|
|
This publication contains the procedures for configuring the Cisco Content Transformation Engine (CTE) 1400 Series.
For information on installing the CTE, refer to the Cisco CTE 1400 Hardware Installation Guide.
 |
Note Throughout this publication, the Cisco CTE 1400 Series is referred to as the CTE. |
This publication consists of these sections:
Improper configuration of the CTE can result in a security risk. Before you deploy the CTE, verify that it does not have access to protected intranet sites.
By default, the CTE proxies only the web pages for which it has transformation rules. As a result, the CTE prevents access to protected servers that are on the same subnet as the CTE. If you choose to override the default, do not put the CTE on the same subnet as protected servers.
|
Note If you configure the CTE to proxy all web pages, the CTE provides access to computers on the same subnet as the web servers that are configured to work with the CTE. For example, suppose a CTE has an external IP address of 24.221.1.1 and an internal IP address of 192.168.1.31. On the same subnet, you have an intranet server protected from outside access, with an IP address of 192.168.1.20. It is possible to access all ports on the protected intranet server through the CTE by using the URL http://24.221.1.1/http://192.168.1.20. |
Also, be aware of the following security considerations:
Because IP phones do not support Secure Sockets Layer (SSL), the connection between the IP phones and the CTE is not secure. We recommend that you locate the connection between an IP phone and the CTE behind a firewall.
When Design Studio is redirected to an SSL site from a non-SSL site (from HTTPS to HTTP), the connection between Design Studio and the CTE is not secure. We recommend that you locate the connection between Design Studio and the CTE behind a firewall.
The CTE transforms and delivers applications to IP phones and a variety of mobile devices, including Wireless Application Protocol (WAP) phones and Personal Digital Assistants (PDAs). The CTE is a 1U device that installs into any network infrastructure without requiring changes to the existing hardware or back-end software. The CTE sits in front of content servers and works with other networking products such as web servers, server load balancers, cache engines, firewalls, Virtual Private Network (VPN) solutions, routers, and IEEE 802.11 broadband wireless devices.
The CTE displays ScreenTop Menu, a hierarchical services menu, on connecting devices. ScreenTop Menu provides users quick access to popular destinations such as news, sports, and travel information. You can make ScreenTop Menu always available to IP phone users by using the soft switch to set a phone or phone group's idle URL to the CTE IP address. ScreenTop Menu appears on any device when the device connects to the CTE.
Design Studio is a PC-based application that you use to create transformation rules, modify the default ScreenTop Menu, and upload your changes to a CTE.
These sections describe the CTE:
Table 1 summarizes the features of the CTE.
|
|
1 XSL = Extensible Stylesheet Language. 2 For more information, see the "Security" section. 3 PEM = Privacy Enhanced Mail. |
The CTE includes FLEXlm licensing. All devices use floating (networked concurrent) licensing. Floating licensing limits the number of concurrent CTE users to the number of licenses purchased. Floating licensing requires no setup or administration.
To obtain additional licenses, you will need to know the host ID of your CTE, as described in the "Host ID" section. You can upload a new license through the CTE Administration Console, as described in the "Uploads" section.
Internet, extranet, and intranet sites require different levels of security, all supported by the CTE. As shown in Figure 1, those sites have the following characteristics:
The CTE supports Basic authentication and NTLM proxy authentication and prompts device users for authentication credentials if they are required. In addition, the CTE transcodes authentication protocols for devices that do not natively support authentication (such as Palm devices).
The CTE terminates SSL sessions to provide an endpoint for a secure link. Some PDAs support SSL connections from the device to the CTE. However, WAP phones and the Palm VII device do not support SSL. WAP phones use Wireless Transport Layer Security (WTLS), and Palm VII devices use Elliptical Curve Cryptography (ECC). Carrier gateways usually convert WTLS and ECC to SSL; during the conversion, text is not secure.
When a new device user makes a first request through the CTE, the CTE creates a new session for that user. The CTE must store data for each session; therefore, the number of active sessions is limited by memory.
The CTE supports two configuration options to control the cache that stores session data: maximum and minimum session-timeout thresholds. Both of these settings (Session Timeout and Minimum Session Timeout) can be set through the Advanced > General screen in the CTE Administration screens. For more information, see the "General" section.
When the maximum session timeout is set and a session has not been active for the specified time period, the CTE terminates the session and wipes the data from the cache. Any session that has been inactive longer than the maximum session timeout can be removed. Data from a terminated session, which includes authentication information and other sensitive data, is physically removed from memory, preventing unauthorized access.
The minimum session timeout determines the minimum time between two requests that a session is guaranteed to be active. For example, if the minimum session timeout is set for 5 minutes, and a user requests information through the CTE every 4 minutes and 59 seconds, that session will remain active indefinitely. If the user waits more than 5 minutes between requests, the session becomes unprotected and can be replaced by a new session.
If the minimum session timeout is not set, the CTE can support the maximum number of sessions. However, not setting a minimum session timeout creates an environment in which each request initiates a new session, and there is no guaranteed stability for any session during busy periods.
The only way to increase the number of active sessions is to increase memory (RAM and/or disk) or to lower the amount of memory allocated to each user. If the memory is lowered, however, performance can suffer because the CTE must retrieve and process the data again.
Another variable affecting performance is the number of simultaneous connections. A connection is used for each request. A session can use several simultaneous connections. For example, when a user requests a web page and that page contains images, frames, and other elements, the user's browser makes one request for each element. If a page has ten elements, the initial request makes one connection to retrieve the main page, and the browser makes ten connections to retrieve the ten elements.
The CTE uses rules supplied by Design Studio to fulfill requests for wireless content. A CTE is typically installed behind a server load balancer. When a wireless device requests a web page, the CTE accepts the request from the wireless device and requests the content from the back-end servers. Functioning as a reverse-proxy, the CTE acts like a web server to the client device and acts like a client device to the web servers.
Figure 2 shows the path that a wireless user request for a web page takes when the CTE is connected to a server load balancer. This configuration is recommended for sites where most of the network traffic intercepted by the CTE uses content supplied by servers directly connected to the server load balancer.
|
Note The numbers in Figure 2 refer to the following process. |
The path the wireless user request takes is as follows:
1. A wireless user requests a URL. A wireless carrier transmits the request to a communications tower, through the WAP carrier gateway, and to the Internet.
2. The server load balancer that receives the request evaluates the request header. The server load balancer directs HTML/XML requests to the web server farm and directs requests from wireless devices to the CTE.
3. The CTE terminates the request and then, acting as a proxy, sends a request to the server load balancer for the HTML/XML page.
4. When the CTE receives the page, it uses the rules in the configuration file to transform the content.
5. The CTE sends the transformed page to the server load balancer for forwarding to the wireless device.
A variation of the preceding configuration is to direct requests from the CTE through a router that sits in front of the server load balancer, as shown in Figure 3. This configuration is recommended for sites where most of the network traffic intercepted by the CTE uses content supplied by servers at other locations. For example, a results page served by a search engine portal contains links to content that resides outside of the domain of the search site.
You can connect a CTE to a web server that routes traffic to the CTE or to web servers based on browser detection, as shown in Figure 4.
You can also connect a CTE directly to a web server, as shown in Figure 5. In this case, all web traffic goes through the CTE, which passes HTML/XML requests to the web server and handles requests from wireless devices. This configuration is recommended when you designate specific IP addresses for wireless traffic.
Figure 6 and the following procedure describe how URL requests from a wireless device are handled by the CTE and connected devices.
|
Note The numbers in Figure 6 refer to the steps in the following procedure. |
When a wireless device sends a URL to a web server, the traffic flow is as follows:
Step 2 The server load balancer that receives the request looks at the header.
Step 3 The server load balancer directs HTML/XML requests to the web server farm.
Step 4 The server load balancer directs requests from wireless devices to the CTE.
Step 5 The CTE sends the new request to the server load balancer for the HTML/XML content. The CTE, acting as a proxy, sends a request to the server load balancer for the HTML/XML content. The server load balancer obtains the content from a web server and sends it to the CTE.
Step 6 The CTE uses the rules and device definitions created in Design Studio to transform the content and then sends the transformed content to the server load balancer. The server load balancer forwards the content to the wireless device.
As shown in Figure 7, you can also route requests based on a URL, so that requests from designated URLs (such as mobile.site.com) are passed directly to the CTE.
Input encoding, the formats into which information coming to the CTE can be written, is configurable through the Administration Console. By default, input encoding is set to Western European (ISO-8859-1, Latin-1, ASCII). Only one input encoding format can be active at a time.
Output encoding, the formats into which information sent from the CTE can be written, is specified in the Device Definition File (DDF) of each device driver. If there is an error in a particular DDF file, each device driver has a hard-coded default value for output encoding. Refer to Chapter 2 of the Design Studio User Guide for output encoding formats.
The configuration instructions in this publication assume the following setup:
The "Operation Modes" section covers typical network configurations for the CTE. Use Table 2 as a guide to determining the best location for a CTE, based on network topology and website characteristics.
Table 2 CTE Network Location Guidelines
The general process for configuring a CTE and connected devices is as follows:
1. Draw a diagram of the data flow for the CTE, including all IP addresses and VLAN numbers.
2. Physically connect the CTE to the network.
Depending on your network topology, you may need to use one or both of the CTE ports (NICs).
3. Verify that the CTE can ping the device connected to it (such as a server load balancer).
4. If you are configuring multiple CTEs, associate the various CTE network connections with a CTE server farm.
5. Configure the server load balancer so that the CTE can access web content on the web servers.
6. Configure the server load balancer so that the CTE is accessible by clients requesting web content.
7. Verify that the data flow of the CTE is as planned.
8. If a client does not require in-line data transformation by the CTE, direct its traffic to the web servers if possible.
These sections describe how to configure the CTE and connected devices:
|
Note Before you deploy the CTE, verify that port 9001 is not accessible from outside of your firewall. The
CTE communicates with Design Studio through port 9001 using clear-text transmissions. Only ports 80
and 443 should be visible from outside of your firewall. Most firewalls allow administrators to deny external IP addresses access to specific ports that are set up internally. Refer to your firewall administrator guide for information on setting up rules to block specific ports. |
To connect the CTE to a network, you need two network cables. Only one cable may be necessary if you connect the CTE directly to one web server. Before configuring the CTE and connected devices, plan the network information you want to use for the following, as appropriate:
|
Note The CTE does not work with Dynamic Host Configuration Protocol (DHCP). You must use static IP addresses for the CTE. |
The first time that you power on the CTE, you are prompted to specify login credentials and basic network settings in the serial console, a command-line interface. The CTE serial console provides access to some settings and allows you to restart or shut down the CTE.
If you completed the installation procedures described in the Cisco CTE 1400 Series Hardware Installation Guide, you already have a CTE serial console open on a computer that has a serial connection to the CTE. If the CTE serial console has been closed, open it by starting the terminal emulation application and opening the connection you created to the CTE. If the CTE serial console does not open, check the following:
To configure the CTE for the first time, perform these steps:
Step 2 Enter a password of 8 or more characters. If prompted to verify the password, reenter it.
The CTE prompts for the following:
Step 3 Enter the IP address and netmask of the eth0 port and the IP address of the default gateway.
Step 4 The CTE prompts for the DNS server and domain name information:
The CTE requires one DNS server to resolve names and provides a default value for one DNS server. You can change the IP address or press Enter to accept the default value. You can also optionally set a default domain name, such as www.fox.com.
Step 5 If you make changes, the CTE prompts you to commit the changes. Type yes to commit the changes.
The Main Menu of the CTE serial console appears.
Step 6 Type 1 and then 6 to ping the connected device.
If the ping is successful, you have completed the initial configuration. If the ping is not successful, check your connections, return to the serial console Main Menu, and type 0 (Express Setup) to change settings as needed.
You can connect a CTE directly to a web server if your site has only one web server and you want all traffic destined for the web server to pass through the CTE. The CTE determines how to handle requests for web content based on the request header, which indicates the type of device making the request. The CTE intercepts requests from supported mobile devices and passes through other requests.
Connecting a CTE directly to a web server does not require any changes to the web server configuration.
The following sections describe how to connect a CTE to a web server and configure the CTE to work with the web server:
Connecting a CTE to a web server requires either one or two network cables as follows:
Figure 8 shows how to connect a CTE to a web server.
|
Note The IP addresses used throughout this publication are sample addresses, not actual ones. |
Use the CTE Administration Console to configure network settings. The following procedure notes the settings to use for the example configuration shown in Figure 8. This general procedure is used regardless of the CTE location in your network.
To configure network settings, perform these steps:
Step 2 Click Yes if a Security Alert dialog box appears.
Step 3 Click the Network tab.
You will be prompted to log in.
Step 4 Enter root in the User Name field and enter the password you specified when you first logged in to the CTE.
|
Note You can create additional administrative usernames and passwords from the CTE serial console. For information, see the "Managing Administrative User Accounts" section. |
The Network > Interfaces screen appears.
Step 5 Specify the IP address and subnet mask for interfaces 0 and 1 as follows:
Interface 0 IP Address: 192.168.2.2
Interface 0 Subnet Mask: 255.255.255.0
Interface 1 IP Address: 192.168.3.2
Interface 0 Subnet Mask: 255.255.255.0
Step 6 If needed, define the Masquerade Hosts for Interface 0 and Interface 1.
The masquerade host is an IP address that can be used for Network Address Translation (NAT). NAT makes all requests appear to originate from the same client, so that the CTE sends its response to the request back on the correct network connection. If the NAT IP address is not defined, the CTE sends responses out through the NIC where the gateway is identified.
Step 7 Use the default settings for Duplex Mode and the Maximum Transmission Unit (MTU) unless you need to change them.
Step 8 Enter the Default Gateway IP address and choose the interface used for the gateway.
For this example you would enter 10.10.20.254 and choose eth1 from the Gateway Interface menu.
Step 9 Click Submit to save your changes.
For help with configuring other network and operational settings, see the "Using the CTE Administration Console" section.
You can connect a CTE to a server load balancer. Characteristics of this configuration include the following:
If multiple CTEs are in use, each CTE has a different masquerade host IP address. In addition, the CTE modifies all URLs embedded within a page to include the masquerade host IP address. This use of the masquerade host IP address ensures that the redirected client returns to the CTE it first encountered, providing session stickiness. The association between a particular request and the CTE is broken only when the client makes a new connection on port 80.
The CTE farm and the web server farm are directly accessible through load-balanced virtual IP (VIP) addresses. This configuration enables you to direct traffic that originates from a wireless device to the CTE farm VIP address.
To operate with the CTE, the server load balancer must be configured to provide real-time header parsing.
Figure 9 shows a server load balancer setup in which CTE requests go to the server load balancer, rather than the router.
This section uses the sample configuration shown in Figure 10.
The following sequence of events occurs when a client requests content, and the SLB encounters a CTE-supported user agent string:
1. The client requests a web page from a domain.
2. The SLB forwards the request to the CTE.
3. The CTE reissues the request to the default host masquerading as the user agent.
4. The SLB receives the request and directs it to the appropriate web server.
5. The web server retrieves the content and passes it through the SLB to the CTE.
6. The CTE transforms the content and sends it back through the SLB and on to the client device.
The following sections describe how to configure a CTE with a server load balancer:
To establish the physical connection, do the following:
Use the CTE Administration Console to configure network settings. For example, specify the interfaces for CTE1 as follows:
Interface 0 IP Address: 192.168.2.1
Interface 0 Subnet Mask: 255.255.255.0
Interface 0 Masq Host: 192.168.2.1
Interface 1 IP Address: 192.168.3.1
Interface 1 Subnet Mask: 255.255.255.0
Interface 1 Masq Host: 192.168.2.1
Default Gateway: 192.168.3.254
Gateway Interface: eth1
The basic process for configuring a server load balancer is as follows:
1. Establish a serial connection to the server load balancer.
2. Define the interfaces to the VLANs.
4. Define services, owners, and content rules.
5. Disable parsing of HTTP headers received on the virtual IP addresses (improves performance).
6. Check network connectivity.
Following are the general steps for configuring a server load balancer, based on the configuration shown in Figure 10.
To configure a server load balancer for operation with a CTE, perform these steps:
Step 2 Create links between the CTE ports and the server load balancer by adding the client-side and server-side VLANs and defining the interfaces to the VLANs.
In the sample configuration in Figure 10, the e1 and e2 ports are the interfaces for VLAN2; e3 and e4 are the interfaces for VLAN3.
Step 3 Specify the IP addresses for the VLAN circuits.
In the sample configuration, the IP address for the VLAN2 circuit is 192.168.2.254. The IP address for the VLAN3 circuit is 192.168.3.254.
Step 4 Create services to identify the two CTEs.
In the sample configuration, the IP address for the CTE1 service is 192.168.2.1, and the IP address for the CTE2 service is 192.168.2.2.
Step 5 Create an owner so that you can define content rules for the CTE1 and CTE2 services.
Step 6 Create a Layer 3 content rule for the services.
In the sample configuration, the content rule is configured with the virtual IP address 192.168.3.252 and is added to the CTE1 and CTE2 services.
Step 7 Disable parsing of HTTP headers received on the virtual IP addresses.
Step 8 Check network connectivity.
If your CTE is behind a firewall or proxy server, you will need to set up CTE proxy settings through the Administration Console. For more information, see the "Proxies" section.
If there is a firewall or proxy server between the computer on which Design Studio is installed and the CTE, Design Studio users will need to specify the host and port for HTTP and HTTPS connections when logging in to Design Studio.
When setting up communication with another host or network, you will sometimes need to create a static route from the CTE to the new destination. Set up static routes on the CTE port not being used by the default gateway.
To create a static route, perform these steps:
Step 2 Enter the IP address of the destination LAN.
Step 3 Enter the subnet mask for the gateway device. The default is 255.255.255.0.
Step 4 Enter the IP address for the default gateway. If you do not specify a gateway, the CTE can access content only on the local network.
Step 5 Select the Interface for the static route. The default is eth0.
Step 6 Click Add Static Route.
To test a static route, perform these steps:
Step 2 Type 6 (Ping).
Step 3 Enter the host IP address for the device you want to ping and press Enter.
If you are successfully communicating with the other machine, messages will appear saying that the same number of packets were transmitted and received, and zero packets were lost.
If you are not communicating with the other machine, the status messages indicate that zero packets were received and all the packets were lost. Return to Step 1 and recreate the static route.
To remove a static route, perform these steps:
Step 2 Click Clear All Routes.
Suppose the IP address of the eth0 port on your CTE is 10.0.16.20 and there has been a request to access information at 129.6.0.20, to which you currently have no path. You can create a static route through the Ethernet port that is not set as your CTE default gateway, and out to the requested network address, as shown in Figure 11.
Figure 11 shows the following connections:
To set up this static route, you need to establish the path between the eth1 port and IP address 129.6.0.20.
To set up a static route, perform these steps:
Step 2 Set the IP address of the destination LAN to 129.6.0.0.
Step 3 Set the subnet mask for the gateway device to the default value, 255.255.255.0.
Step 4 Set the IP address of the default gateway to 192.168.0.1.
Step 5 Choose eth1 as the gateway device interface.
Step 6 Click Add Static Route.
From the CTE Administration Console, you can manage the CTE with a web browser. The Administration Console provides access to all CTE configuration settings, including the following:
To open the Administration Console, perform these steps:
Step 2 From a web browser, connect to the CTE by entering the URL:
Step 3 If the Security Alert dialog box appears, click Yes.
Step 4 The Main administration screen appears. From this page you can download Design Studio without logging in to the Administration Console.
Step 5 To download Design Studio, click Download Design Studio, and then specify where you want to save the Design Studio installer.
Step 6 When you select any other CTE Administration menus, the Administration Console login dialog appears.
Step 7 Enter your administrative username and password.
The Administration screen you selected appears.
|
Note When working with the Administration Console, click Submit to save changes. If a Restart Server button
appears after you submit a change, click the button before making more changes. To view information about a setting, hold the mouse over the setting and view the information area at the bottom of the screen. |
Network settings appear on the screens described in the following sections:
To specify network interfaces, perform this step:
The Network > Interfaces screen appears.
The Network > Interfaces screen contains the settings described in Table 3.
|
To specify network ports, perform this step:
The Network > Ports screen appears.
The Network > Ports screen contains the settings described in Table 4.
|
To specify DNS settings, perform this step:
The Network > DNS screen appears.
The Network > DNS screen contains the settings described in Table 5.
|
To add and remove static routes, perform this step:
The Network > Routes screen appears.
For more information, see the "Creating and Removing Static Routes" section.
To specify proxy host settings, perform this step:
The Network > Proxies screen appears.
The Network > Proxies screen contains the settings described in Table 6.
|
To map CTE hostnames to IP addresses, perform this step:
The Network > Hosts screen appears.
From the Hosts screen, you can map CTE hostnames to IP addresses. The host aliases that you define override DNS settings. Defined hosts appear in the Hosts Table.
After you add a host, you must click the Restart Server button that appears after you click Submit.
To clear all hosts, click Clear Hosts Table.
Although the CTE does not include an NIS client and thus does not support commands such as ypbind and nslookup, name resolution libraries can resolve CTE hostnames by checking the /etc/hosts file.
Settings that affect the overall operation of the CTE appear in the screens described in the following sections:
To specify general operational settings, perform this step:
The Advanced > General screen appears.
The Advanced > General screen contains the settings described in Table 7.
Table 7 General Screen Settings
|
Some IP phones require a username and password in order to accept pushed data.
To specify credentials for IP phone push operations, perform these steps:
The Advanced > IP Phone screen appears.
Step 2 Specify a username to be used as the default IP phone username.
Step 3 Specify a password to be associated with the default IP phone username.
Step 4 Click Submit.
To change the system date and time, perform these steps:
The Advanced > Date screen appears.
Step 2 Click Update Time to update the date and time on the CTE.
Logging settings appear on the screens described in the following sections:
The logging features allow you to enable or disable the logging of system performance information and view the information collected during the logging. By reviewing the information provided, you can track unusual changes that affect the stability and performance of the CTE.
To configure logging, perform this step:
The Logging > Configure screen appears.
The Logging > Configure screen contains the settings described in Table 8.
|
|
Note Before you can view the System Log, make sure that you have enabled the logging of system messages on the Logging > Configure screen. |
To view the system log, perform this step:
|
Note Before you can view health data, make sure that you have enabled the Health Log setting on the Logging > Configure screen. |
To view health data, perform this step:
The health log includes device-driver statistics, the number of requests received from each listed device, and load statistics. The load statistics displayed are as follows:
|
Note Before you can view the SNMP Log, be sure that you have enabled the logging of SNMP messages on the Logging > Configure screen. |
To view a log of SNMP messages, perform this step:
To display the version of your installed CTE, perform this step:
Administration settings appear on the screens described in the following sections:
To use Design Studio, a user must specify a username and password that are set up through the Administration > Users screen. You can also use that screen to delete Design Studio users and to change user passwords.
To add a Design Studio user account, perform these steps:
Step 2 Type a username and password.
Usernames must be must be at least 6 characters. Passwords must be at least 8 characters.
Step 3 Click Add User.
To add a Design Studio user account, perform these steps:
Step 2 Click the checkbox beside the username you want to delete.
Step 3 Click Delete User.
To reset a Design Studio user password, perform these steps:
Step 2 Click the checkbox beside the username whose password you want to reset.
Step 3 Enter a new password.
Step 4 Click Reset Password.
Use the Administration > Uploads screen to upload licenses and secure certificates and to upgrade the server.
|
Note When you upload a server upgrade, the CTE drops the active sessions, so it is best to upgrade the server when you know that traffic is at a minimum. |
To upload a file, perform these steps:
Step 2 Click the Browse button for the type of file you want to upload.
Step 3 Locate the file you want to upload and click Open.
Step 4 Click Submit to upload the file.
Step 5 If you uploaded a certificate, click Network and then Interfaces. Set the value for the Interface 0 Masq Host to the DNS name for which the certificate was registered.
When you purchase additional licenses, a salesperson will request the host ID of the CTE for which you are purchasing licenses.
The first time that you start the CTE, you must log in as root and create a password for the root account. You can create and manage additional administrative accounts through the CTE serial console.
To add, delete, and list administrative user accounts, perform these steps:
Step 2 Log in to the serial console using the root username and password.
Step 3 When the Main Menu appears, type 2 (Manage Administrative Users) and press Enter.
Step 4 Follow the on-screen prompts to manage administrative user accounts.
To change an administrative user account password, perform these steps:
Step 2 Log in to the serial console using the username whose password you want to change.
Step 3 When the Main Menu appears, type 2 (Manage Administrative Users) and press Enter.
Step 4 Follow the on-screen prompts to change a password.
Always use the CTE serial console to shut down the CTE server software. Never shut down the CTE server software by powering off the CTE.
To shut down the CTE server software, perform these steps:
Step 2 Type 1 or S and press Enter.
To restart the CTE server software, perform these steps:
Step 2 Type 0 or R and press Enter.
The CTE accepts a Privacy Enhanced Mail (PEM) format certificate file. PEM is a text format that is the Base-64 encoding of the Distinguished Encoding Rules (DER) binary format. The PEM format specifies the use of text BEGIN and END lines that indicate the type of content that is being encoded.
Before you can upload a certificate to the CTE, you will need to generate a Certificate Signing Request (CSR) and private key. We recommend using Linux OpenSSL to administer any certificate activity. If Linux is not available, we recommend the Cygwin UNIX environment for Windows, which includes an OpenSSL module. Instructions for downloading, installing, and using the Cygwin UNIX environment to generate a CSR are included in this section.
If you are familiar with certificate manipulation, you can use other tools to create a PEM formatted file. The certificate that you upload to the CTE must have the following characteristics:
The following sections describe how to perform the tasks associated with generating a CSR:
If you are unfamiliar with generating a CSR, review this section for background information.
The general process for generating a CSR and handling the signed certificate is as follows:
1. Generate a CSR (public.csr) and private key (private.key) as described in the "Generating a CSR" section.
2. Send the public.csr file to an authorized certificate provider.
3. If you used a tool other than the Cygwin UNIX environment to generate the CSR, check the format of the private key. If it is in DER format or is encrypted, convert it to PEM format as described in the "Unencrypting the Private Key" section.
4. When you receive the signed certificate file from your SSL certification company, check the file format. If it is in binary DER format, convert it to PEM format as described in the "Converting to a PEM Formatted Certificate" section.
5. Combine the PEM formatted signed certificate with the PEM formatted private key (private.key) as described in the "Combining the Private Key with the Signed Certificate" section.
6. If your certificate has more than one level, handle the intermediate certificates as described in the "Generating Trusted Certificates for Multiple Levels" section.
7. Upload the certificate to the CTE as described in the "Uploads" section.
If Linux OpenSSL is not available, install the Cygwin UNIX environment for Windows. When you install Cygwin, you must choose the OpenSSL modules as described in the following steps.
To install Cygwin, perform these steps:
Step 2 Follow the on-screen instructions to open the setup installer.
Step 3 In the Cygwin Setup dialog box, click Next.
Step 4 Click Install from Internet and then click Next.
Step 5 Accept the default root installation directory settings and then click Next.
Step 6 Accept the default local package directory setting and then click Next.
Step 7 In the Internet Connection screen, click Use IE5 Settings and then click Next.
Step 8 In the list of Available Download Sites, click ftp://ftp.nas.nasa.gov and then click Next.
Step 9 In the Select Packages screen, click the View button (upper-right corner).
Step 10 Scroll the packages list to locate in the Package column openssl: The OpenSSL runtime environment and openssl-devel: The OpenSSL development environment.
Step 11 In the New column for those two entries, click Skip.
The current version number of Cygwin appears.
Step 12 Click Next to start the installation.
After Cygwin installs, you can generate the CSR.
These instructions to generate a CSR assume that you are using the Cygwin UNIX environment installed as described in the "Installing the Cygwin UNIX Environment for Windows" section.
To generate a CSR using the Cygwin UNIX environment, perform these steps:
A command window opens with a UNIX bash environment.
Step 2 To change to a particular drive, use the command: cd driveLetter:
Step 3 At the $ prompt, type the following to generate a CSR:
Status messages about the private key generation appear. You will be prompted for information such as country name.
Step 4 When prompted for the Common name, enter the DNS name of the CTE.
The name that you enter will appear in the certificate and must match the name expected by PCs that connect to the CTE. Thus, if you alias DNS names, you will need to use the alias name instead.
Step 5 Submit your CSR (public.csr) to an authorized certificate provider such as Verisign.
The certificate provider will return a Signed Certificate to you by e-mail within several days.
The following procedure is not needed if you use the Cygwin UNIX environment to generate the CSR and private key. Follow this procedure only if the method you use to generate the private key results in an encrypted key.
To unencrypt the private key, perform these steps:
A command window opens with a UNIX bash environment.
Step 2 To change to a particular drive, use the command: cd driveLetter:
Step 3 At the $ prompt enter the command: openssl rsa
If you enter this command without arguments, you will be prompted as follows:
Step 4 Enter the name of the password to be encrypted.
You can enter the openssl rsa command with arguments if you know the name of the private key and the unencrypted PEM file.
For example, if the private key filename is my_keytag_key.pvk, and the unencrypted filename is keyout.pem, you would enter openssl rsa -in my_keytag_key.pvk -out keyout.pem.
For more information, refer to the following URL:
http://www.openssl.org/docs/apps/rsa.html#EXAMPLES
For information on downloading OpenSSL for Windows, refer to the following URL:
http://sourceforge.net/project/showfiles.php?group_id=23617&release_id=48801
When you receive the signed certificate file from your certificate provider, check the file format. If it is in binary DER format, convert it to PEM format.
To convert a certificate to PEM format, perform these steps:
A command window opens with a UNIX bash environment.
Step 2 To change to a particular drive, use the command: cd driveLetter:
Step 3 At the $ prompt enter the command:
You must combine the signed certificate with the private key before you can upload it to the CTE.
To combine the private key with the signed certificate, perform these steps:
The file contents should look similar to the following:
Step 2 Save and name the PEM file. For example, CTE.pem.
 |
Caution Any certificate that has more than one level must include all intermediate certificates, or the system may become unusable. |
You must determine whether your certificate has more than one level and, if it does, handle the intermediate certificates properly.
To generate trusted certificates for multiple levels, perform these steps:
Step 2 Open Internet Explorer, and access a page through the CTE. For example, enter a URL similar to the following:
https://ipAddress:httpPort//www.mypage.com
Step 3 Double-click the Lock symbol in the bottom right corner of the browser.
Step 4 Switch to the Certificate Path window pane at the top of the screen.
Step 5 Double-click the first path level to bring up the Certificate information for the first level and then go to the Details screen.
Step 6 Click the Copy to File button at the bottom.
Step 7 After the Certificate Export Wizard appears, click Next.
Step 8 Click the format Base-64 encoded and then click Next.
Step 9 Enter a filename. For example, G:\tmp\root.cer.
Step 10 Review the information and note the complete filename. Click Finish.
Step 11 Click OK to close the Certificate information window for the first level.
Step 12 Repeat Steps 5-11 for all levels except the last level.
Step 13 Insert all certificates into one file, and make sure that any intermediate certificates are part of any certificate file you upload.
The format of the uploaded file should be the following:
private key
Server Certificate
Intermediate Certificate 0
Intermediate Certificate 1
Intermediate Certificate 2
If the CTE device fails, follow the instructions in the CTE Hardware Installation Guide for diagnosing and recovering from a hardware failure. Once the hardware is operational, reinstall the CTE server software from the CD provided with the device.
To reinstall the CTE server software, perform these steps:
Step 2 When the installation completes, power off the CTE.
Step 3 Power on the CTE. As the device starts, eject the CD.
The CTE serial console displays a message informing you whether the installation was successful.
The following information explains how to deal with problems you might encounter when setting up and using the CTE.
Verify that the following are correctly set up:
Verify that the following are correctly set up:
If you are sure that the rules are correctly created and applied in Design Studio and that they have been uploaded to the CTE, verify the CTE configuration as follows:
The reboot function on the CTE is disabled. You must use the CTE serial console to start and stop the device.
By default, the CTE redirects traffic from HTTP to HTTPS. European-made phones do not support those secure redirects, so if you are using this type of phone you must disable secure redirects for the CTE. To do that, go to the CTE Administration Console, and under the General screen on the Advanced tab, set the Security field to No HTTPS, and click the Submit button to commit the change. (Be aware that no HTTPS sites can be proxied when you set this field to No HTTPS.)
If intermediate (multi-level) certificates are part of your secure certificate upload, you need to make sure that the intermediate certificates are part of the certificate file you are uploading. SSLV2 does not support certificate chaining. Any certificate that has more than one level must include all intermediate certificates, or the system may become unusable. For information about how to add intermediate certificates to the uploaded certificate file, see the "Generating a Secure Certificate for the CTE" section.
For more information about the CTE, refer to the following publications:
For information about Design Studio, refer to the Design Studio User Guide.
The following sections explain how to obtain documentation from Cisco Systems.
You can access the most current Cisco documentation on the World Wide Web at the following URL:
Translated documentation is available at the following URL:
http://www.cisco.com/public/countries_languages.shtml
Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which is shipped with your product. The Documentation CD-ROM is updated monthly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual subscription.
Cisco documentation is available in the following ways:
http://www.cisco.com/cgi-bin/order/order_root.pl
http://www.cisco.com/go/subscription
If you are reading Cisco product documentation on Cisco.com, you can submit technical comments electronically. Click the Fax or Email option under the "Leave Feedback" section at the bottom of the Cisco Documentation home page. After you complete the form, print it out and fax it to Cisco at 408 527-0730.
You can e-mail your comments to bug-doc@cisco.com.
To submit your comments by mail, use the response card behind the front cover of your document, or write to the following address:
Cisco Systems
Attn: Document Resource Connection
170 West Tasman Drive
San Jose, CA 95134-9883
Cisco provides Cisco.com as a starting point for all technical assistance. Customers and partners can obtain documentation, troubleshooting tips, and sample configurations from online tools by using the Cisco Technical Assistance Center (TAC) Web Site. Cisco.com registered users have complete access to the technical support resources on the Cisco TAC Web Site.
Cisco.com is the foundation of a suite of interactive, networked services that provides immediate, open access to Cisco information, networking solutions, services, programs, and resources at any time, from anywhere in the world.
Cisco.com is a highly integrated Internet application and a powerful, easy-to-use tool that provides a broad range of features and services to help you to:
You can self-register on Cisco.com to obtain customized information and service. To access Cisco.com, go to the following URL:
The Cisco TAC is available to all customers who need technical assistance with a Cisco product, technology, or solution. Two types of support are available through the Cisco TAC: the Cisco TAC Web Site and the Cisco TAC Escalation Center.
Inquiries to Cisco TAC are categorized according to the urgency of the issue:
Which Cisco TAC resource you choose is based on the priority of the problem and the conditions of service contracts, when applicable.
The Cisco TAC Web Site allows you to resolve P3 and P4 issues yourself, saving both cost and time. The site provides around-the-clock access to online tools, knowledge bases, and software. To access the Cisco TAC Web Site, go to the following URL:
All customers, partners, and resellers who have a valid Cisco services contract have complete access to the technical support resources on the Cisco TAC Web Site. The Cisco TAC Web Site requires a Cisco.com login ID and password. If you have a valid service contract but do not have a login ID or password, go to the following URL to register:
http://www.cisco.com/register/
If you cannot resolve your technical issues by using the Cisco TAC Web Site, and you are a Cisco.com registered user, you can open a case online by using the TAC Case Open tool at the following URL:
http://www.cisco.com/tac/caseopen
If you have Internet access, it is recommended that you open P3 and P4 cases through the Cisco TAC Web Site.
The Cisco TAC Escalation Center addresses issues that are classified as priority level 1 or priority level 2; these classifications are assigned when severe network degradation significantly impacts business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer will automatically open a case.
To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to the following URL:
http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml
Before calling, please check with your network operations center to determine the level of Cisco support services to which your company is entitled; for example, SMARTnet, SMARTnet Onsite, or Network Supported Accounts (NSA). In addition, please have available your service agreement number and your product serial number.
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of DUB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED "AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
CTE Configuration Note
Copyright © 2001—2002, Cisco Systems, Inc.
All rights reserved.
Posted: Mon Aug 18 15:18:04 PDT 2003
All contents are Copyright © 1992--2003 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.
