, Telnet

Suspends the function of the backend server.

transparent
no transparent

Availability: Remote, Serial, Telnet

Enables the backend server to function as a transparent proxy (default). When transparent proxy behavior is disabled, the device accepts connections on the IP address of the Secure Content Accelerator rather than on the server address. The no form of the command is used to disable this behavior.

Certificate Configuration Mode

finished

Availability: Remote, Serial, Telnet

Leaves Certificate Configuration Mode and returns to Top Level mode.

Certificate Group Configuration Mode

finished

Availability: Remote, Serial, Telnet

Leaves Certificate Group Configuration Mode and returns to Top Level mode.

Key Configuration Mode

finished

Availability: Remote, Serial, Telnet

Leaves Key Configuration Mode and returns to Top Level mode.

genrsa [bits <512|1024>] [encrypt <des|des3>] [seed <seedstring>] [output <filename|url>]

Availability: Remote, Serial, Telnet

Generates an RSA key.

Reverse-Proxy Server Configuration Mode

activate

Availability: Remote, Serial, Telnet

Activates the current suspended reverse-proxy server if enough information has been configured.

certgroup serverauth <certgroupname>
no certgroupchain

Availability: Remote, Serial, Telnet

end

Availability: Remote, Serial, Telnet

Exits Reverse-Proxy Server Configuration mode, activates all changes, and returns to SSL Configuration mode.

exit

Availability: Remote, Serial, Telnet

Exits Reverse-Proxy Server Configuration mode, activates all changes, and returns to SSL Configuration mode.

finished

Availability: Remote, Serial, Telnet

Leaves Reverse-Proxy Server Configuration Mode and returns to Top Level mode.

help [command]

Availability: Remote, Serial, Telnet

Displays help information for the specified command. If you do not specify a command, help information is displayed for all Reverse-Proxy Server Configuration Commands.

info

Availability: Remote, Serial, Telnet

Displays current information about the logical secure server being edited or created.

ip address <ipaddr> [netmask <mask>]
no ip address

Availability: Remote, Serial, Telnet

Sets the specified IP address for the backend server, where ipaddr is the IP address and mask is the valid netmask. Using the no form of the command clears the IP address for the backend server.

Reverse-Proxy Server Configuration Mode

(continued)

localport <port|default>

Availability: Remote, Serial, Telnet

Specifies the TCP service port through which non-secure connections are received, where port is the port specification. Using the keyword default sets the port specification to 80.

log-url <ipaddr>

Availability: Remote, Serial, Telnet

Specifies a host for logging of URL requests, where ipaddr is the IP address of the log host.

remoteport <port|default>

Availability: Remote, Serial, Telnet

Specifies the TCP service port through which redirected secure connections are sent, where port is the port specification. Using the keyword default sets the port specification to 443.

secpolicy <polname|all|default|strong|weak>

Availability: Remote, Serial, Telnet

Creates an association between this server and the specified security policy, where polname is the name of the existing security policy.

serverauth enable
no serverauth enable

Availability: Remote, Serial, Telnet

Enables server certificate authentication. Using the no form of the command disables server certificate authentication.

Availability: Remote, Serial, Telnet

Specifies the server authentication errors to ignore. Any combination of options can be used currently. Use the no form of the command to cease ignoring the specific server authentication error.

session-cache enable
no session-cache enable

Availability: Remote, Serial, Telnet

Enables session caching. Use the no form of the command to disable session caching.

session-cache size <cachesize>

Availability: Remote, Serial, Telnet

Specifies the size of the session cache, where cachesize is the number of sessions to be cached. The default is 1024. The acceptable range is 1 to 5096.

session-cache timeout <seconds>

Availability: Remote, Serial, Telnet

Specifies the session cache length before being timed out, where seconds is the number of seconds before the cache times out.

suspend [now]

Availability: Remote, Serial, Telnet

Suspends the function of the reverse-proxy server.

Security Policy Configuration Mode

finished

Availability: Remote, Serial, Telnet

Leaves Security Policy Configuration Mode and returns to Top Level mode.

Server Configuration Command Mode

activate

Availability: Remote, Serial, Telnet

Activates the current logical secure server if enough information has been configured.

certgroup clientauth <certgroupname>
no clientauth

Availability: Remote, Serial, Telnet

Assigns a certificate group to be used as a certificate trust list for client certificate authentication. The no form of the command is used to disable client authentication using the certificate group. When using the no flag, you need not specify any certificate group name. Only one certificate chain can be used.

clientauth enable
no clientauth enable

Availability: Remote, Serial, Telnet

Enables client certificate authentication. Use the no form of the command to disable client certificate authentication.

Availability: Remote, Serial, Telnet

Specifies the client certificate authentication errors to ignore. Any combination of options can be used currently. Use the no form of the command to cease ignoring the specific client authentication error.

clientauth verifydepth <depth>

Availability: Remote, Serial, Telnet

Specifies the level of certificate within the certificate group to use when verifying client certificates, where depth is the number of certificates within the certificate group to use for authentication.

ephrsa
no ephrsa

Availability: Remote, Serial, Telnet

When an export browser version connects to a server using 1024-bit keys, this allows the RSA key exchange (the SSL handshake) to be negotiated using a dynamically created 512-bit key. Using ephemeral RSA ensures the device complies with United States commerce laws. The default is no ephemeral RSA. Use the no form of the command to disable ephemeral RSA.

finished

Availability: Remote, Serial, Telnet

Leaves Server Configuration Mode and returns to Top Level mode.

Server Configuration Mode

(continued)

Availability: Remote, Serial, Telnet

Specifies the header information to pass to backend HTTP servers. Any combination of options can be used currently. Use the no form of the command to cease using the specific option.

redirect
no redirect

Availability: Remote, Serial, Telnet

Enables server redirection. Use the no form of the command to disable server redirection.

session-cache enable
no session-cache enable

Availability: Remote, Serial, Telnet

Enables session caching. Use the no form of the command to disable session caching.

session-cache size <cachesize>

Availability: Remote, Serial, Telnet

Specifies the size of the session cache, where cachesize is the number of sessions. The default is 1024. The acceptable range is 1 to 5096.

session-cache timeout <seconds>

Availability: Remote, Serial, Telnet

Specifies the session cache length before being timed out, where seconds is the number of seconds.

suspend [now]

Availability: Remote, Serial, Telnet

Suspends the function of the server.

Table 2: CLI Commands Changed in 3.1

Mode	Command and Syntax	Description
Top Level: Non-Privileged and Privileged Modes	show profile [all]	Availability: Remote Displays the monitor-interval and on-prefix settings of the if they have been changed from the default settings.
Top Level: Privileged Mode	copy running-configuration [filename\|url] on <devname> copy running-configuration [filename]	Availability: Remote, Serial, Telnet Writes the running-configuration of a device to a file. If you do not specify a file name or URL, you are prompted for it. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
	copy to flash [filename\|url] on <devname> copy to flash [filename]	Availability: Remote, Serial, Telnet Uploads a Cisco Secure Content Accelerator image file to the device flash. If you do not specify a file name or URL, you are prompted for it. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
	copy to running-configuration [filename\|url] on <devname> copy to running-configuration [filename]	Availability: Remote, Serial, Telnet Uploads a saved configuration file and merges it to the running-configuration of a device. If you do not specify a file name or URL, you are prompted for it. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
Configuration Mode	password <access\|enable> no password <access\|enable>	Availability: Remote, Serial, Telnet Sets the access- or enable-level password for the current Secure Content Accelerator. You are prompted to enter and verify the password. Use the no form of the command to clear the access- or enable-level password for the current device.
Backend Server Configuration Mode	secpolicy <polname\|all\|default\| noexport56\|strong\|weak>	Availability: Remote, Serial, Telnet Creates an association between the backend server and the specified security policy.
Reverse-Proxy Server Configuration Mode	secpolicy <polname\|all\|default\| noexport56\|strong\|weak>	Availability: Remote, Serial, Telnet Creates an association between the reverse-proxy server and the specified security policy.
Server Configuration Mode	secpolicy <polname\|all\|default\| noexport56\|strong\|weak>	Availability: Remote, Serial, Telnet Creates an association between the server and the specified security policy.

What's New in 3.0.5

The 3.0.5 release of the Cisco Secure Content Accelerator firmware and software adds additional features and functionality. Changes to individual commands are noted in "Version 3.0.5 Command Changes".

The 2.0.1c version had a mini configuration utility available on the serial port. This has been replaced with a Command Line Interface, providing the same features and functions as the remote configuration manager as well as allowing the device to be put into single-port mode and configuring a passphrase for encrypted management sessions.
The new version allows management of the device via a telnet session and onboard CLI configuration manager.
The Cisco Secure Content Accelerator now can be configured via a web browser connection to the onboard GUI. Most functionality of the CLI configuration manager is available.
PKCS#7-format chain certificates can be loaded directly without having to use the OpenSSL utility to pre-process them.
PCKS#12-format certificate/private key pairs can be imported directly without having to use the OpenSSL utility to pre-process them.
The serial and telnet CLI configuration connections allow ping and traceroute commands to be executed from the device rather than from the configuring computer.
DNS information can be configured on the device.
A remote timeserver (RDATE server) can be set and used for time information on the device.
Date and time information for the device can be displayed using a telnet or serial management session.
Target addressing in the Top Level commands of the remote configuration manager uses a different paradigm. \The Top Level command set has been split to create Non-Privileged and Privileged command sets. Non-Privileged commands are available within both Non-Privileged and Privileged modes.
Using the remote configuration manager, the administrator can define device groups valid for the management session. These groups can be targeted by some commands in the configuration manager. "All" devices is a valid target group for some commands.
Additional commands have been activated for use with device groups.
Requested URLs can be logged with the IP address of the associated client.
Administrators can view open serial, telnet, or remote configuration sessions via serial and telnet CLI management sessions.
Private keys and certificates are loaded as separate entities instead of single key associations. Thus, Key Association Configuration mode has been replaced with Key Configuration mode.
Failover has been removed. Customers desiring a high availability option should use the capabilities of other networking devices to provide it.
Several statistic display commands can be used in a continuous fashion. Administrators can specify the interval for statistic display refresh.
The firmware can be upgraded using HTTP, HTTPS, FTP, or TFPT via a serial or telnet management session.
Device configurations can be copied to and from the device using HTTP, HTTPS, FTP, or TFPT via a serial or telnet management session.
The maximum number of possible concurrent connections has been increased from 800 to 1600 total connections per second.

Known Issues in 3.0.5

The notes in this section apply to the Cisco CSS 11000 Secure Content Accelerator configuration manager application, version 3.0.5, for all operating systems.

The web-based management GUI required Internet Explorer 5.5 or greater. There are many issues when using older versions or other browsers. Certain configurations can cause Netscape to crash.
In the web-based management GUI, the validity of certificates is incorrectly displayed as "false".
When loading keys or certificates in the web-based management GUI, you might need to refresh the browser before they can be displayed.
Be careful when deleting objects such as certificates, keys, certificate groups, and security policies using the web-based management GUI. These objects can be deleted using the GUI even when referenced by another object, such as a secure server ("ssl-server").
If power and is lost and is restored within three minutes, the device may come up without a configuration. Reloading the device (using the reload command) will restore the configuration.
Although the web-based management GUI can be assigned an access list, the access list information is not enabled.
When using the web-based management GUI with a device configured with an enable password, you are prompted to re-enter the password after an administrator inactivity timeout. There is an anomaly that allows access to the device configuration without entering a password or the correct password after an inactivity timeout has occurred. To ensure security of the device configuration while away from the configuring computer, close the management session and re-initiate it when you return.
When using the DNS functionality and pinging a host unknown to the DNS server on an isolated network, the reply will come from the last successfully pinged host.
The command copy running-configuration does not have a completer when using the on prefix. The completer is available when the on prefix is not used and only one device is attached.
When creating or modifying a secure server entry using the onboard CLI (via telnet or serial connections), messages stating "modsizebytes" should be ignored.
If you change the IP address of a device with the remote configuration manager, the connection is lost to that device and must be re-established by restarting the remote configuration manager or by using the discover command to find the device.
If your firewall or router filters traffic based upon MAC addresses, you must allow multiple MAC addresses per IP address on the interface connected to the Cisco Secure Content Accelerator.
Adding a static route entry for which a RIP-discovered route already exists is not supported. Deleting a RIP-discovered route also is not supported at this time.
You may receive errors from the OpenSSL utility when generating keys if few active sessions are running. Key generation may fail. Consider using the -rand option in the OpenSSL utility. Alternatively, open several applications or windows to increase the data available for OpenSSL to generate a more random key.
When attaching to a device configured to use remote management encryption, entering an invalid shared passphrase results in the following message:

%%timeout waiting for response to my challenge
%%Could not successfully attach to <device name>.

Copying a configuration to a device that changes the IP address or resets the interface settings may have unexpected effects. If a configuration file was saved using the remote configuration manager or onboard CLI, we recommend that the same management session type is used to copy the configuration back to the device.
The information for the command no remote-management enable in the remote configuration manager states that all remote management sessions will be cut off. The current session(s) are not halted, but no new remote management sessions can be established.
No error message is displayed when deleting an access list referenced by certain subsystems. All telnet access will be denied in this situation. Remote management, SNMP, and web management functions will behave as if no access list as been assigned. To deny access to these subsystems, disable the subsystem or reassign an appropriate access list.
When using the onboard CLI, the confirmation prompt for the reload command fails the first time after erasing or saving the configuration to the startup-configuration. The first character of the response will appear and the reload will not take place. Enter the reload command again to reboot the device.
The command ip route does not allow a change to an existing entry. To change an entry, delete the old entry first, then add the new one.
When using the remote configuration manager with multiple devices attached, some of the show commands do not identify which item belongs to which device. In these instances, use the on prefix with individual device names.
Configuring a device using simultaneous multiple sessions or methods may have unexpected results. We recommend the device be configured using a single management session.
The erase running-configuration command does not delete access list references. However, the individual access lists are removed. SNMP access reverts to a disabled state.

Linux-Specific Notes for 3.0.5

The notes in this section apply to the Cisco CSS 11000 Secure Content Accelerator configuration manager application, version 3.0.5, for RedHat Linux.

A certain library is needed for the remote configuration manager to function. Make sure the following RPM is installed from the Red Hat distribution CD:

/mnt/cdrom/RedHat/RPMS/compat-libstdc++-6.2-2.9.0.9.i386.rpm

Using ^C to abort the QuickStart wizard may not work if the intr char is not ^C. Check the intr char with the stty -a at the Linux prompt, and use that key command to abort the QuickStart wizard.

Solaris-Specific Notes for 3.0.5

The notes in this section apply to the Cisco CSS 11000 Secure Content Accelerator configuration manager application, version 3.0.5, for Solaris.

Certain error messages are not displayed in the remote configuration manager under Solaris.
To assure the remote configuration manager runs under Solaris 2.6, follow these steps:

a. Log in as root.

b. Enter cd /usr/lib

c. Enter ln -s libposix4.so.1 librt.so.1

Windows 2000-Specific Notes for 3.0.5

In rare instances, resizing the window while doing a continuous display of statistics can cause an exception in the configuration manager.

Windows NT-Specific Notes for 3.0.5

The arrow keys will behave unexpectedly in the Windows NT default telnet client when accessing the CLI. To scroll through the command history, use CTRL+N and CTRL+P.
In rare instances, resizing the window while doing a continuous display of statistics can cause an exception in the configuration manager.

Version 3.0.5 Command Changes

Table 3 and Table 4 list CLI commands and options that have been added or changed to software version 3.0.5. Changed commands are listed in their current 3.0.5 format. Table 5 lists commands which have been removed in this release version. These descriptions are a summary. Please see the Cisco CSS 11000 Secure Content Accelerator Configuration Guide for more information.

Table 3: CLI Commands Added in 3.0.5

Mode	Command and Syntax	Description
Top Level: Non-Privileged and Privileged Modes	enable no enable on <devname\|groupname\|all> enable on <devname\|groupname\|all> no enable	Availability: Remote, Serial, Telnet If an enable-level password has been defined, you must enter it when prompted. When using remote management, enters Privileged mode for a single, attached device. If more than one device is valid for this command, use the on form of the command to specify the device(s) to enable, where devname is the name of an individual device, groupname is the name of a user-defined group, and all represents all appropriate devices. Using the no form of this command leaves Privileged mode.
group <groupname> [create] no group <groupname>	Availability: Remote Use the create flag to create the specified group and enter Group Configuration mode for it, where groupname is the name of the device group. Use the no form of the command to remove the specified group.
paws	Availability: Remote, Serial, Telnet Pauses the configuration manager for a specified time or until a key is pressed.
set on-prefix <devname\|groupname> no set on-prefix	Availability: Remote Sets the target device(s) to address as default when using the on prefix, where devname is the name of a single device and groupname is the name of a user-defined device group. Use the no form of the command to clear the default entity.
show cpu [continuous] [interval <value>] on <devname\|groupname\|all> show cpu [continuous] [interval <value>]	Availability: Remote, Serial, Telnet Displays CPU utilization information for one or more devices. Use the continuous option to display statistics continuously, updated every second. Use the interval option to specify an interval for display updates, where value is the interval in seconds. Press any key to stop displaying statistics. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show date	Availability: Serial, Telnet Displays current date and time settings on the device.
Top Level: Non-Privileged and Privileged Modes (continued)	show device list	Availability: Remote Displays summary information for all Secure Content Accelerators in the same broadcast domain as the configuring computer or found by the configuration manager through the discover or discover port commands.
show dns on <devname\|groupname\|all> show dns	Availability: Remote, Serial, Telnet Displays DNS configuration information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show group [<groupname>]	Availability: Remote Displays group summary information for the specified group, where groupname is the name of the user-defined group. You must specify a group unless only one group is defined.
show ip domain-name on <devname\|groupname\|all> show ip domain-name	Availability: Remote, Serial, Telnet Displays DNS configuration information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show interface errors [<network \| server>] [continuous] [interval <value>] on <devname\|groupname\|all> show interface errors [<network \| server>] [continuous] [interval <value>]	Availability: Remote, Serial, Telnet Displays a listing of interface errors for one or more devices. If an interface is not specified, errors for both interfaces are displayed. If continuous is specified, error statistics are updated every second. Use the interval option to specify an interval for display updates, where value is the interval in seconds. Press any key to stop displaying errors. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show ip name-server on <devname\|groupname\|all> show ip name-server	Availability: Remote, Serial, Telnet Displays DNS configuration information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show profile	Availability: Remote Displays current user preferences setting.
Top Level: Non-Privileged and Privileged Modes (continued)	show route on <devname\|groupname\|all> show route	Availability: Remote, Serial, Telnet Displays the routing table stored in one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show sessions	Availability: Serial, Telnet Displays current remote, serial, and telnet management connections to the device.
show ssl key [<keyname>] on <devname\|groupname\|all> show ssl key [<keyname>]	Availability: Remote, Serial, Telnet Displays summary data for the specified public/private key pair loaded on one or more devices, where keyname is the name of the key. If you do not specify a key name, all key information is displayed. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
terminal length	Availability: Remote, Serial, Telnet Sets the number of lines in a terminal window.
terminal width <width>	Availability: Remote, Serial, Telnet Sets the width of the terminal window.
Top Level: Privileged Mode	clear interface statistics on <devname\|groupname\|all> clear interface statistics	Availability: Remote, Serial, Telnet Resets all interface statistics for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
clear ip routes on <devname\|groupname\|all> clear ip routes	Availability: Remote, Serial, Telnet Clears the IP routing table on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
clear ip statistics on <devname\|groupname\|all> clear ip statistics	Availability: Remote, Serial, Telnet Resets all IP statistics on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
Top Level: Privileged Mode (continued)	copy running-configuration [<filename>] on <devname> copy running-configuration [<filename>]	Availability: Remote Writes the running-configuration of a device. If you do not specify a file name, you are prompted for it. When using remote configuration, use the on form of the command to specify the target of the command, where devname is the device name.
copy running-configuration <url>	Availability: Serial, Telnet Writes the running-configuration of a device to a file, where url is the name of the file.
copy running-configuration startup-configuration	Availability: Serial, Telnet Writes the running-configuration of a device to its startup-configuration.
copy startup-configuration <url>	Availability: Serial, Telnet Writes the startup-configuration of a device to a file, where url is the name of the file.
copy startup-configuration running-configuration	Availability: Serial, Telnet Writes the startup-configuration of a device to its running-configuration.
copy to flash <url>	Availability: Serial, Telnet Uploads a Cisco Secure Content Accelerator image file to the device flash, where url is the name of the file.
copy to flash [<filename>] on <devname\|groupname\|all> copy to flash [<filename>]	Availability: Remote Uploads a Cisco Secure Content Accelerator image file to the device flash. If you do not specify a file name, you are prompted for it. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
copy to running-configuration [<filename>] on <devname> copy to running-configuration [<filename>]	Availability: Remote Uploads a saved configuration file to the device flash. If you do not specify a file name, you are prompted for it. When using remote configuration, use the on form of the command to specify the target of the command, where devname is the device name.
copy to running-configuration <url>	Availability: Serial, Telnet Uploads a saved configuration file and merges it to the running-configuration of a device, where url is the file name.
Top Level: Privileged Mode (continued)	copy to startup-configuration <url>	Availability: Serial, Telnet Uploads a saved configuration file and merges it to the startup-configuration of a device, where url is the file name.
disable on <devname\|groupname\|all> disable	Availability: Remote, Serial, Telnet Exits Privileged mode for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
erase running-configuration on <devname\|groupname\|all> erase running-configuration	Availability: Remote, Serial, Telnet Erases the running-configuration on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
erase startup-configuration on <devname\|groupname\|all> erase startup-configuration	Availability: Remote, Serial, Telnet Erases the startup-configuration on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices
show startup-configuration	Availability: Serial, Telnet Displays the startup-configuration of a device.
write memory	Availability: Serial, Telnet Writes the running-configuration to flash memory on a device.
write network <url>	Availability: Serial, Telnet Writes the running-configuration to a file on a remote host, where url is the name of the file.
Group Configuration Mode	device <devname> no device <devname>	Availability: Remote Adds the specified device to the group list, where devname is the name of the device.
end	Availability: Remote Leaves Group Configuration Mode.
exit	Availability: Remote Leaves Group Configuration Mode.
help [<command>]	Availability: Remote Displays information for a specific command, where command is the name of the command. If no command is specified, help information is displayed for all Group Configuration commands.
Group Configuration Mode (continued)	info	Availability: Remote Displays current information about the device group being created or edited.
Configuration Mode	exit	Availability: Remote, Serial, Telnet Leaves Configuration Mode and returns to Privileged Mode.
ip domain-name <name>	Availability: Remote, Serial, Telnet Sets the default domain name for the device, where name is the domain name.
ip name-server <ipaddr>	Availability: Remote, Serial, Telnet Sets the one or more name servers to use with the device, where ipaddr is the IP address of the Domain Name Server.
mode one-port no mode one-port	Availability: Serial Enables secure and non-secure traffic to pass through the single "Network" Ethernet port. Use the no form of the command to return the device to dual-port mode.
mode pass-thru no mode pass-thru	Availability: Remote, Serial, Telnet Enables pass through of non-SSL traffic. Pass through is the default. Use the no form of the command to block non-SSL traffic pass through.
rdate-server <ipaddr> no rdate-server	Availability: Remote, Serial, Telnet Specifies and RDATE-protocol server to be used for date and time information on the device, where ipaddr is the IP address of the RDATE server.
remote-management shared-secret <passphrase> no remote-management shared-secret	Availability: Serial Sets the secret passphrase used for encryption, where passphrase is the passphrase. Use the no form of the command to clear the passphrase.
telnet access-list <id> no telnet access-list <id>	Availability: Remote, Serial, Telnet Assigns an existing access list to be used with telnet management requests, where id is the access list identifier. Use the no form of the command to remove the specified access list.
telnet enable no telnet enable	Availability: Remote, Serial, Telnet Allows telnet management sessions for the device. Use the no form of the command to disable telnet management access
timezone <zone>	Availability: Serial, Telnet Specifies the time zone of the device's location, where zone is the time zone identifier.
Configuration Mode (continued)	web-mgmt access-list <id> no web-mgmt access-list <id>	Availability: Remote, Serial, Telnet Assigns an existing access list to be used with web browser-based management requests, where id is the access list identifier. Use the no form of the command to remove the specified access list.
web-mgmt enable no web-mgmt enable	Availability: Remote, Serial, Telnet Allows web browser-based management sessions for the device. Use the no form of the command to disable web browser-based management access.
SSL Configuration Mode	import pkcs12 <name> [<filename>]\|<url>	Availability: Remote, Serial, Telnet Imports and processes a pkcs12-format file to create certificate and key objects, where name is the user-defined name for the certificate and key objects, filename is the path and name of the file, and url is the location of the file (serial and telnet only).
import pkcs7 <name> <der\|pem> [prefix <prefixText>] [<filename>]\|<url>	Availability: Remote, Serial, Telnet Imports and processes a pkcs7-format file to create a certificate object, where name is the user-defined name of the certificate group object, prefixText is the prefix assigned to the certificate names in the chain, filename is the path and name of the file, and url is the location of the file (serial and telnet only). You must specify whether the file is encoded in DER or PEM format and identify a prefix, if any.
key <keyname> [create] no key <keyname>	Availability: Remote, Serial, Telnet Creates and/or configures the specified key object, where keyname is the name of the key and enters Key Configuration mode for the specified key. The create flag is used to create a new key. The no flag is used to remove a key. You may not delete a key referenced by a server. You can have up to 255 key objects.
Certificate Configuration Mode	binhex [<value>]	Availability: Remote, Serial, Telnet Allows a binary hex-encoded X509 certificate to be pasted into the configuration manager. After the command is entered, you are prompted to paste the key from the cut buffer. You can use a text editor to copy the key from a file. After the key is pasted, you must press Enter twice to complete the command.
exit	Availability: Remote, Serial, Telnet Exits Certificate Configuration mode, activates all valid changes, and returns to SSL Configuration mode.
Certificate Group Configuration Mode	exit	Availability: Remote, Serial, Telnet Exits Certificate Group Configuration mode, activates all changes, and returns to SSL Configuration mode.
Key Configuration Mode	binhex [<value>]	Availability: Remote, Serial, Telnet Allows a binary hex-encoded key to be pasted into the configuration manager. After the command is entered, you are prompted to paste the key from the cut buffer. You can use a text editor to copy the key from a file. After the key is pasted, you must press Enter twice to complete the command.
Security Policy Configuration Mode	exit	Availability: Remote, Serial, Telnet Exits Security Policy Configuration mode, activates all changes, and returns to SSL Configuration mode.
Server Configuration Command Set	cert <certname \| default \| default-1024 \| default 512>	Availability: Remote, Serial, Telnet Sets the specified certificate for use by the server. Only one certificate is allowed per server. If you enter this command with a different certificate, that reference replaces the earlier one.
exit	Availability: Remote, Serial, Telnet Exits Server Configuration mode, activates all changes, and returns to SSL Configuration mode.
key <keyname \| default \| default-1024 \| default 512>	Availability: Remote, Serial, Telnet Sets the specified key for use by the server. Only one key is allowed per server. If you enter this command with a different key, that reference replaces the earlier one.
log-url <ipaddr>	Availability: Remote, Serial, Telnet Specifies a host for logging of URL requests, where ipaddr is the IP address of the host.

Mode

Command and Syntax

Description

Top Level: Non-Privileged and Privileged Modes

enable
no enable

on <devname|groupname|all> enable
on <devname|groupname|all> no enable

Availability: Remote, Serial, Telnet

If an enable-level password has been defined, you must enter it when prompted. When using remote management, enters Privileged mode for a single, attached device. If more than one device is valid for this command, use the on form of the command to specify the device(s) to enable, where devname is the name of an individual device, groupname is the name of a user-defined group, and all represents all appropriate devices. Using the no form of this command leaves Privileged mode.

group <groupname> [create]
no group <groupname>

Availability: Remote

Use the create flag to create the specified group and enter Group Configuration mode for it, where groupname is the name of the device group. Use the no form of the command to remove the specified group.

paws

Availability: Remote, Serial, Telnet

Pauses the configuration manager for a specified time or until a key is pressed.

set on-prefix <devname|groupname>
no set on-prefix

Availability: Remote

Sets the target device(s) to address as default when using the on prefix, where devname is the name of a single device and groupname is the name of a user-defined device group. Use the no form of the command to clear the default entity.

show cpu [continuous] [interval <value>]

on <devname|groupname|all> show cpu [continuous] [interval <value>]

Availability: Remote, Serial, Telnet

Displays CPU utilization information for one or more devices. Use the continuous option to display statistics continuously, updated every second. Use the interval option to specify an interval for display updates, where value is the interval in seconds. Press any key to stop displaying statistics. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show date

Availability: Serial, Telnet

Displays current date and time settings on the device.

Top Level: Non-Privileged and Privileged Modes

(continued)

show device list

Availability: Remote

Displays summary information for all Secure Content Accelerators in the same broadcast domain as the configuring computer or found by the configuration manager through the discover or discover port commands.

show dns

on <devname|groupname|all> show dns

Availability: Remote, Serial, Telnet

Displays DNS configuration information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show group [<groupname>]

Availability: Remote

Displays group summary information for the specified group, where groupname is the name of the user-defined group. You must specify a group unless only one group is defined.

show ip domain-name

on <devname|groupname|all> show ip domain-name

Availability: Remote, Serial, Telnet

show interface errors [<network | server>] [continuous] [interval <value>]

on <devname|groupname|all> show interface errors [<network | server>] [continuous] [interval <value>]

Availability: Remote, Serial, Telnet

Displays a listing of interface errors for one or more devices. If an interface is not specified, errors for both interfaces are displayed. If continuous is specified, error statistics are updated every second. Use the interval option to specify an interval for display updates, where value is the interval in seconds. Press any key to stop displaying errors. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show ip name-server

on <devname|groupname|all> show ip name-server

Availability: Remote, Serial, Telnet

show profile

Availability: Remote

Displays current user preferences setting.

Top Level: Non-Privileged and Privileged Modes

(continued)

show route

on <devname|groupname|all> show route

Availability: Remote, Serial, Telnet

Displays the routing table stored in one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show sessions

Availability: Serial, Telnet

Displays current remote, serial, and telnet management connections to the device.

show ssl key [<keyname>]

on <devname|groupname|all> show ssl key [<keyname>]

Availability: Remote, Serial, Telnet

Displays summary data for the specified public/private key pair loaded on one or more devices, where keyname is the name of the key. If you do not specify a key name, all key information is displayed. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

terminal length

Availability: Remote, Serial, Telnet

Sets the number of lines in a terminal window.

terminal width <width>

Availability: Remote, Serial, Telnet

Sets the width of the terminal window.

Top Level: Privileged Mode

clear interface statistics

on <devname|groupname|all> clear interface statistics

Availability: Remote, Serial, Telnet

Resets all interface statistics for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

clear ip routes

on <devname|groupname|all> clear ip routes

Availability: Remote, Serial, Telnet

Clears the IP routing table on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

clear ip statistics

on <devname|groupname|all> clear ip statistics

Availability: Remote, Serial, Telnet

Resets all IP statistics on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

Top Level: Privileged Mode

(continued)

copy running-configuration [<filename>]

on <devname> copy running-configuration [<filename>]

Availability: Remote

Writes the running-configuration of a device. If you do not specify a file name, you are prompted for it. When using remote configuration, use the on form of the command to specify the target of the command, where devname is the device name.

copy running-configuration <url>

Availability: Serial, Telnet

Writes the running-configuration of a device to a file, where url is the name of the file.

copy running-configuration startup-configuration

Availability: Serial, Telnet

Writes the running-configuration of a device to its startup-configuration.

copy startup-configuration <url>

Availability: Serial, Telnet

Writes the startup-configuration of a device to a file, where url is the name of the file.

copy startup-configuration running-configuration

Availability: Serial, Telnet

Writes the startup-configuration of a device to its running-configuration.

copy to flash <url>

Availability: Serial, Telnet

Uploads a Cisco Secure Content Accelerator image file to the device flash, where url is the name of the file.

copy to flash [<filename>]

on <devname|groupname|all> copy to flash [<filename>]

Availability: Remote

Uploads a Cisco Secure Content Accelerator image file to the device flash. If you do not specify a file name, you are prompted for it. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

copy to running-configuration [<filename>]

on <devname> copy to running-configuration [<filename>]

Availability: Remote

Uploads a saved configuration file to the device flash. If you do not specify a file name, you are prompted for it. When using remote configuration, use the on form of the command to specify the target of the command, where devname is the device name.

copy to running-configuration <url>

Availability: Serial, Telnet

Uploads a saved configuration file and merges it to the running-configuration of a device, where url is the file name.

Top Level: Privileged Mode

(continued)

copy to startup-configuration <url>

Availability: Serial, Telnet

Uploads a saved configuration file and merges it to the startup-configuration of a device, where url is the file name.

disable

on <devname|groupname|all> disable

Availability: Remote, Serial, Telnet

Exits Privileged mode for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

erase running-configuration

on <devname|groupname|all> erase running-configuration

Availability: Remote, Serial, Telnet

Erases the running-configuration on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

erase startup-configuration

on <devname|groupname|all> erase startup-configuration

Availability: Remote, Serial, Telnet

Erases the startup-configuration on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices

show startup-configuration

Availability: Serial, Telnet

Displays the startup-configuration of a device.

write memory

Availability: Serial, Telnet

Writes the running-configuration to flash memory on a device.

write network <url>

Availability: Serial, Telnet

Writes the running-configuration to a file on a remote host, where url is the name of the file.

Group Configuration Mode

device <devname>
no device <devname>

Availability: Remote

Adds the specified device to the group list, where devname is the name of the device.

end

Availability: Remote

Leaves Group Configuration Mode.

exit

Availability: Remote

Leaves Group Configuration Mode.

help [<command>]

Availability: Remote

Displays information for a specific command, where command is the name of the command. If no command is specified, help information is displayed for all Group Configuration commands.

Group Configuration Mode

(continued)

info

Availability: Remote

Displays current information about the device group being created or edited.

Configuration Mode

exit

Availability: Remote, Serial, Telnet

Leaves Configuration Mode and returns to Privileged Mode.

ip domain-name <name>

Availability: Remote, Serial, Telnet

Sets the default domain name for the device, where name is the domain name.

ip name-server <ipaddr>

Availability: Remote, Serial, Telnet

Sets the one or more name servers to use with the device, where ipaddr is the IP address of the Domain Name Server.

mode one-port
no mode one-port

Availability: Serial

Enables secure and non-secure traffic to pass through the single "Network" Ethernet port. Use the no form of the command to return the device to dual-port mode.

mode pass-thru
no mode pass-thru

Availability: Remote, Serial, Telnet

Enables pass through of non-SSL traffic. Pass through is the default. Use the no form of the command to block non-SSL traffic pass through.

rdate-server <ipaddr>
no rdate-server

Availability: Remote, Serial, Telnet

Specifies and RDATE-protocol server to be used for date and time information on the device, where ipaddr is the IP address of the RDATE server.

remote-management shared-secret <passphrase>
no remote-management shared-secret

Availability: Serial

Sets the secret passphrase used for encryption, where passphrase is the passphrase. Use the no form of the command to clear the passphrase.

telnet access-list <id>
no telnet access-list <id>

Availability: Remote, Serial, Telnet

Assigns an existing access list to be used with telnet management requests, where id is the access list identifier. Use the no form of the command to remove the specified access list.

telnet enable
no telnet enable

Availability: Remote, Serial, Telnet

Allows telnet management sessions for the device. Use the no form of the command to disable telnet management access

timezone <zone>

Availability: Serial, Telnet

Specifies the time zone of the device's location, where zone is the time zone identifier.

Configuration Mode

(continued)

web-mgmt access-list <id>
no web-mgmt access-list <id>

Availability: Remote, Serial, Telnet

Assigns an existing access list to be used with web browser-based management requests, where id is the access list identifier. Use the no form of the command to remove the specified access list.

web-mgmt enable
no web-mgmt enable

Availability: Remote, Serial, Telnet

Allows web browser-based management sessions for the device. Use the no form of the command to disable web browser-based management access.

SSL Configuration Mode

import pkcs12 <name> [<filename>]|<url>

Availability: Remote, Serial, Telnet

Imports and processes a pkcs12-format file to create certificate and key objects, where name is the user-defined name for the certificate and key objects, filename is the path and name of the file, and url is the location of the file (serial and telnet only).

import pkcs7 <name> <der|pem> [prefix <prefixText>] [<filename>]|<url>

Availability: Remote, Serial, Telnet

Imports and processes a pkcs7-format file to create a certificate object, where name is the user-defined name of the certificate group object, prefixText is the prefix assigned to the certificate names in the chain, filename is the path and name of the file, and url is the location of the file (serial and telnet only). You must specify whether the file is encoded in DER or PEM format and identify a prefix, if any.

key <keyname> [create]
no key <keyname>

Availability: Remote, Serial, Telnet

Creates and/or configures the specified key object, where keyname is the name of the key and enters Key Configuration mode for the specified key. The create flag is used to create a new key. The no flag is used to remove a key. You may not delete a key referenced by a server. You can have up to 255 key objects.

Certificate Configuration Mode

binhex [<value>]

Availability: Remote, Serial, Telnet

Allows a binary hex-encoded X509 certificate to be pasted into the configuration manager. After the command is entered, you are prompted to paste the key from the cut buffer. You can use a text editor to copy the key from a file. After the key is pasted, you must press Enter twice to complete the command.

exit

Availability: Remote, Serial, Telnet

Exits Certificate Configuration mode, activates all valid changes, and returns to SSL Configuration mode.

Certificate Group Configuration Mode

exit

Availability: Remote, Serial, Telnet

Exits Certificate Group Configuration mode, activates all changes, and returns to SSL Configuration mode.

Key Configuration Mode

binhex [<value>]

Availability: Remote, Serial, Telnet

Allows a binary hex-encoded key to be pasted into the configuration manager. After the command is entered, you are prompted to paste the key from the cut buffer. You can use a text editor to copy the key from a file. After the key is pasted, you must press Enter twice to complete the command.

Security Policy Configuration Mode

exit

Availability: Remote, Serial, Telnet

Exits Security Policy Configuration mode, activates all changes, and returns to SSL Configuration mode.

Server Configuration Command Set

cert <certname | default | default-1024 | default 512>

Availability: Remote, Serial, Telnet

Sets the specified certificate for use by the server. Only one certificate is allowed per server. If you enter this command with a different certificate, that reference replaces the earlier one.

exit

Availability: Remote, Serial, Telnet

Exits Server Configuration mode, activates all changes, and returns to SSL Configuration mode.

key <keyname | default | default-1024 | default 512>

Availability: Remote, Serial, Telnet

Sets the specified key for use by the server. Only one key is allowed per server. If you enter this command with a different key, that reference replaces the earlier one.

log-url <ipaddr>

Availability: Remote, Serial, Telnet

Specifies a host for logging of URL requests, where ipaddr is the IP address of the host.

Table 4: CLI Commands Changed in 3.0.5

Mode	Command and Syntax	Description
Top Level: Non-Privileged and Privileged Modes	attach no attach on <devname\|groupname\|all> attach on <devname\|groupname\|all> no attach	Availability: Remote Instructs the configuration manager to attach to one or more devices. Use the no form of the command to detach the configuration manager from one or more devices. If an access-level password has been defined, you must enter it when prompted before the configuration manager will attach to the device(s). If a shared secret passphrase has been assigned as part of remote management encryption, you are prompted for it. If more than one device is valid for this command, use the on form of the command to specify the device(s) to attach to or detach from (using the no form of the command), where devname is the name of an individual device, groupname is the name of a user-defined group, and all represents all appropriate devices.
discover [port <portid>]	Availability: Remote Checks the network for new remote devices. Use the port option to specify a TCP service port to search for devices when using an alternate remote management port, where portid is the port number.
exit	Availability: Remote, Serial, Telnet Quits the configuration manager. When executed from the remote configuration manager, closes the configuration manager. When executed from a serial connection, does not close the connection. If an access password has been configured, you are prompted for it. When executed from telnet, closes the telnet connection.
quit	Availability: Remote, Serial, Telnet Quits the configuration manager. When executed from the remote configuration manager, closes the configuration manager. When executed from a serial connection, does not close the connection. If an access password has been configured, you are prompted for it. When executed from telnet, closes the telnet connection.
show arp on <devname\|groupname\|all> show arp	Availability: Remote, Serial, Telnet Displays the arp device cache on a single device. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show device on <devname\|groupname\|all> show device	Availability: Remote, Serial, Telnet Displays device information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
Top Level: Non-Privileged and Privileged Modes (continued)	show interface [network \| server] on <devname\|groupname\|all> show interface [network \| server]	Availability: Remote, Serial, Telnet Displays information for the specified Ethernet interface for one or more devices. The information includes connection, duplex, speed, and autonegotiation settings. You must specify a device name unless only one Secure Content Accelerator is attached. If you do not specify network or server, information for all interfaces on the specified device is displayed. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show interface statistics [<network \| server>] [continuous] [interval <value>] on <devname\|groupname\|all> show interface statistics [<network \| server>] [continuous] [interval <value>]	Availability: Remote, Serial, Telnet Displays interface statistics for one or more devices. If an interface is not specified, statistics for both interfaces are displayed. If continuous is specified, statistics are updated every second. Use the interval option to specify an interval for display updates, where value is the interval in seconds. Press any key to stop displaying statistics. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show ip routes on <devname\|groupname\|all> show ip routes	Availability: Remote, Serial, Telnet Displays the routing table for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show ip statistics on <devname\|groupname\|all> show ip statistics	Availability: Remote, Serial, Telnet Displays diagnostic IP, ICMP, TCP, and UDP statistics for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show keepalive-monitor on <devname\|groupname\|all> show keepalive-monitor	Availability: Remote, Serial, Telnet Displays a list of keepalive-monitor IP addresses for one or more devices. SSL errors from IP addresses specified with the keepalive-monitor command are ignored. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
Top Level: Non-Privileged and Privileged Modes (continued)	show memory [zones] on <devname\|groupname\|all> show memory [zones]	Availability: Remote, Serial, Telnet Displays memory usage on one or more devices. The zones flag is used to display information for each memory zone. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show messages on <devname\|groupname\|all> show messages	Availability: Remote, Serial, Telnet Displays the diagnostic message buffer for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show netstat on <devname\|groupname\|all> show netstat	Availability: Remote, Serial, Telnet Displays the current state of the IP connection for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show processes on <devname\|groupname\|all> show processes	Availability: Remote, Serial, Telnet Displays information, by thread, about processes running on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show remote-management on <devname\|groupname\|all> show remote-management	Availability: Remote, Serial, Telnet Displays remote management information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show rip on <devname\|groupname\|all> show rip	Availability: Remote, Serial, Telnet Displays the RIP status of one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
Top Level: Non-Privileged and Privileged Modes (continued)	show snmp on <devname\|groupname\|all> show snmp	Availability: Remote, Serial, Telnet Displays SNMP configuration information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show ssl on <devname\|groupname\|all> show ssl	Availability: Remote, Serial, Telnet Displays SSL summary data for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show ssl cert [<certname>] on <devname\|groupname\|all> show ssl cert [<certname>]	Availability: Remote, Serial, Telnet Displays summary data for the specified certificate entity loaded on one or more devices, where certname is the name of the certificate. If you do not specify a certificate entity name, all certificate entity information is displayed. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show ssl certgroup [<certgroupname>] on <devname\|groupname\|all> show ssl certgroup [<certgroupname>]	Availability: Remote, Serial, Telnet Displays summary data for a certificate group loaded on one or more devices, where certgroupname is the name of the certificate group. If you do not specify a certificate group, all certificate group information is displayed. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show ssl errors [continuous] [interval <value>] on <devname\|groupname\|all> show ssl errors [continuous] [interval <value>]	Availability: Remote, Serial, Telnet Displays SSL errors reported on one or more devices. Use the continuous option to update the statistics every second. Use the interval option to specify an interval for display updates, where value is the interval in seconds. Press any key to stop displaying errors. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
Top Level: Non-Privileged and Privileged Modes (continued)	show ssl secpolicy [<polname>] on <devname\|groupname\|all> show ssl secpolicy [<polname>]	Availability: Remote, Serial, Telnet Displays summary data for the specified security policy on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show ssl server [<servname>] on <devname\|groupname\|all> show ssl server [<servname>]	Availability: Remote, Serial, Telnet Displays information for the specified configured logical secure server on one or more devices, where servname is the name of the logical secure server. If you do not specify a secure server name, all secure server information is displayed. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show ssl statistics [continuous] [interval <value>] on <devname\|groupname\|all> show ssl statistics [continuous] [interval <value>]	Availability: Remote, Serial, Telnet Displays SSL statistics summed over all secure logical servers on one or more devices. Use the continuous option to update the statistics every second. Use the interval option to specify an interval for display updates. Press any key to stop displaying information. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show syslog on <devname\|groupname\|all> show syslog	Availability: Remote, Serial, Telnet Displays the list of hosts to which diagnostic messages from one or more devices are sent. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show system-resources [continuous] [interval <value>] on <devname\|groupname\|all> show system-resources [continuous] [interval <value>]	Availability: Remote, Serial, Telnet Displays system memory and CPU usage for one or more devices. Use the continuous option to update the information every second. Use the interval option to specify an interval for display updates, where value is the interval in seconds. Press any key to stop displaying information. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
Top Level: Non-Privileged and Privileged Mode (continued)	traceroute <ipaddr\|name>	Availability: Remote, Serial, Telnet Displays the router hops to the specified destination, where ipaddr is the IP address of the destination and name is the host name (serial/telnet only).
Top Level: Privileged Mode	clear messages on <devname\|groupname\|all> clear messages	Availability: Remote, Serial, Telnet Empties the diagnostic message buffer on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
clear ssl statistics on <devname\|groupname\|all> clear ssl statistics	Availability: Remote, Serial, Telnet Resets all SSL statistics for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
quick-start on <devname> quick-start	Availability: Remote, Serial, Telnet Runs the QuickStart wizard for a device. You must specify a device unless only one device is appropriate. When using remote configuration, use the on form of the command to specify the target of the command, where devname is the name of a single device.
reload on <devname\|groupname\|all> reload	Availability: Remote, Serial, Telnet Reboots one or more devices. You must specify a device unless only one device is appropriate. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
show access-list [<listid>] on <devname\|groupname\|all> show access-list [<listid>]	Availability: Remote, Serial, Telnet Displays the specified access list for one or more devices, where listid is the access list identifier. If you do not specify an access list identifier, information for all access lists is displayed. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
Top Level: Privileged Mode (continued)	show running-configuration on <devname\|groupname\|all> show running-configuration	Availability: Remote, Serial, Telnet Displays the running-configuration on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
write file [<filename>] on <devname> write file [<filename>]	Availability: Remote Writes the running-configuration of a device to a file on the file system of the configuring computer, where filename is the name and path of the file. When using remote configuration, use the on form of the command to specify the target of the command, where devname is the name of a single device.
write flash on <devname\|groupname\|all> write flash	Availability: Remote, Serial, Telnet Writes the running-configuration to flash memory on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
write messages [<filename>] on <devname> write messages [<filename>]	Availability: Remote Writes the diagnostic messages of a device to a file, where filename is the name and path of the file. If you do not supply a file name, you are prompted for it. When using remote configuration, use the on form of the command to specify the target of the command, where devname is the name of a single device.
write terminal on <devname\|groupname\|all> write terminal	Availability: Remote, Serial, Telnet Displays the running-configuration of one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.
Configuration Mode	password <access\|enable> no password <access\|enable>	Availability: Remote, Serial, Telnet Sets the access- or enable-level password for the current Secure Content Accelerator. You are prompted to enter the password. Use the no form of the command to clear the access- or enable-level password for the current device.
Certificate Configuration Mode	der [<cert-filename>]\|<url>	Availability: Remote, Serial, Telnet Loads a DER-encoded X509 certificate into the certificate entity, where cert-filename is the name of the file and url is the location of the file (serial and telnet only). If you do not enter the file name, you are prompted for it. You must enter the path if the file is not located in the current directory.
pem [<cert-filename>]\|<url>	Availability: Remote, Serial, Telnet Loads a PEM-encoded certificate into the certificate entity, where cert-filename is the name of the key file and url is the location of the file (serial and telnet only). If you do not enter the file name, you are prompted for it. You must enter the path if the file is not located in the current directory.
Key Configuration Mode (was Key Association Configuration Mode)	der [<key-filename>]\|<url>	Availability: Remote, Serial, Telnet Loads a DER-encoded X509 private key into the key entity, where key-filename is the name of the file and url is the location of the file (serial and telnet only). If you do not enter the file name, you are prompted for it. You must enter the path if the file is not located in the current directory.
exit	Availability: Remote, Serial, Telnet Exits Key Configuration mode, activates all changes, and returns to SSL Configuration mode.
net-iis [<key-filename>]\|<url>	Availability: Remote, Serial, Telnet Loads a private key exported from IIS4 into the key entity, where key-filename is the name of the key file and url is the location of the file (serial and telnet only). You must enter a private key password. If you do not enter the file name, you are prompted for it. You must enter the path if the file is not located in the current directory.
pem [<key-filename>]\|<url>	Availability: Remote, Serial, Telnet Loads a PEM-encoded X509 private key into the key object, where key-filename is the path and name of the file and url is the location of the file (serial and telnet only). If you do not enter the file names, you are prompted for them. Key names cannot contain spaces and must be compatible with the configuring computer's operating system. You must enter the path if the file is not located in the current directory.
Server Configuration Mode	sslport <port\|default>	Availability: Remote, Serial, Telnet Specifies the TCP service port to which non-secure connections is sent, where port is the port number. Use the default argument to return to the default setting of 443.

Mode

Command and Syntax

Description

Top Level: Non-Privileged and Privileged Modes

attach
no attach

on <devname|groupname|all> attach
on <devname|groupname|all> no attach

Availability: Remote

Instructs the configuration manager to attach to one or more devices. Use the no form of the command to detach the configuration manager from one or more devices. If an access-level password has been defined, you must enter it when prompted before the configuration manager will attach to the device(s). If a shared secret passphrase has been assigned as part of remote management encryption, you are prompted for it. If more than one device is valid for this command, use the on form of the command to specify the device(s) to attach to or detach from (using the no form of the command), where devname is the name of an individual device, groupname is the name of a user-defined group, and all represents all appropriate devices.

discover [port <portid>]

Availability: Remote

Checks the network for new remote devices. Use the port option to specify a TCP service port to search for devices when using an alternate remote management port, where portid is the port number.

exit

Availability: Remote, Serial, Telnet

Quits the configuration manager. When executed from the remote configuration manager, closes the configuration manager. When executed from a serial connection, does not close the connection. If an access password has been configured, you are prompted for it. When executed from telnet, closes the telnet connection.

quit

Availability: Remote, Serial, Telnet

show arp
on <devname|groupname|all> show arp

Availability: Remote, Serial, Telnet

Displays the arp device cache on a single device. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show device
on <devname|groupname|all> show device

Availability: Remote, Serial, Telnet

Displays device information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

Top Level: Non-Privileged and Privileged Modes

(continued)

show interface [network | server]

on <devname|groupname|all> show interface [network | server]

Availability: Remote, Serial, Telnet

Displays information for the specified Ethernet interface for one or more devices. The information includes connection, duplex, speed, and autonegotiation settings. You must specify a device name unless only one Secure Content Accelerator is attached. If you do not specify network or server, information for all interfaces on the specified device is displayed. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show interface statistics [<network | server>] [continuous] [interval <value>]

on <devname|groupname|all> show interface statistics [<network | server>] [continuous] [interval <value>]

Availability: Remote, Serial, Telnet

Displays interface statistics for one or more devices. If an interface is not specified, statistics for both interfaces are displayed. If continuous is specified, statistics are updated every second. Use the interval option to specify an interval for display updates, where value is the interval in seconds. Press any key to stop displaying statistics. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show ip routes

on <devname|groupname|all> show ip routes

Availability: Remote, Serial, Telnet

Displays the routing table for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show ip statistics

on <devname|groupname|all> show ip statistics

Availability: Remote, Serial, Telnet

Displays diagnostic IP, ICMP, TCP, and UDP statistics for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show keepalive-monitor

on <devname|groupname|all> show keepalive-monitor

Availability: Remote, Serial, Telnet

Displays a list of keepalive-monitor IP addresses for one or more devices. SSL errors from IP addresses specified with the keepalive-monitor command are ignored. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

Top Level: Non-Privileged and Privileged Modes

(continued)

show memory [zones]

on <devname|groupname|all> show memory [zones]

Availability: Remote, Serial, Telnet

Displays memory usage on one or more devices. The zones flag is used to display information for each memory zone. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show messages

on <devname|groupname|all> show messages

Availability: Remote, Serial, Telnet

Displays the diagnostic message buffer for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show netstat

on <devname|groupname|all> show netstat

Availability: Remote, Serial, Telnet

Displays the current state of the IP connection for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show processes

on <devname|groupname|all> show processes

Availability: Remote, Serial, Telnet

Displays information, by thread, about processes running on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show remote-management

on <devname|groupname|all> show remote-management

Availability: Remote, Serial, Telnet

Displays remote management information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show rip

on <devname|groupname|all> show rip

Availability: Remote, Serial, Telnet

Displays the RIP status of one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

Top Level: Non-Privileged and Privileged Modes

(continued)

show snmp

on <devname|groupname|all> show snmp

Availability: Remote, Serial, Telnet

Displays SNMP configuration information for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show ssl

on <devname|groupname|all> show ssl

Availability: Remote, Serial, Telnet

Displays SSL summary data for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show ssl cert [<certname>]

on <devname|groupname|all> show ssl cert [<certname>]

Availability: Remote, Serial, Telnet

Displays summary data for the specified certificate entity loaded on one or more devices, where certname is the name of the certificate. If you do not specify a certificate entity name, all certificate entity information is displayed. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show ssl certgroup [<certgroupname>]

on <devname|groupname|all> show ssl certgroup [<certgroupname>]

Availability: Remote, Serial, Telnet

Displays summary data for a certificate group loaded on one or more devices, where certgroupname is the name of the certificate group. If you do not specify a certificate group, all certificate group information is displayed. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show ssl errors [continuous] [interval <value>]

on <devname|groupname|all> show ssl errors [continuous] [interval <value>]

Availability: Remote, Serial, Telnet

Displays SSL errors reported on one or more devices. Use the continuous option to update the statistics every second. Use the interval option to specify an interval for display updates, where value is the interval in seconds. Press any key to stop displaying errors. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

Top Level: Non-Privileged and Privileged Modes

(continued)

show ssl secpolicy [<polname>]

on <devname|groupname|all> show ssl secpolicy [<polname>]

Availability: Remote, Serial, Telnet

Displays summary data for the specified security policy on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show ssl server [<servname>]
on <devname|groupname|all> show ssl server [<servname>]

Availability: Remote, Serial, Telnet

Displays information for the specified configured logical secure server on one or more devices, where servname is the name of the logical secure server. If you do not specify a secure server name, all secure server information is displayed. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show ssl statistics [continuous] [interval <value>]

on <devname|groupname|all> show ssl statistics [continuous] [interval <value>]

Availability: Remote, Serial, Telnet

Displays SSL statistics summed over all secure logical servers on one or more devices. Use the continuous option to update the statistics every second. Use the interval option to specify an interval for display updates. Press any key to stop displaying information. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show syslog

on <devname|groupname|all> show syslog

Availability: Remote, Serial, Telnet

Displays the list of hosts to which diagnostic messages from one or more devices are sent. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show system-resources [continuous] [interval <value>]

on <devname|groupname|all> show system-resources [continuous] [interval <value>]

Availability: Remote, Serial, Telnet

Displays system memory and CPU usage for one or more devices. Use the continuous option to update the information every second. Use the interval option to specify an interval for display updates, where value is the interval in seconds. Press any key to stop displaying information. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

Top Level: Non-Privileged and Privileged Mode

(continued)

traceroute <ipaddr|name>

Availability: Remote, Serial, Telnet

Displays the router hops to the specified destination, where ipaddr is the IP address of the destination and name is the host name (serial/telnet only).

Top Level: Privileged Mode

clear messages

on <devname|groupname|all> clear messages

Availability: Remote, Serial, Telnet

Empties the diagnostic message buffer on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

clear ssl statistics

on <devname|groupname|all> clear ssl statistics

Availability: Remote, Serial, Telnet

Resets all SSL statistics for one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

quick-start

on <devname> quick-start

Availability: Remote, Serial, Telnet

Runs the QuickStart wizard for a device. You must specify a device unless only one device is appropriate. When using remote configuration, use the on form of the command to specify the target of the command, where devname is the name of a single device.

reload

on <devname|groupname|all> reload

Availability: Remote, Serial, Telnet

Reboots one or more devices. You must specify a device unless only one device is appropriate. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

show access-list [<listid>]

on <devname|groupname|all> show access-list [<listid>]

Availability: Remote, Serial, Telnet

Displays the specified access list for one or more devices, where listid is the access list identifier. If you do not specify an access list identifier, information for all access lists is displayed. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

Top Level: Privileged Mode

(continued)

show running-configuration

on <devname|groupname|all> show running-configuration

Availability: Remote, Serial, Telnet

Displays the running-configuration on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

write file [<filename>]

on <devname> write file [<filename>]

Availability: Remote

Writes the running-configuration of a device to a file on the file system of the configuring computer, where filename is the name and path of the file. When using remote configuration, use the on form of the command to specify the target of the command, where devname is the name of a single device.

write flash

on <devname|groupname|all> write flash

Availability: Remote, Serial, Telnet

Writes the running-configuration to flash memory on one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

write messages [<filename>]

on <devname> write messages [<filename>]

Availability: Remote

Writes the diagnostic messages of a device to a file, where filename is the name and path of the file. If you do not supply a file name, you are prompted for it. When using remote configuration, use the on form of the command to specify the target of the command, where devname is the name of a single device.

write terminal

on <devname|groupname|all> write terminal

Availability: Remote, Serial, Telnet

Displays the running-configuration of one or more devices. When using remote configuration, use the on form of the command to specify the target(s) of the command, where devname is the name of a single device, groupname is the name of a user-defined device group, and all represents all appropriate devices.

Configuration Mode

password <access|enable>
no password <access|enable>

Availability: Remote, Serial, Telnet

Sets the access- or enable-level password for the current Secure Content Accelerator. You are prompted to enter the password. Use the no form of the command to clear the access- or enable-level password for the current device.

Certificate Configuration Mode

der [<cert-filename>]|<url>

Availability: Remote, Serial, Telnet

Loads a DER-encoded X509 certificate into the certificate entity, where cert-filename is the name of the file and url is the location of the file (serial and telnet only). If you do not enter the file name, you are prompted for it. You must enter the path if the file is not located in the current directory.

pem [<cert-filename>]|<url>

Availability: Remote, Serial, Telnet

Loads a PEM-encoded certificate into the certificate entity, where cert-filename is the name of the key file and url is the location of the file (serial and telnet only). If you do not enter the file name, you are prompted for it. You must enter the path if the file is not located in the current directory.

Key Configuration Mode

(was Key Association Configuration Mode)

der [<key-filename>]|<url>

Availability: Remote, Serial, Telnet

Loads a DER-encoded X509 private key into the key entity, where key-filename is the name of the file and url is the location of the file (serial and telnet only). If you do not enter the file name, you are prompted for it. You must enter the path if the file is not located in the current directory.

exit

Availability: Remote, Serial, Telnet

Exits Key Configuration mode, activates all changes, and returns to SSL Configuration mode.

net-iis [<key-filename>]|<url>

Availability: Remote, Serial, Telnet

Loads a private key exported from IIS4 into the key entity, where key-filename is the name of the key file and url is the location of the file (serial and telnet only). You must enter a private key password. If you do not enter the file name, you are prompted for it. You must enter the path if the file is not located in the current directory.

pem [<key-filename>]|<url>

Availability: Remote, Serial, Telnet

Loads a PEM-encoded X509 private key into the key object, where key-filename is the path and name of the file and url is the location of the file (serial and telnet only). If you do not enter the file names, you are prompted for them. Key names cannot contain spaces and must be compatible with the configuring computer's operating system. You must enter the path if the file is not located in the current directory.

Server Configuration Mode

sslport <port|default>

Availability: Remote, Serial, Telnet

Specifies the TCP service port to which non-secure connections is sent, where port is the port number. Use the default argument to return to the default setting of 443.

Table 5: CLI Commands Deprecated in 3.0.5

Mode	Command and Syntax	Description
Top Level	attach all no attach all	Instructs the configuration manager to attach all non-attached remote devices on the network. Use the no form of the command to detach the configuration manager from all remote devices on the network.
	copy file configuration [devname]	Loads a saved configuration for use as the active configuration for the device.
	copy file flash [devname]	Updates a flash image on the specified device based upon the specified flash image file.
	copy file flash all	Updates all flash images on all attached devices.
	erase flash [devname]	Erases the configuration stored in the flash memory of the specified device.
	erase flash all	Erases the configuration stored in the flash memory on all attached devices.
	erase memory [devname]	Erases the configuration running on the specified device but does not erase the configuration stored in the flash memory.
	reload all	Reboots all attached configuration-level devices.
	show access-lists [devname]	Displays all defined access lists for a specified device.
	show configuration [devname]	Displays the active configuration for the specified device.
	show devices	Displays a list of all Secure Content Accelerator devices.
	show routes [devname]	Displays the routing table stored in the device, where devname is the name of the device.
	show ssl errors all [continuous]	Displays SSL errors for all attached Secure Content Accelerator devices.
	show ssl keyassoc [keyname]	Displays summary data for the specified public/private key pair loaded on the device.
	show ssl statistics all [continuous]	Displays SSL statistics summed over all secure logical servers on all attached Secure Content Accelerator devices.
	su [devname] no su [devname]	Raises the security level on the specified attach-level device. Using the no form of the command lowers the security level on the specified config-level device.
	su all no su all	Raises the security level on all attach-level devices. Using the no form of the command lowers the security level on all config-level devices.
	write flash all	Writes the active configuration to flash memory on all attached devices.
SSL Configuration Mode	keyassoc <keyname> [create] no keyassoc <keyname>	Creates and/or configures the specified key association and enters Key Association Configuration mode for the specified key association. The no form of the command is used to remove a key association.
	mode one-port	Prompts the administrator to use the serial console to switch operation of the Secure Content Accelerator to use a single Ethernet port for both secure SSL traffic and non-secure clear or plain text traffic.
	mode pass-thru no mode pass-thru	Enables pass-through of non-SSL traffic. This is the default behavior. Use the no form of the command to disable pass-through.
Key Association Configuration Mode	cert <der\|pem> [<cert-filename>]	Loads a X509 certificate file in the specified file format.
	cert pem-paste	Allows a PEM-encoded X509 certificate to be pasted into the configuration manager.
	key <der \| netiis \| pem> [<key-filename>]	Loads a key file in the specified file format.
	key pem-paste	Allows a PEM-encoded key to be pasted into the configuration manager.
Server Configuration Mode	keyassoc <keyassocname>	Creates an association between this logical secure server and the specified key association.

AccessPath, AtmDirector, Browse with Me, CCIP, CCSI, CD-PAC, CiscoLink, the Cisco Powered Network logo, Cisco Systems Networking Academy, the Cisco Systems Networking Academy logo, Cisco Unity, Fast Step, Follow Me Browsing, FormShare, FrameShare, IGX, Internet Quotient, IP/VC, iQ Breakthrough, iQ Expertise, iQ FastTrack, the iQ Logo, iQ Net Readiness Scorecard, MGX, the Networkers logo, ScriptBuilder, ScriptShare, SMARTnet, TransPath, Voice LAN, Wavelength Router, and WebViewer are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and Discover All That's Possible are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, FastHub, FastSwitch, GigaStack, IOS, IP/TV, LightStream, MICA, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, SlideCast, StrataView Plus, Stratm, SwitchProbe, TeleRouter, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries.

All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0110R)

Table of Contents

Windows NT or Windows 2000

Linux

Solaris